Bybit Sues North Korea and Lazarus Group Over $1.5bn Crypto Theft

Bybit has filed a civil lawsuit in the US District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau and the Lazarus Group over a February 2025 cyberattack. The exchange also secured a preliminary injunction that freezes identified stolen assets held by unnamed defendants who have been moving or holding the funds. The order bars the transfer or dissipation of those assets while the litigation continues, and Bybit says it will seek further judicial relief. When granting an earlier temporary restraining order, the court called the incident one of the largest cryptocurrency thefts in history and found Bybit had shown a likelihood of success on the merits.

The civil case runs alongside, but independently of, US criminal investigations. Bybit says it is cooperating with the FBI and sharing blockchain intelligence and investigative findings. Co-founder and CEO Ben Zhou said the Lazarus attack was not just an attack on Bybit but an attack on trust in the industry, and that the company has worked with investigators, exchanges, regulators, law enforcement and now the courts.

So far, about $48.4m of the stolen assets has been recovered, according to the exchange. Another $30.5m has been frozen across more than 28 exchanges and custodians while legal and investigative steps continue. Those amounts remain a small share of the roughly $1.5bn allegedly taken. Bybit’s recovery effort has also supported wider enforcement: German authorities dismantled the crypto exchange eXch, while German and Swiss authorities disrupted Cryptomixer.io, removing two alleged laundering channels.

The case highlights a shift in how crypto firms respond to state-sponsored cybercrime, with civil litigation increasingly used alongside criminal referrals and on-chain tracing. That approach relies on blockchain analytics and cross-border judicial cooperation, both of which are still developing. Regulators are likely to watch the matter closely, given security and operational resilience rules for crypto firms in the EU, UK and UAE, where Bybit is headquartered.

Suing a nation-state in a US district court is procedurally complex under the Foreign Sovereign Immunities Act, and enforcing any eventual judgment against North Korean state assets would face major practical obstacles. The more immediate lever is the injunction against unnamed defendants moving funds, because court orders can be enforced against identifiable wallets and cooperating custodians. For the industry, the case makes the cost of large-scale theft more visible and contested; whether it deters sophisticated state actors is uncertain, but it signals that well-resourced exchanges will litigate.