Overview
- The attackers drained more than 400,000 ETH from Bybit on February 21, 2025, worth about $1.5 billion at the time.
- Bybit filed a civil suit in U.S. District Court for the District of Columbia on August 7, 2026, naming the DPRK, the Reconnaissance General Bureau and the Lazarus Group and listing unidentified holders as John Doe defendants.
- A federal judge granted a preliminary injunction that freezes identified stolen assets and authorizes expedited discovery aimed at exchanges and custodians to turn blockchain tracing into enforceable freezes.
- Investigators say most funds were moved through cross‑chain bridges, mixers and peel‑chain patterns, which rapidly eroded traceability and left recovery limited so far to about $48 million recovered and $31 million frozen across more than 28 platforms.
- The lawsuit asks the court to apply exceptions to the Foreign Sovereign Immunities Act for state‑backed wrongdoing and could create a legal template to force custodial compliance and raise the cost of laundering for future attacks.