Bybit Files Civil Lawsuit Against North Korea and Lazarus Group Over $1.5B Hack

Cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau (RGB), and the Lazarus Group over the $1.5 billion hack that occurred in February last year. The case, filed in the U.S. District Court for the District of Columbia, also secured a preliminary injunction that freezes certain assets tied to the incident while the litigation proceeds.

Legal Action and Asset Freeze

The lawsuit seeks to recover stolen funds and hold the attackers accountable, according to a report from CoinDesk. Bybit CEO Ben Zhou stated, “Our goal is to put user protection first, recover as much as possible, and hold accountable those behind these attacks.” He emphasized that the Lazarus attack was not merely an attack on Bybit, but an assault on trust within the entire cryptocurrency industry.

Zhou noted that Bybit has cooperated closely with investigators, exchanges, regulators, and judicial authorities, and now plans to pursue additional legal relief through the court. The preliminary injunction prevents the transfer or disposal of specific assets linked to the hack while the case is ongoing.

Separate Criminal Investigation

The civil case runs parallel to an ongoing criminal investigation by U.S. law enforcement agencies. The Lazarus Group, a state-sponsored hacking unit allegedly operating under North Korea’s RGB, is accused of stealing approximately $1.5 billion worth of Ethereum from Bybit in February 2025. This incident ranks among the largest cryptocurrency thefts ever recorded.

Implications for the Crypto Industry

This lawsuit marks a significant step in the cryptocurrency sector’s efforts to combat state-sponsored cybercrime. By taking legal action against a sovereign state and its affiliated hacking group, Bybit is setting a precedent that could encourage other exchanges to pursue similar recourse. The case also highlights the growing scrutiny of North Korea’s illicit cyber activities, which have been a major source of funding for its weapons programs, according to United Nations reports.

For the broader industry, the outcome could influence how exchanges handle security breaches and cooperate with international legal frameworks. It also underscores the importance of robust security measures and cross-border collaboration to protect user assets.

Conclusion

Bybit’s civil lawsuit against North Korea and the Lazarus Group represents a pivotal moment in the fight against crypto crime. While the legal process will take time, the action demonstrates a commitment to accountability and asset recovery. The industry will be watching closely as the case unfolds, as it may reshape how exchanges respond to major hacks and interact with law enforcement worldwide.

FAQs

Q1: What is the Lazarus Group?
The Lazarus Group is a cybercrime organization believed to be state-sponsored by North Korea. It has been linked to numerous high-profile hacks, including the 2014 Sony Pictures attack and multiple cryptocurrency exchange thefts.

Q2: How much was stolen in the Bybit hack?
Approximately $1.5 billion worth of Ethereum was stolen from Bybit in February 2025, making it one of the largest cryptocurrency heists in history.

Q3: What does the preliminary injunction do?
The preliminary injunction bars the transfer or disposal of certain assets tied to the hack while the lawsuit is ongoing, helping to preserve funds for potential recovery.