Overview
- Bybit filed a civil suit in Washington, D.C., naming the DPRK, its Reconnaissance General Bureau and the Lazarus Group, and won a preliminary injunction on Aug. 7, 2026 that bars transfers of identified wallets while the case moves forward.
- The judge also granted expedited discovery that lets Bybit seek account names, balances and transaction records from U.S.-linked exchanges and custodians to trace stolen funds.
- The underlying theft occurred on Feb. 21, 2025 when attackers used a compromised Safe{Wallet} multisig developer environment to drain more than 400,000 ETH and staked ETH, worth about $1.5 billion at the time.
- Bybit says roughly $48.4 million has been recovered and about $30.5 million remains frozen across more than 28 platforms, but its June filing reported about 90.2% of the theft had become untraceable after mixers, bridges and OTC trades.
- The case shows how civil courts can force intermediaries to preserve crypto, but it also highlights structural limits: native self‑custody, rapid cross‑chain laundering and OTC channels make most large recoveries unlikely and could invite competing claims on frozen assets.