Bybit, the world’s second-largest cryptocurrency exchange, has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group, alleging the group stole $1.5 billion in Ethereum from the exchange in February 2025. Bybit also secured a preliminary injunction to freeze stolen assets held by unidentified individuals and entities.
The lawsuit, filed in the U.S. District Court for the District of Columbia, names the Democratic People’s Republic of Korea, its intelligence agency, and the Lazarus Group as defendants. Bybit claims the attack, which occurred on February 21, 2025, involved the theft of approximately 400,000 ETH and stETH, marking the largest cryptocurrency heist in history. A preliminary injunction has been granted to freeze assets held by unnamed “John Doe defendants,” according to court documents.
The hack accounted for a significant portion of the $2.02 billion in cryptocurrency stolen by North Korean-linked actors in 2024, as reported by Chainalysis. The firm’s data indicates that North Korean hackers have stolen a total of $6.75 billion in cryptocurrency to date, though the figures are based on analysis rather than direct confirmation. Bybit’s legal action is separate from ongoing U.S. law enforcement investigations into the incident.
Ben Zhou, Bybit’s co-founder and CEO, described the attack as a threat to trust in the industry. He stated the lawsuit aims to recover funds, support law enforcement, and hold perpetrators accountable. The company has not disclosed the exact methods used by the Lazarus Group, which is alleged to have executed the heist but has not publicly commented on the claims.
The legal battle highlights the challenges faced by cryptocurrency firms in recovering stolen assets, particularly when linked to state-sponsored groups. While the U.S. has previously imposed sanctions on the Lazarus Group, the success of Bybit’s lawsuit remains uncertain. The identities of those holding the stolen assets remain unknown, complicating efforts to trace and recover the funds.
This case underscores the growing role of civil litigation in addressing cybercrime in the digital assets sector. Bybit’s action may set a precedent for exchanges seeking to hold state-backed hackers accountable, though legal and jurisdictional hurdles persist. The outcome could influence future strategies for recovering stolen crypto and pressuring nations linked to such activities.
Written by Daniel Brooks
Security Desk
