What exactly happened?
Crypto exchange Bybit has filed a civil lawsuit against North Korea (DPRK), its intelligence agency and the Lazarus Group hacking outfit. The suit was brought before the federal court for the District of Columbia and concerns a large-scale cyberattack from February 21, 2025, reports Incrypted, citing the court filing.
The attack saw roughly $1.5 billion in crypto assets stolen. Sources cite the figure of $1.5 billion (Decrypt) as well as a more precise $1.46 billion (Incrypted). It ranks as one of the largest thefts in crypto history.
What did the court order?
Alongside filing the lawsuit, Bybit obtained a preliminary injunction that bars the movement of the stolen funds, according to Incrypted.
The U.S. court also backed Bybit's request for so-called expedited discovery. This allows the exchange to demand from platforms with a U.S. presence the identities of accounts, their balances and transaction histories, Cointelegraph reports. The goal is to trace where the stolen funds flowed.
How much has been recovered?
The figures published by Bybit itself show that so far this is only a fraction of the stolen sum.
| Item | Amount |
|---|---|
| Total stolen (February 2025) | approx. $1.5 billion |
| Recovered | $48.4 million |
| Additionally frozen | $30.5 million |
| Number of entities where funds are frozen | more than 28 exchanges and custodians |
Source: Decrypt and Incrypted. The frozen $30.5 million sits, according to Incrypted, across more than 28 exchanges and custodians.
Who is the Lazarus Group?
The Lazarus Group is a hacking outfit long associated with North Korea. Bybit names it in its lawsuit as an actor in the attack alongside the DPRK state itself and its intelligence agency (Incrypted). The attribution of the attack rests on the plaintiff's claims; the court proceedings are yet to unfold.
What we don't know yet?
The lawsuit is at its very beginning. It is not known how (or whether) North Korea will respond to it, nor how enforceable any eventual judgment will be against a state that lies beyond the reach of U.S. authorities. It is also not clear from the available sources how much of the total stolen amount will ultimately be recovered beyond the figures cited today.
What to watch for in this type of case
This is a report about a legal action and its immediate effects, not a recommendation to take any action. In cases like this it is worth separating three things: what is documented by the court filing (the lawsuit and the injunction), what the injured party claims (the scale of the damage and the attribution of the attack) and what remains open (the final rate of fund recovery). charliedesk will monitor whether the published figures on recovered and frozen funds change over time.