Overview
- Bybit filed a civil suit in the U.S. District Court for the District of Columbia naming the DPRK, its Reconnaissance General Bureau, and the Lazarus Group and obtained a preliminary injunction that bars identified defendants from moving certain stolen holdings.
- The case stems from the February 21, 2025 breach that drained more than 400,000 ETH and staked ETH, a theft U.S. authorities later attributed to DPRK-linked Lazarus actors.
- The court has granted Bybit expedited discovery powers that let the exchange seek account identities, balances, and transaction records from U.S.-based platforms to trace and seize assets tied to the theft.
- Bybit’s filings and chain-analysis firms show roughly 90% of the $1.5 billion was routed through mixers, cross‑chain bridges, and OTC channels and is now largely untraceable, while only a small share—tens of millions of dollars, about 5%—has been frozen or recovered so far.
- The lawsuit highlights a Safe{Wallet} supply‑chain vulnerability used in the attack, underscores limits to recovering native self‑custodied ETH or BTC, and could set a legal template for exchanges seeking to stop or reclaim laundered crypto.