Key facts
- Bybit has filed a civil lawsuit against North Korea, its intelligence agency (RGB), and the Lazarus Group.
- The lawsuit stems from a $1.5 billion hack of Bybit in February 2025, attributed to the Lazarus Group.
- A federal U.S. court has granted Bybit a preliminary injunction to freeze certain assets related to the hack.
- The injunction prohibits the transfer or dissipation of identified stolen assets while litigation proceeds.
- Bybit stated the action aims to recover funds, support investigations, and hold cybercriminals accountable.
Cryptocurrency exchange Bybit has initiated a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its intelligence agency the Reconnaissance General Bureau (RGB), and the state-sanctioned Lazarus Group, holding them responsible for a $1.5 billion hack that occurred in February 2025. The exchange announced that a federal U.S. court has granted a preliminary injunction, prohibiting the transfer or dissipation of identified assets connected to the case while litigation is ongoing.
The hack, which involved over 400,000 ETH and stETH, was reportedly the largest cryptocurrency heist in history at the time and constituted a significant portion of the $2.02 billion stolen by North Korea in 2025. Chainalysis data indicates North Korean hackers have stolen a total of $6.75 billion in crypto, with funds often used to finance the country's weapons programs.
Bybit stated that the court order is crucial for preserving the stolen digital assets and represents a key step in their recovery efforts, supporting law enforcement investigations, and promoting accountability for cybercrime. Ben Zhou, co-founder and CEO of Bybit, emphasized the exchange's commitment to user protection, fund recovery, and holding attackers accountable, noting that the Lazarus attack was an assault on industry trust. The civil action is being pursued independently of any ongoing criminal investigations by U.S. law enforcement.