Bybit has sued the Democratic People's Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group in U.S. federal court over the February 2025 theft of about $1.5 billion from the exchange, and says a judge granted a preliminary injunction freezing identified assets while finding the company likely to succeed on the merits. The exchange says about $48.4 million has been recovered and roughly $30.5 million frozen across more than 28 exchanges and custodians, or about 5% of the stolen funds. Bybit says the attackers drained Ethereum from a cold wallet by manipulating a signing interface, and that most of the proceeds were later converted to Bitcoin through Thorchain and routed through mixers including Wasabi, Tornado Cash and Railgun. The civil case runs alongside criminal investigations, with Bybit sharing blockchain intelligence with agencies including the FBI as authorities in Greece, Germany and Switzerland have pursued related seizures and disruptions.