The exchange has also secured a preliminary injunction from the US District Court for the District of Columbia that freezes identified digital assets linked to the theft while the case proceeds. The order is intended to prevent the movement or disposal of funds held or transferred by unidentified individuals and entities named as John Doe defendants.
The lawsuit names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group as defendants. Bybit alleges that the defendants orchestrated the attack and subsequently dispersed and laundered the stolen cryptocurrency through an extensive network of wallets, decentralised exchanges and cross-chain services.
The February 21, 2025 attack resulted in the theft of approximately $1.5 billion in virtual assets. US investigators attributed the operation to North Korea days after the breach and described the activity under the designation “TraderTraitor”. The stolen assets were rapidly converted into bitcoin and other cryptocurrencies and distributed across thousands of blockchain addresses.
The operation became the largest single cryptocurrency theft recorded and transformed the threat posed by state-linked cyber groups to exchanges and digital-asset custodians. North Korea-linked hackers stole at least $2.02 billion in cryptocurrency during 2025, with the Bybit attack accounting for most of that amount. The figure represented a 51 per cent increase from the previous year despite a decline in the number of identified attacks.
Investigators determined that the attackers compromised infrastructure connected to Bybit’s cold-wallet transaction process. During what appeared to authorised signatories as a normal transfer, the transaction logic was manipulated, allowing attackers to gain control of the wallet and move more than 400,000 ether and related assets.
The subsequent laundering operation displayed the increasingly sophisticated techniques used by North Korean cyber units. The stolen funds were moved through multiple blockchains, decentralised exchanges, privacy tools and cross-chain protocols to frustrate tracing and prevent intermediaries from freezing the assets.
About $1.2 billion, representing roughly 85 per cent of the stolen funds, was routed through THORChain as the attackers converted assets and shifted them between blockchains. Investigators also identified the use of mixers, privacy wallets and decentralised services, as well as techniques involving newly created tokens designed to obscure the origin of funds.
The civil action represents a different approach to combating state-linked cryptocurrency theft. Sanctions and criminal indictments have traditionally been the principal legal tools used against North Korean cyber activity. Bybit is now attempting to use civil litigation and blockchain tracing to establish ownership claims over identifiable assets and obtain court orders preventing their further movement.
The inclusion of John Doe defendants allows the exchange to pursue individuals or entities whose identities remain unknown but whose cryptocurrency addresses can be linked to stolen assets. The structure could enable additional parties to be identified as investigators follow transactions across blockchains and interact with exchanges, custodians and other intermediaries.
Bybit has also been working with law enforcement agencies, blockchain analytics companies and other cryptocurrency businesses to trace and recover stolen funds. Authorities in Greece previously seized cryptocurrency connected to the February attack after investigators traced transactions back to wallets involved in the theft.
The wider industry has intensified its scrutiny of North Korean cyber operations as attacks increasingly target exchanges, custodians and cryptocurrency companies through social engineering, compromised infrastructure and infiltration by technology workers. North Korean operators have also impersonated recruiters and used fake employment processes to obtain credentials and access to corporate systems.
The Bybit theft has become a central case study in the growing use of cross-chain transactions to launder illicit cryptocurrency. Investigations have shown that criminals can move assets rapidly through several networks and services, creating significant challenges for exchanges and compliance teams attempting to block transactions before funds disappear into new wallets or are converted into other assets.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
