Bybit Sues DPRK and Lazarus, Freezes $1.5B Theft Assets in Preliminary Injunction

Bybit said it filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group, alleging a February 2025 cyberattack involving a $1.5 billion theft. A preliminary injunction has been issued to freeze identified stolen digital assets. The order bars defendants from transferring or dissipating those funds while the case proceeds. Bybit said the court found it showed a “likelihood of success on the merits,” and framed the action as a way to preserve potentially recoverable assets alongside parallel criminal investigations. Bybit emphasized it will pursue the case independently of U.S. government criminal proceedings, while continuing to cooperate with agencies including the FBI through blockchain intelligence sharing. Progress updates: Bybit reported about $48.4 million recovered and around $30.5 million frozen across more than 28 exchanges and custodians, pending further legal and investigative steps. The latest release also highlights related enforcement: German authorities dismantled the eXch exchange, and German/Swiss authorities disrupted Cryptomixer.io, targeting infrastructure used to launder illicit proceeds. For crypto traders, this is primarily a legal and asset-recovery development around a major incident. It may reduce near-term uncertainty about some stolen-funds locations, but it is not expected to directly change network fundamentals or spot flows for major tokens. Watch for follow-up filings and any expanded freezes or restitution timelines as the Bybit case advances.