Bybit sues North Korea over $1.5B Lazarus hack and wins asset freeze
Bybit has filed a civil lawsuit in US federal court against North Korea and the Lazarus Group over the February 2025 theft of roughly $1.5 billion in Ethereum, securing a preliminary injunction to...
The Lawsuit and Asset Freeze
@Bybit_Official has filed a civil lawsuit in the US District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group. The action stems from the February 21, 2025 theft of approximately $1.5 billion in $ETH — over 400,000 ETH and stETH stolen from the Dubai-based exchange in what remains the largest cryptocurrency heist on record.
In addition to the lawsuit, Bybit said it won a preliminary injunction freezing certain stolen assets held by a group of unidentified individuals and entities, named in the case as John Doe defendants. The freeze order prevents those parties from transferring or selling the identified assets while litigation continues, giving the civil action real on-chain consequence even as enforcement against a sovereign state remains a longer road.
How the Attack Unfolded
During a scheduled transfer from a cold to a hot wallet, the hackers intercepted and rerouted funds to addresses they controlled, quickly converting the loot into Bitcoin and other assets and dispersing them across thousands of blockchain addresses to obscure their trail. The Lazarus Group managed to manipulate the Safe user interface used for Bybit transactions. By injecting malicious JavaScript into the UI, they created the illusion of a legitimate transaction, allowing the attackers to bypass security protocols and facilitate the unauthorized transfer of funds.
The Bybit hack made up the bulk of the $2.02 billion in crypto stolen by North Korea in 2025. In total, North Korean hackers have stolen $6.75 billion worth of crypto, according to data from Chainalysis, with the country widely believed to use stolen funds to finance its weapons program.
CEO @benbybit framed the lawsuit as part of a broader accountability push. "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry," he said, adding that Bybit has worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. The civil action is being pursued independently of ongoing criminal investigations.
Sources:
CoinDesk: Bybit Sues North Korea and Lazarus Group, Secures Asset Freeze
FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack
American Banker: How North Korean Hackers Stole $1.5B in Ethereum from Bybit