Bybit Files Federal Lawsuit Against North Korea Over $1.5B Hack

The legal action follows a February 21, 2025, breach where hackers drained over 400,000 Ether from the Dubai-based platform. While the FBI quickly attributed the attack to state-sponsored North Korean actors, tracing the funds proved increasingly difficult as the perpetrators funneled assets through mixers and cross-chain protocols. By April 2025, Bybit CEO Ben Zhou estimated that more than a quarter of the stolen holdings had effectively gone dark.

To prevent further dissipation of the remaining funds, a federal judge has granted a preliminary injunction. This order freezes specific assets held by unidentified John Doe defendants, prohibiting them from transferring or liquidating the property while the litigation proceeds. Although this does not constitute a final judgment on ownership, it provides Bybit a formal mechanism to challenge the movement of stolen capital. The exchange, which covered the initial shortfall through internal reserves and loans to ensure customer liquidity, maintains that this civil pursuit operates independently of ongoing U.S. criminal investigations into North Korean cyber operations.