Bybit Sues North Korea and Lazarus Group Over $1.5B Crypto Hack

Bybit has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group, according to CoinDesk. The exchange says the North Korea-linked hacking group was responsible for stealing about $1.5 billion from Bybit last year, and it has obtained a preliminary injunction freezing certain assets tied to the case.

The development matters because it moves one of crypto's largest alleged thefts into a civil court process alongside existing law enforcement activity. For exchanges and users, the case highlights how major hacks can trigger not only investigations but also legal efforts to preserve and potentially recover digital assets across jurisdictions.

CoinDesk reported that the February 21, 2025 attack involved roughly $1.5 billion in Ethereum, including more than 400,000 ETH and stETH, stolen from Dubai-based Bybit. The hack accounted for a large share of the $2.02 billion in crypto allegedly stolen by North Korea last year, according to Chainalysis data cited in the report.

The preliminary injunction applies to a group of unidentified individuals and entities named as John Doe defendants. Bybit said the order bars those respondents from transferring or selling the assets they hold while litigation is pending, and the exchange said it plans to seek further relief from the court.

The case also places renewed attention on the Lazarus Group and the broader use of stolen crypto by North Korean-linked actors. CoinDesk noted that North Korean hackers have stolen an estimated $6.75 billion in crypto overall, while the country is widely believed to use illicit digital assets to support its weapons program.