Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze

Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze

Policy

Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze

The exchange has secured a preliminary injunction freezing stolen assets.

By

Ian Allison

|

Edited by

Cheyenne Ligon

,

Nikhilesh De

4 hrs ago

2

min read

Make

preferred on

Share

Share this article

Copy link

X icon

X (Twitter)

LinkedIn

Facebook

Email

Make

preferred on

hack, hacker, hoodie(Shutterstock)

Summary

Show

Bybit filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its intelligence agency, the Reconnaissance General Bureau (RGB), and state-sanctioned hacking organization the Lazarus Group.

The preliminary injunction from a federal U.S. court prohibits the transfer or dissipation of identified assets connected to the case while litigation continues.

Bybit, the world’s second-largest cryptocurrency exchange, has filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) intelligence agency and the Lazarus Group, identified as the DPRK-linked hacking group responsible for stealing $1.5 billion from the exchange last year.

In addition to the lawsuit, filed in the U.S. District Court for the District of Columbia, Bybit said it won a preliminary injunction freezing certain stolen assets held by a group of unidentified individuals and entities, named in the case as John Doe defendants, the exchange said in a press release on Friday.

On February 21, 2025, the

North Korean state-sponsored Lazarus Group

f allegedly executed the largest cryptocurrency heist in history, stealing approximately $1.5 billion in Ethereum (over 400,000 ETH and stETH) from Dubai-based Bybit. The Bybit hack made up a bulk of the $2.02 billion in crypto stolen by North Korea last year. In total, North Korean hackers have stolen $6.75 billion worth of crypto, according to data from Chainalysis. The country is widely believed to use its ill-gotten crypto to fund its weapons program.

“The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit's ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime,” Bybit said in the release.

“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," said Ben Zhou, co-founder and CEO of Bybit, in a statement. “The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts.”

The preliminary injunction means a federal judge ordered the respondents not to transfer or sell the assets they’re holding while the case is ongoing, Bybit said. The exchange added that it will look for further relief from the court.

“The civil action is being pursued independently of ongoing criminal investigations conducted by U.S. law enforcement authorities,” the firm added.

Latest Crypto News

1

U.S. widens Iran crypto crackdown with sanctions on two exchanges

2 hrs ago

2

BitMEX sale collapsed as buyers balked at founder ownership and shrinking business

4 hrs ago

3

OKX's Rafique doubts Clarity Act will pass, warns optimism is already priced into bitcoin

5 hrs ago

4

How a five-second trick let traders drain millions from Polymarket

5 hrs ago

5

A part of FTX survived, and it’s the case for the CLARITY Act

6 hrs ago

6

Russia cracks down on unlicensed crypto exchanges it claims are linked to Ukraine

6 hrs ago

7

U.S. unexpectedly shed 23,000 jobs in July, putting Fed rate hikes in question

8 hrs ago

8

After a Clarity Act funeral, the crypto world would keep turning

8 hrs ago

9

Why Bitcoin's BIP-110 refuses to die despite near-zero miner support

9 hrs ago

10

Bitcoin’s volatility has nearly disappeared. The risk hasn’t.

9 hrs ago

Latest Research

Building the Zcash Machine: Tachyon and Quantum Readiness

Building the Zcash Machine: Tachyon and Quantum Readiness

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

By

CoinDesk Research

Jun 30, 2026

Commissioned by

GenZcash

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

Why it matters

:

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

View Full Report

More From

Policy

U.S. widens Iran crypto crackdown with sanctions on two exchanges

OKX's Rafique doubts Clarity Act will pass, warns optimism is already priced into bitcoin

Russia cracks down on unlicensed crypto exchanges it claims are linked to Ukraine

More From

IP

U.S. widens Iran crypto crackdown with sanctions on two exchanges

BitMEX sale collapsed as buyers balked at founder ownership and shrinking business

OKX's Rafique doubts Clarity Act will pass, warns optimism is already priced into bitcoin

Crypto

CD20

$1,752.30

CD20 up 0.38 percent

0.38%

BTC

$64,931.48

BTC up 0.83 percent

0.83%

ETH

$1,914.07

ETH up 0.45 percent

0.45%

XRP

$1.02

XRP down 0.74 percent

0.74%

SOL

$73.78

SOL up 1.35 percent

1.35%