Bybit Sues North Korea and Lazarus Group Over $1.5B Crypto Hack

The lawsuit was filed in the U.S. District Court for the District of Columbia. Bybit also secured a preliminary court order freezing certain identified stolen assets while the case proceeds.

Why Is Bybit Suing North Korea?

The lawsuit stems from the February 21, 2025 cyberattack that drained approximately $1.5 billion in Ethereum and liquid staking tokens from one of Bybit’s cold wallets.

The attack remains the largest cryptocurrency theft ever recorded.

According to Bybit, the civil action targets North Korea, its Reconnaissance General Bureau, and the Lazarus Group, which U.S. authorities previously linked to the hack.

The exchange said the lawsuit is independent of ongoing criminal investigations.

Instead, it seeks civil remedies while helping preserve stolen assets identified during blockchain investigations.

What Does the Court Order Do?

Alongside the lawsuit, Bybit obtained a preliminary injunction from a federal court.

The order freezes certain identified digital assets currently held by unknown “John Doe” defendants.

The purpose is to prevent those assets from being transferred or dissipated while litigation continues.

Bybit described the injunction as an important step in supporting fund recovery efforts and broader law enforcement investigations.

The company has not disclosed the exact amount of assets covered by the order.

What Happened During the 2025 Bybit Hack?

The attack occurred on February 21, 2025.

Hackers compromised Bybit’s Ethereum multisignature cold wallet infrastructure.

The attackers allegedly manipulated the transaction approval process, transferring control of the wallet during what appeared to be a routine operation.

Once the attackers gained access, they transferred out more than 400,000 ETH and additional liquid staking tokens.

The stolen funds were then rapidly split across dozens of wallets.

Investigators say the attackers laundered the assets through decentralized exchanges, cross-chain bridges, and other techniques commonly associated with Lazarus Group operations.

Why Lazarus Group Is Accused

The FBI and multiple blockchain intelligence firms previously attributed the attack to the Lazarus Group.

Investigators have long linked the hacking organization to North Korea’s Reconnaissance General Bureau.

According to Chainalysis, North Korea-linked actors have stolen an estimated $6.75 billion in cryptocurrency over time.

The Bybit attack represented one of the largest individual contributions to the approximately $2.02 billion stolen by DPRK-linked hackers during 2025.

Security researchers say the group’s operations often combine sophisticated social engineering with advanced laundering methods.

Why the Lawsuit Matters

Although recovering funds from a sanctioned state remains difficult, the lawsuit establishes another legal avenue beyond criminal investigations.

Civil proceedings can help preserve assets, coordinate international recovery efforts, and increase pressure on exchanges or custodians that may encounter stolen funds.

The filing also reinforces growing cooperation between crypto companies, blockchain investigators, regulators, and law enforcement.

For the wider crypto industry, the case highlights how exchanges are increasingly using traditional legal systems alongside blockchain analytics to respond to large-scale cybercrime.