Cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau (RGB) intelligence agency and the Lazarus Group over the $1.5 billion crypto heist that struck the exchange in February 2025.
Filed in the U.S. District Court for the District of Columbia, the lawsuit marks a new phase in Bybit’s effort to recover the stolen assets and hold the alleged perpetrators accountable. The exchange also secured a preliminary injunction freezing certain digital assets linked to the theft and held by unidentified individuals and entities listed as “John Doe” defendants.
Bybit said the order is intended to preserve identifiable stolen assets while the litigation continues. It plans to seek further relief as investigators trace the funds.
Bybit Sues North Korea and Lazarus Group Over $1.5 Billion Crypto Heist
The Largest Crypto Heist
On February 21, 2025, hackers drained more than 400,000 ETH and stETH from a Bybit cold wallet. The cryptocurrency was worth about $1.5 billion at the time, making the attack the largest known crypto theft.
The attack was attributed to Lazarus, the North Korean state-linked hacking group that has targeted crypto companies and blockchain projects for years.
Rather than directly breaking through Bybit’s cold-storage defenses, the attackers reportedly compromised infrastructure used to manage the wallet. Investigators found that a developer associated with Safe{Wallet}, the multisignature wallet infrastructure used by Bybit, had been compromised.
Malicious code was used to manipulate what appeared to be a legitimate transaction, allowing the attackers to change the wallet’s underlying logic and redirect the funds.
The incident demonstrated that even cold storage and multisignature protections can be undermined when attackers gain access to the people or software surrounding them.
North Korea’s Growing Crypto Theft
The Bybit attack accounted for most of North Korea’s cryptocurrency theft in 2025.
According to Chainalysis, North Korean hackers stole approximately $2.02 billion in cryptocurrency last year, up 51% from 2024. The firm estimates DPRK-linked hackers have stolen about $6.75 billion in crypto over time.
The scale of the activity has become a major concern for governments and the digital-asset industry. Stolen cryptocurrency is widely believed to provide revenue for the North Korean regime, including funding associated with weapons programs.
Lazarus has previously been linked to several major crypto attacks, including the $620 million Ronin Network bridge hack and the $100 million Harmony Horizon Bridge exploit in 2022.
The repeated attacks have made North Korea one of the most prominent state-linked cyber threats facing the crypto industry.
Tracing the Stolen Funds
Recovering Bybit’s assets has been difficult because the attackers moved quickly after the theft.
Investigators tracked the cryptocurrency across thousands of wallet addresses and multiple blockchain networks. Large amounts of Ethereum were converted into Bitcoin, while other funds moved through cross-chain bridges, mixers and crypto services designed to make transactions harder to follow.
Blockchain transparency has helped investigators monitor many movements, but tracing does not guarantee recovery. Once assets are divided among thousands of addresses or moved between networks, identifying their ultimate holders becomes much harder.
Bybit has worked with blockchain analytics firms, exchanges, regulators and law enforcement agencies to track and freeze portions of the stolen funds.
Court Action Adds a New Weapon
The preliminary injunction gives Bybit another tool in that recovery campaign.
The order prevents certain unidentified holders connected to the stolen assets from transferring or selling the funds while the case proceeds. Bybit said the measure is designed to preserve assets investigators have been able to identify.
The exchange is seeking additional relief, including recovery of the stolen cryptocurrency and damages. It emphasized that the civil lawsuit is separate from ongoing criminal investigations by U.S. authorities.
Bybit CEO Ben Zhou said the company’s priority remains protecting customers and recovering the stolen assets.
“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable,” Zhou said.
He described the Lazarus attack as an attack on trust across the cryptocurrency industry.
Ben Zhou’s comment on X (Source: X)
What Comes Next
The lawsuit faces an unusual challenge because one defendant is the North Korean government itself. Even if Bybit wins the case, enforcing a judgment directly against the DPRK could be difficult.
The more immediate impact may involve unidentified defendants and intermediaries holding traceable stolen assets. If funds reach exchanges or custodians subject to U.S. jurisdiction, court orders could help Bybit freeze assets and obtain information needed for recovery.
The case also shows why major crypto theft investigations increasingly combine blockchain analysis with traditional legal action. Blockchains can reveal where stolen funds move, but recovering them often requires cooperation from exchanges, custodians, regulators and law enforcement.
For Bybit, the lawsuit is the latest step in a recovery campaign that began after the February 2025 breach. For the wider crypto industry, the case could test whether courts can help reclaim digital assets after sophisticated state-linked hackers move them across multiple blockchains and jurisdictions.
