Bybit has obtained a court injunction to freeze cryptocurrency assets connected to a hack attributed to North Korea, CryptoBriefing reported. The move gives the exchange a legal mechanism to restrict the movement of funds tied to the incident while investigations continue.
Bybit has been a repeated target of large-scale cyberattacks. The exchange suffered one of the largest crypto hacks on record in early 2025, when attackers linked by investigators to North Korean state-sponsored groups drained a significant portion of its digital asset reserves. That incident drew widespread attention across the industry and intensified scrutiny of exchange custody practices.
Court injunctions of this kind allow victims of theft to legally compel exchanges, custodians, or other intermediaries to freeze assets before they can be moved, converted, or laundered further. In crypto cases, this often means blocking wallet addresses or halting withdrawals tied to flagged transactions. Because blockchain transactions are traceable but not easily reversible, injunctions are frequently the fastest available tool to slow down the dispersal of stolen funds.
North Korea has been repeatedly linked by cybersecurity researchers and government agencies to a pattern of cryptocurrency theft targeting exchanges and decentralized platforms. Analysts have said funds stolen in such attacks are often used to support state programs, though attribution in individual cases can be difficult to confirm with certainty. Investigators typically rely on wallet clustering, transaction tracing, and exchange cooperation to identify stolen funds as they move through the crypto ecosystem.
The injunction reported by CryptoBriefing suggests Bybit is pursuing formal legal channels alongside blockchain forensic tracking to contain and potentially recover assets connected to the hack. Details on the specific amount frozen, the jurisdiction involved, or the parties named in the order were not included in the available reporting.
Exchanges facing large-scale thefts often combine legal action with technical measures, including coordination with other platforms to flag and freeze suspicious wallets. This approach reflects a broader trend in the industry, where victims increasingly seek court backing to formalize freezes that might otherwise rely solely on voluntary cooperation from other exchanges or blockchain analytics firms.
Sources disagree on this story
This article was published before the reports below were compared. The reporting above stands; what follows is where the published accounts do not agree.
Reports on Bybit's lawsuit against North Korea agree on the hack and the injunction but give conflicting filing dates and recovered/frozen fund totals.
What all sources agree on
- The hack occurred on Feb. 21, 2025, and involved the theft of approximately $1.5 billion in Ethereum from Bybit.
- Attackers compromised Safe{Wallet} infrastructure/software to carry out the theft.
- The FBI attributed the attack to North Korea.
- Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group.
- A federal court granted a preliminary injunction/temporary restraining order freezing certain stolen assets held by unidentified defendants.
- The lawsuit invokes the Racketeer Influenced and Corrupt Organizations Act (RICO), seeking roughly $1.5 billion plus punitive/treble damages.
- Chainalysis estimates North Korea has stolen a cumulative $6.75 billion in cryptocurrency.
Where the reports disagree
1Date the lawsuit was filed
The civil lawsuit, filed on August 7, 2026, names the Democratic People’s Republic of Korea, its intelligence arm the Reconnaissance General Bureau, and the infamous Lazarus Group as defendants.
Bybit filed the lawsuit under seal on June 18 against North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 unidentified defendants.
The company filed the civil lawsuit under seal on June 18, 2026, in the U.S. District Court for the District of Columbia. It became public this week.
What would settle it: The court docket for the case in the U.S. District Court for the District of Columbia, which would show the actual filing date and any seal/unseal orders.
2Amount of stolen funds recovered or frozen
The remaining 9.8% had been traced to identifiable wallets, including 5.3% of the total, about $75.5 million, that had been frozen or recovered.
So far, Bybit has recovered about $48.4 million and frozen another $30.5 million across more than 28 exchanges and custodians.
What would settle it: Bybit's own accounting of recovered and frozen assets, or court filings itemizing the traced/frozen amounts.
What to make of it
Treat the underlying facts of the hack, the FBI's attribution, and the existence of the lawsuit and injunction as established; do not rely on any single figure for when the suit was filed or how much money has been recovered until Bybit or the court record specifies one consistent number.
Market Impact
News of a legal freeze tied to a major hack can reinforce confidence that exchanges are actively pursuing recovery mechanisms after security breaches. For Bybit specifically, continued legal action related to the 2025 hack may be viewed by users and partners as a sign of accountability, even as questions about the exchange's security infrastructure persist.
Broader market impact is likely to be limited unless the frozen assets represent a material share of stolen funds or trigger further regulatory or law enforcement involvement. The case may still influence how other exchanges structure their own legal responses to future hacks linked to state-sponsored actors.
The injunction represents a legal step in an ongoing effort to track and restrict crypto assets tied to a hack blamed on North Korea. Further details are expected to emerge as the case and related investigations progress.
Frequently Asked Questions
What did Bybit win an injunction for?
According to CryptoBriefing, Bybit obtained a court order to freeze cryptocurrency assets connected to a hack attributed to North Korea.
Does this relate to Bybit's earlier hack?
Bybit experienced a major security breach in early 2025 linked by investigators to North Korean-affiliated hackers, and this injunction may relate to efforts to recover funds tied to that or similar incidents.
How does a crypto asset freeze injunction work?
Such injunctions legally compel exchanges or custodians to block withdrawals or transfers involving specific wallets or transactions, helping prevent stolen funds from being moved or laundered further.
Is North Korea confirmed to be behind the hack?
Attribution to North Korean state-linked actors is based on patterns identified by cybersecurity researchers, though definitive confirmation in individual cases can be difficult to establish.