Bybit Hack Takes New Turn as US Court Freezes More Stolen Crypto

TLDR:

• Bybit hack recovery has entered a new legal phase after a U.S. court granted a preliminary injunction freezing identified assets tied to unnamed defendants.
• Bybit says about $48.4 million has been recovered, while roughly $30.5 million remains frozen across more than 28 exchanges and custodians.
• The lawsuit names North Korea, its Reconnaissance General Bureau, and Lazarus Group while operating separately from ongoing U.S. criminal investigations.
• Chainalysis estimates North Korean hackers stole at least $2.02 billion in crypto during 2025, with the February Bybit attack driving most of that total.

Bybit’s legal response to the February 2025 Bybit hack has moved into federal court, adding another route for asset recovery. The exchange filed suit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group in Washington, D.C. A judge also granted a preliminary injunction covering identified stolen assets tied to unnamed defendants. 

Bybit says the order blocks transfers or other dissipation while litigation proceeds. The exchange has recovered about $48.4 million and frozen another $30.5 million across more than 28 exchanges and custodians. Most of the stolen crypto from the $1.5 billion attack remains under active tracing efforts.

Bybit Hack Lawsuit Adds Court Protection for Frozen Assets

Bybit filed the civil case in the U.S. District Court for the District of Columbia. The complaint names the Democratic People’s Republic of Korea, the Reconnaissance General Bureau, and Lazarus Group as defendants. It also includes unidentified people and entities accused of holding or moving stolen crypto. The lawsuit seeks to preserve recoverable digital assets while Bybit pursues claims through the federal civil process.

The preliminary injunction applies to identified assets connected with those unnamed defendants. Bybit says the order prevents transfers, sales, or dissipation while the case develops. The court also found that the exchange had demonstrated a likelihood of success on the merits at this stage. The order does not determine final ownership or complete the recovery process.

The Bybit hack took place on February 21, 2025, when attackers removed nearly $1.5 billion in ether from the exchange. Chainalysis describes the incident as the largest digital heist in cryptocurrency history. Bybit hack later became central to estimates of North Korean crypto theft during 2025.

Chainalysis estimates North Korean hackers stole at least $2.02 billion in cryptocurrency during 2025. That figure rose 51% from 2024 and pushed the group’s estimated cumulative theft to $6.75 billion. The Bybit hack accounted for most of that annual total.

Bybit says the civil lawsuit does not replace criminal investigations by U.S. authorities. The exchange continues sharing blockchain intelligence and investigative findings with agencies, including the FBI. It also works with analytics firms, exchanges, custodians, and international law enforcement partners.

Lazarus Group Asset Tracing Extends Across Global Platforms

Meanwhile, Bybit says approximately $48.4 million linked to the Bybit hack has already been recovered. Another $30.5 million remains frozen across more than 28 exchanges and custodians. Those funds remain subject to further legal and investigative procedures as recovery efforts continue.

Freezing stolen crypto does not automatically return it to an exchange. Investigators must identify assets, establish links to the theft, and work with platforms holding the funds. Court orders can then restrict movement while ownership and recovery issues proceed through legal channels.

The Lazarus Group has used several laundering routes after major cryptocurrency thefts. Chainalysis has documented bridge services, mixing protocols, and smaller transaction tranches in North Korean laundering patterns. These methods can spread stolen crypto across many addresses and networks.

Bybit says enforcement actions have also targeted services allegedly used to move illicit proceeds. German authorities dismantled the eXch cryptocurrency exchange, while German and Swiss authorities later disrupted Cryptomixer.io. Bybit links those actions to wider efforts against laundering infrastructure connected with stolen funds.

The exchange says it will seek additional judicial relief as the case proceeds. That process may include further requests involving assets already identified through tracing work. The preliminary injunction currently covers identified assets held or moved by John Doe defendants named in the lawsuit.

The remaining recovery task is still substantial. The recovered and frozen amounts total about $78.9 million, representing only a fraction of the original $1.5 billion loss. Bybit continues tracing wallets, transactions, exchanges, custodians, and services connected with the stolen crypto as the federal case remains active.

The post Bybit Hack Takes New Turn as US Court Freezes More Stolen Crypto appeared first on Blockonomi.