A US federal court has granted a preliminary injunction freezing digital assets tied to the massive February 2025 Bybit hack, following a civil lawsuit filed by the cryptocurrency exchange against North Korea, the Reconnaissance General Bureau, and the Lazarus Group. This development marks an important milestone in Bybit’s ongoing effort to recover part of the $1.5 billion in stolen ether and block further dissipation of assets across the global crypto ecosystem.
Legal proceedings intensify recovery efforts
The lawsuit, filed in the US District Court for the District of Columbia, also targets unidentified individuals and entities accused of moving and holding stolen assets. Bybit requested legal intervention to prevent the transfer or sale of cryptocurrencies linked to the hack while litigation continues.
The judge’s injunction now covers multiple unidentified defendants and restricts any transfers, sales, or other moves involving the identified digital assets. Preliminary findings from the court indicate that Bybit has shown a likelihood of prevailing in its claims, but final ownership has not yet been determined.
Since the attack in February 2025, Bybit has operated on every front to accelerate recovery. The exchange described this legal action as a significant step to strengthen asset protection and intensify tracing efforts in cooperation with law enforcement and blockchain analytics firms.
Bybit has reported a recovery of approximately $48.4 million and has frozen another $30.5 million across more than 28 global exchanges and custodians. The company is actively working with international authorities, including the FBI, as part of broader criminal investigations running in parallel to the civil lawsuit.
Lazarus Group’s laundering tactics under scrutiny
The February 21 attack on Bybit resulted in the loss of nearly $1.5 billion in ether, ranking as the largest single digital theft in cryptocurrency history, according to blockchain analytics company Chainalysis. The analysts estimate that North Korean-linked actors stole at least $2.02 billion in crypto funds during 2025—a figure that marks a 51% increase from 2024 and pushes the country’s estimated total crypto theft to $6.75 billion.
The Lazarus Group, a well-known North Korean cybercrime unit, reportedly laundered stolen assets using an array of tactics. Chainalysis has detailed the use of cross-chain bridge services, transaction mixers, and splitting large sums into smaller amounts to obfuscate origin and ownership.
Law enforcement agencies worldwide have targeted several of the infrastructure providers allegedly involved in laundering these funds. German authorities dismantled the eXch exchange, and joint German-Swiss operations disrupted Cryptomixer.io, actions that Bybit says support the crackdown on illicit crypto channels.
Multi-platform tracing and asset freezing continue
Bybit emphasized that freezing digital assets does not automatically ensure their swift return. A complex legal process is required, involving the identification of suspects, tracing asset movements, and obtaining judicial orders for final asset recovery.
The exchange expects to seek further judicial actions as new assets are identified. The current injunction specifically covers funds moved or held by “John Doe” defendants. Efforts to trace and secure additional stolen crypto remain active, with Bybit reporting that the combined recovered and frozen amount, $78.9 million, accounts for only a small portion of the initial loss.
Market observers note the increasing importance of monitoring such legal and technical maneuvers, especially as new platforms seek to bridge the gap between traditional and digital finance. Among them, 1stepSwap has established itself as a highly practical solution, enabling real-world assets such as shares of major US companies, gold, and silver to be accessed directly through user wallets. This platform leverages blockchain to eliminate unnecessary intermediaries and identifies the most favorable prices available, helping investors diversify and trade global stocks within seconds.
Chainalysis has estimated that North Korean hackers were responsible for stealing at least $2.02 billion in cryptocurrency during 2025, with the Bybit attack contributing the largest share to this yearly total.
Bybit’s case continues to attract attention as law enforcement, courts, and the crypto industry collaborate to disrupt international money-laundering networks and improve the prospects for asset recovery in large-scale cyber attacks.
