Bybit<\/b> has secured a U.S. court order freezing crypto assets linked to the roughly <\/span>$1.5 billion <\/b>hack in February 2025, as it pursues a civil lawsuit against <\/span>North Korea<\/b>, the Reconnaissance General Bureau, and the <\/span>Lazarus Group<\/b>. Filed in the U.S. District Court for the District of Columbia on August 7, 2026, the lawsuit marks a new legal escalation in asset-recovery efforts following the attack attributed by the FBI to hackers linked to North Korea.<\/span><\/p>\n According to an <\/span>August 7 announcement by Bybit<\/span><\/a>, the civil lawsuit targets the Democratic People\u2019s Republic of Korea, the Reconnaissance General Bureau, and the Lazarus Group. The Lazarus Group is a hacker group frequently associated by U.S. authorities with North Korea\u2019s state-sponsored cyber operations. This represents a notable legal move as Bybit is utilizing U.S. courts to preserve traced assets, rather than relying solely on criminal investigations, on-chain alerts, or voluntary cooperation from crypto platforms.<\/span><\/p>\n The preliminary injunction order prohibits the transfer or dissipation of assets identified as linked to the incident. Bybit stated that the court found the exchange had demonstrated a \u201clikelihood of success on the merits,\u201d meaning it possesses a sufficiently strong legal basis at the initial stage of the lawsuit. The company also said it would continue to seek further judicial remedies as the legal proceedings progress.<\/span><\/p>\n According to Bybit, approximately <\/span>$48.4 million<\/b> in stolen assets has been recovered, while more than <\/span>$30.5 million <\/b>remains frozen across over 28 exchanges and custodians. While these figures still represent only a small fraction of the total losses, they show that recovery efforts have entered a phase with clearer legal leverage.<\/span><\/p>\n In crypto, stolen assets can be split, swapped, and routed across multiple blockchains before the victim can request a freeze. Therefore, a preliminary injunction from a U.S. court provides Bybit with additional legal grounds to demand that exchanges, custodians, or holders of relevant assets preserve the traced funds.<\/span><\/p>\n Notably, the lawsuit targets entities alleged to have ties to the North Korean state, rather than a private hacker group. The FBI previously attributed the Bybit hack to North Korea\u2019s <\/span>TraderTraitor<\/b> activity and warned that the stolen assets had been converted and dispersed across multiple blockchain addresses. This makes the recovery process heavily reliant on coordination between on-chain analytics, court orders, and compliant intermediaries.<\/span><\/p>\n The court order does not mean Bybit will recover all of the stolen funds. However, it helps the exchange exert further legal pressure at points where the funds touch controllable systems, particularly centralized exchanges and custodians. For assets that have passed through bridges, DEXs, mixers, or non-compliant platforms, recovery remains an open question.<\/span><\/p>\n The lawsuit stems from the <\/span>February 2025 Bybit hack<\/span><\/a>, one of the largest crypto thefts ever recorded. According to <\/span>Bybit\u2019s incident timeline<\/span><\/a>, the attack occurred on February 21, 2025, and affected a single Ethereum cold wallet of the exchange. Bybit stated that losses reached approximately<\/span> $1.46 billion<\/b>, including 401,347 ETH, 90,375 stETH, 15,000 cmETH, and 8,000 mETH.<\/span><\/p>\n Bybit stated that the attacker exploited the transaction signing process of its Safe multisig cold wallet, causing a malicious transaction to be approved and allowing assets to leave the ETH cold wallet. Following the incident, <\/span>CEO Ben Zhou<\/b> stated that Bybit remained solvent and customer assets were backed 1:1, even if the hacked funds were not recovered.<\/span><\/p>\nBybit Turns to U.S. Court for Asset Recovery<\/b><\/h2>\n
Why the Injunction Matters<\/b><\/h2>\n
The Hack Behind the Case<\/b><\/h2>\n
![\"North](\"https:\/\/nftevening.com\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-11-at-00.58.56.jpg\")