Bybit Sues North Korea and Lazarus Group Over $1.5 Billion Crypto Heist

Cryptocurrency trade Bybit has filed a civil lawsuit in opposition to North Korea, its Reconnaissance Common Bureau (RGB) intelligence company and the Lazarus Group over the $1.5 billion crypto heist that struck the trade in February 2025.

Filed within the U.S. District Courtroom for the District of Columbia, the lawsuit marks a brand new section in Bybit’s effort to get better the stolen belongings and maintain the alleged perpetrators accountable. The trade additionally secured a preliminary injunction freezing sure digital belongings linked to the theft and held by unidentified people and entities listed as “John Doe” defendants.

Bybit stated the order is meant to protect identifiable stolen belongings whereas the litigation continues. It plans to hunt additional reduction as investigators hint the funds.

Bybit Sues North Korea and Lazarus Group Over $1.5 Billion Crypto Heist

The Largest Crypto Heist

On February 21, 2025, hackers drained greater than 400,000 ETH and stETH from a Bybit chilly pockets. The cryptocurrency was value about $1.5 billion on the time, making the assault the biggest recognized crypto theft.

The assault was attributed to Lazarus, the North Korean state-linked hacking group that has focused crypto corporations and blockchain initiatives for years.

Somewhat than straight breaking by way of Bybit’s cold-storage defenses, the attackers reportedly compromised infrastructure used to handle the pockets. Investigators discovered {that a} developer related to Protected{Pockets}, the multisignature pockets infrastructure utilized by Bybit, had been compromised.

Malicious code was used to control what gave the impression to be a authentic transaction, permitting the attackers to vary the pockets’s underlying logic and redirect the funds.

The incident demonstrated that even chilly storage and multisignature protections will be undermined when attackers acquire entry to the folks or software program surrounding them.

North Korea’s Rising Crypto Theft

The Bybit assault accounted for many of North Korea’s cryptocurrency theft in 2025.

In line with Chainalysis, North Korean hackers stole roughly $2.02 billion in cryptocurrency final 12 months, up 51% from 2024. The agency estimates DPRK-linked hackers have stolen about $6.75 billion in crypto over time.

The dimensions of the exercise has turn into a serious concern for governments and the digital-asset trade. Stolen cryptocurrency is broadly believed to offer income for the North Korean regime, together with funding related to weapons packages.

Lazarus has beforehand been linked to a number of main crypto assaults, together with the $620 million Ronin Community bridge hack and the $100 million Concord Horizon Bridge exploit in 2022.

The repeated assaults have made North Korea probably the most outstanding state-linked cyber threats dealing with the crypto trade.

Tracing the Stolen Funds

Recovering Bybit’s belongings has been troublesome as a result of the attackers moved rapidly after the theft.

Investigators tracked the cryptocurrency throughout hundreds of pockets addresses and a number of blockchain networks. Massive quantities of Ethereum have been transformed into Bitcoin, whereas different funds moved by way of cross-chain bridges, mixers and crypto companies designed to make transactions more durable to comply with.

Blockchain transparency has helped investigators monitor many actions, however tracing doesn’t assure restoration. As soon as belongings are divided amongst hundreds of addresses or moved between networks, figuring out their final holders turns into a lot more durable.

Bybit has labored with blockchain analytics companies, exchanges, regulators and legislation enforcement companies to trace and freeze parts of the stolen funds.

Courtroom Motion Provides a New Weapon

The preliminary injunction offers Bybit one other instrument in that restoration marketing campaign.

The order prevents sure unidentified holders related to the stolen belongings from transferring or promoting the funds whereas the case proceeds. Bybit stated the measure is designed to protect belongings investigators have been capable of determine.

The trade is searching for further reduction, together with restoration of the stolen cryptocurrency and damages. It emphasised that the civil lawsuit is separate from ongoing legal investigations by U.S. authorities.

Bybit CEO Ben Zhou stated the corporate’s precedence stays defending prospects and recovering the stolen belongings.

“Our focus has by no means modified: defend our customers first, get better what we are able to, and ensure the folks behind these assaults are held accountable,” Zhou stated.

He described the Lazarus assault as an assault on belief throughout the cryptocurrency trade.

Ben Zhou’s touch upon X (Supply: X)

What Comes Subsequent

The lawsuit faces an uncommon problem as a result of one defendant is the North Korean authorities itself. Even when Bybit wins the case, implementing a judgment straight in opposition to the DPRK might be troublesome.

The extra rapid influence might contain unidentified defendants and intermediaries holding traceable stolen belongings. If funds attain exchanges or custodians topic to U.S. jurisdiction, court docket orders might assist Bybit freeze belongings and acquire info wanted for restoration.

The case additionally exhibits why main crypto theft investigations more and more mix blockchain evaluation with conventional authorized motion. Blockchains can reveal the place stolen funds transfer, however recovering them usually requires cooperation from exchanges, custodians, regulators and legislation enforcement.

For Bybit, the lawsuit is the most recent step in a restoration marketing campaign that started after the February 2025 breach. For the broader crypto trade, the case might check whether or not courts may also help reclaim digital belongings after subtle state-linked hackers transfer them throughout a number of blockchains and jurisdictions.