Cryptocurrency exchange Bybit has initiated a civil lawsuit against the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) intelligence agency, and the Lazarus Group hacking group. The claim alleges responsibility for the theft of approximately $1.5 billion in cryptocurrency from the exchange during an attack executed last year.
The lawsuit was filed with the U.S. District Court for the District of Columbia on February 21, 2025. It seeks to recover funds and hold accountable those involved in the alleged criminal activity. A preliminary injunction has been secured, targeting assets held by unidentified individuals and entities – designated as “John Doe defendants.”
The hack targeted Bybit’s cryptocurrency holdings, involving roughly $1.5 billion worth of Ethereum. This included over 400,000 ETH and associated stETH tokens. Chainalysis reportedly utilized its blockchain analysis tools to trace the stolen assets.
According to available data, this Bybit incident represented a significant portion – approximately $2.02 billion – of the total cryptocurrency theft attributed to North Korea during the preceding year. North Korean hackers are said to have amassed over $6.75 billion in illicit crypto gains globally.
The lawsuit centres on allegations that the DPRK, through its RGB intelligence agency and the Lazarus Group, perpetrated the cyberattack. These entities remain central figures in investigations surrounding numerous past cryptocurrency heists. The alleged theft is believed to be a key component of North Korea’s efforts to fund its military programs.
Securing the preliminary injunction against “John Doe defendants” aims to freeze assets connected to the stolen funds. However, the identities of those individuals and entities remain undisclosed. The case marks an escalated effort by Bybit to recover losses stemming from what is considered a substantial cybercrime.
The ongoing investigations highlight the evolving tactics employed by North Korean hacking groups in targeting cryptocurrency exchanges worldwide. Recovering assets involved in this incident will be crucial in assessing the broader impact of these attacks and preventing future criminal activity.
Written by Daniel Brooks
Security Desk
