Cryptocurrency alternate Bybit has filed a civil lawsuit in opposition to North Korea, its Reconnaissance Common Bureau (RGB) intelligence company and the Lazarus Group over the $1.5 billion crypto heist that struck the alternate in February 2025.
Filed within the U.S. District Courtroom for the District of Columbia, the lawsuit marks a brand new section in Bybit’s effort to get better the stolen belongings and maintain the alleged perpetrators accountable. The alternate additionally secured a preliminary injunction freezing sure digital belongings linked to the theft and held by unidentified people and entities listed as “John Doe” defendants.
Bybit mentioned the order is meant to protect identifiable stolen belongings whereas the litigation continues. It plans to hunt additional aid as investigators hint the funds.
Bybit Sues North Korea and Lazarus Group Over $1.5 Billion Crypto Heist
The Largest Crypto Heist
On February 21, 2025, hackers drained greater than 400,000 ETH and stETH from a Bybit chilly pockets. The cryptocurrency was value about $1.5 billion on the time, making the assault the biggest recognized crypto theft.
The assault was attributed to Lazarus, the North Korean state-linked hacking group that has focused crypto corporations and blockchain tasks for years.
Reasonably than instantly breaking by means of Bybit’s cold-storage defenses, the attackers reportedly compromised infrastructure used to handle the pockets. Investigators discovered {that a} developer related to Protected{Pockets}, the multisignature pockets infrastructure utilized by Bybit, had been compromised.
Malicious code was used to control what gave the impression to be a legit transaction, permitting the attackers to alter the pockets’s underlying logic and redirect the funds.
The incident demonstrated that even chilly storage and multisignature protections might be undermined when attackers achieve entry to the individuals or software program surrounding them.
North Korea’s Rising Crypto Theft
The Bybit assault accounted for many of North Korea’s cryptocurrency theft in 2025.
In accordance with Chainalysis, North Korean hackers stole roughly $2.02 billion in cryptocurrency final yr, up 51% from 2024. The agency estimates DPRK-linked hackers have stolen about $6.75 billion in crypto over time.
The size of the exercise has grow to be a significant concern for governments and the digital-asset trade. Stolen cryptocurrency is broadly believed to offer income for the North Korean regime, together with funding related to weapons applications.
Lazarus has beforehand been linked to a number of main crypto assaults, together with the $620 million Ronin Community bridge hack and the $100 million Concord Horizon Bridge exploit in 2022.
The repeated assaults have made North Korea one of the vital outstanding state-linked cyber threats going through the crypto trade.
Tracing the Stolen Funds
Recovering Bybit’s belongings has been troublesome as a result of the attackers moved shortly after the theft.
Investigators tracked the cryptocurrency throughout 1000’s of pockets addresses and a number of blockchain networks. Massive quantities of Ethereum had been transformed into Bitcoin, whereas different funds moved by means of cross-chain bridges, mixers and crypto providers designed to make transactions more durable to observe.
Blockchain transparency has helped investigators monitor many actions, however tracing doesn’t assure restoration. As soon as belongings are divided amongst 1000’s of addresses or moved between networks, figuring out their final holders turns into a lot more durable.
Bybit has labored with blockchain analytics corporations, exchanges, regulators and regulation enforcement companies to trace and freeze parts of the stolen funds.
Courtroom Motion Provides a New Weapon
The preliminary injunction provides Bybit one other device in that restoration marketing campaign.
The order prevents sure unidentified holders linked to the stolen belongings from transferring or promoting the funds whereas the case proceeds. Bybit mentioned the measure is designed to protect belongings investigators have been in a position to determine.
The alternate is in search of extra aid, together with restoration of the stolen cryptocurrency and damages. It emphasised that the civil lawsuit is separate from ongoing prison investigations by U.S. authorities.
Bybit CEO Ben Zhou mentioned the corporate’s precedence stays defending clients and recovering the stolen belongings.
“Our focus has by no means modified: shield our customers first, get better what we are able to, and ensure the individuals behind these assaults are held accountable,” Zhou mentioned.
He described the Lazarus assault as an assault on belief throughout the cryptocurrency trade.
Ben Zhou’s touch upon X (Supply: X)
What Comes Subsequent
The lawsuit faces an uncommon problem as a result of one defendant is the North Korean authorities itself. Even when Bybit wins the case, implementing a judgment instantly in opposition to the DPRK may very well be troublesome.
The extra fast influence could contain unidentified defendants and intermediaries holding traceable stolen belongings. If funds attain exchanges or custodians topic to U.S. jurisdiction, court docket orders might assist Bybit freeze belongings and procure info wanted for restoration.
The case additionally reveals why main crypto theft investigations more and more mix blockchain evaluation with conventional authorized motion. Blockchains can reveal the place stolen funds transfer, however recovering them usually requires cooperation from exchanges, custodians, regulators and regulation enforcement.
For Bybit, the lawsuit is the newest step in a restoration marketing campaign that started after the February 2025 breach. For the broader crypto trade, the case might check whether or not courts may help reclaim digital belongings after subtle state-linked hackers transfer them throughout a number of blockchains and jurisdictions.
