Bybit Takes Legal Action Against North Korea and Lazarus Group Following $1.5 Billion Hack

Bybit, the world’s second-largest cryptocurrency exchange, has launched a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group, linked to a staggering $1.5 billion theft that took place last year.

The lawsuit was submitted to the U.S. District Court for the District of Columbia, resulting in a preliminary injunction aimed at freezing specific assets believed to be stolen. These assets are associated with unidentified individuals and entities referred to as John Doe defendants, according to a statement from Bybit.

The hack occurred on February 21, 2025, and is considered the largest cryptocurrency heist, involving the theft of over 400,000 ETH and stETH from Bybit, which operates out of Dubai. This incident represents a significant portion of the $2.02 billion in cryptocurrency that North Korea is estimated to have stolen that year. Overall, North Korean cybercriminals have reportedly pilfered a total of $6.75 billion in cryptocurrency, much of which is suspected to finance the country’s arms programs, as highlighted by Chainalysis data.

Bybit is pursuing this injunction to safeguard the identified stolen crypto assets while the lawsuit is processed, marking a crucial effort to recover lost funds and bolster accountability for cybercrimes. Ben Zhou, co-founder and CEO of Bybit, emphasized their ongoing commitment to prioritizing user safety and collaborating with law enforcement and regulators to combat these attacks. "The Lazarus attack was not only an assault on Bybit but on the entire industry's trust," he stated.

The injunction prohibits any transfer or sale of the implicated assets during the course of the litigation, with Bybit planning to seek further legal remedies. It's important to note that this civil action is distinct from ongoing criminal investigations by U.S. authorities.