Home/News/Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze

Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze

CoinDeskPublished on 2 hours ago

The exchange has secured a preliminary injunction freezing stolen assets.

Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze

The exchange has secured a preliminary injunction freezing stolen assets.

Bybit filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its intelligence agency, the Reconnaissance General Bureau (RGB), and state-sanctioned hacking organization the Lazarus Group. The preliminary injunction from a federal U.S. court prohibits the transfer or dissipation of identified assets connected to the case while litigation continues.

Bybit, the world’s second-largest cryptocurrency exchange, has filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) intelligence agency and the Lazarus Group, identified as the DPRK-linked hacking group responsible for stealing $1.5 billion from the exchange last year.

In addition to the lawsuit, filed in the U.S. District Court for the District of Columbia, Bybit said it won a preliminary injunction freezing certain stolen assets held by a group of unidentified individuals and entities, named in the case as John Doe defendants, the exchange said in a press release on Friday.

On February 21, 2025, the North Korean state-sponsored Lazarus Group f allegedly executed the largest cryptocurrency heist in history, stealing approximately $1.5 billion in Ethereum (over 400,000 ETH and stETH) from Dubai-based Bybit. The Bybit hack made up a bulk of the $2.02 billion in crypto stolen by North Korea last year. In total, North Korean hackers have stolen $6.75 billion worth of crypto, according to data from Chainalysis. The country is widely believed to use its ill-gotten crypto to fund its weapons program.

“The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit's ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime,” Bybit said in the release.

“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," said Ben Zhou, co-founder and CEO of Bybit, in a statement. “The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts.”

The preliminary injunction means a federal judge ordered the respondents not to transfer or sell the assets they’re holding while the case is ongoing, Bybit said. The exchange added that it will look for further relief from the court.

“The civil action is being pursued independently of ongoing criminal investigations conducted by U.S. law enforcement authorities,” the firm added.

1OKX's Rafique doubts Clarity Act will pass, warns optimism is already priced into bitcoin1 hour ago 2How a five-second trick let traders drain millions from Polymarket1 hour ago 3A part of FTX survived, and it’s the case for the CLARITY Act2 hours ago 4Russia cracks down on unlicensed crypto exchanges it claims are linked to Ukraine2 hours ago 5U.S. unexpectedly shed 23,000 jobs in July, putting Fed rate hikes in question4 hours ago 6After a Clarity Act funeral, the crypto world would keep turning4 hours ago 7Why Bitcoin's BIP-110 refuses to die despite near-zero miner support4 hours ago 8Bitcoin’s volatility has nearly disappeared. The risk hasn’t.5 hours ago 9Bitcoin hovers below $65,000 as Middle East tensions escalate further6 hours ago 10Coldcard fallout shows up onchain as 210,000 bitcoin leaves old wallets7 hours ago

Building the Zcash Machine: Tachyon and Quantum Readiness

Building the Zcash Machine: Tachyon and Quantum Readiness

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

Why it matters:

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

OKX's Rafique doubts Clarity Act will pass, warns optimism is already priced into bitcoin

Russia cracks down on unlicensed crypto exchanges it claims are linked to Ukraine

Senate won't vote on crypto Clarity Act before its summer break