Bybit Sues North Korea and Lazarus After $1.5 Billion Hack

The exchange also secured a preliminary injunction to freeze stolen ETH and stETH while U.S. authorities and Chainalysis track the funds.

Key Takeaways

• Bybit has filed a civil lawsuit against North Korea, the Reconnaissance General Bureau, and the Lazarus Group after the $1.5 billion hack.
• A U.S. judge granted a preliminary injunction that freezes certain stolen assets while the case moves forward.
• The February 21, 2025 attack involved about 400,000 ETH and stETH and is considered the biggest crypto heist so far.

Bybit has taken North Korea, the Reconnaissance General Bureau, and the Lazarus Group to civil court, saying the hacking operation behind last year’s $1.5 billion (€1.3 billion) theft of Ethereum was tied to that group. Alongside the lawsuit, the crypto exchange won a preliminary injunction that blocks certain stolen assets from being moved while the case plays out.

Lawsuit in Washington

The complaint was filed in the U.S. District Court for the District of Columbia. Bybit said the judge ordered the defendants not to transfer or liquidate the assets connected to the case while it remains pending. The filing also names unknown individuals and entities as John Doe defendants, since some of the stolen funds have not yet been linked to specific parties.

Bybit said the action is a key step toward securing the digital assets it has identified and keeping the legal process moving. The company also noted that the civil case is separate from the criminal investigations being carried out by U.S. authorities.

Biggest Hack in the Industry

The attack took place on February 21, 2025, and is widely regarded as the largest crypto theft to date. Bybit says roughly 400,000 ETH and stETH were taken, with a total value of about $1.5 billion (€1.3 billion). That made the hack the largest share of the $2.02 billion (€1.8 billion) in crypto that North Korea reportedly stole last year, according to Chainalysis data.

Bybit CEO Ben Zhou said the company’s priorities are protecting users, recovering as much of the stolen funds as possible, and holding the attackers accountable. He added that the breach did not just affect Bybit, but also damaged confidence across the broader industry.

Why This Matters

The case is another sign that major crypto exchanges are leaning more heavily on both legal action and blockchain forensics to chase stolen funds. For European crypto readers, the main takeaway is that the case centers on Ethereum and that the stolen assets were reportedly moved across several blockchains, which makes them harder to trace and freeze. It also shows how cybercrime, sanctions, and cross-border enforcement are becoming more intertwined in crypto.