Bybit has sued a North Korea Government backed the Lazarus Group over the $1.5 billion Ethereum hack, securing a U.S. court order to freeze stolen assets
Dubai-based crypto exchange Bybit has taken its fight against North Korea's cybercrime network to a U.S. court. The exchange has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau (RGB), and the Lazarus Group, seeking justice over the $1.5 billion Ethereum hack that shook the crypto industry in 2025.
Alongside the lawsuit, Bybit has already secured a court order freezing part of the stolen funds as recovery efforts continue.
Bybit announced that it has filed a civil lawsuit in the U.S. District Court for the District of Columbia, accusing North Korea’s RGB, and the state-backed Lazarus Group of carrying out the record-breaking crypto theft.
The lawsuit relates to the February 21, 2025, attack, when hackers allegedly used social engineering during a routine wallet transfer to steal approximately 401,347 ETH and other assets worth around $1.46 billion at the time.
The attack remains the largest cryptocurrency theft in history and has become one of the most significant cybercrime cases ever faced by the digital asset industry.
Along with the lawsuit, Bybit secured an important legal victory.
The U.S. court granted a preliminary injunction, ordering that identified stolen assets linked to the hack be frozen while the case continues.
The order applies to unidentified holders listed as "John Doe" defendants and prevents them from transferring, selling, or moving the traced crypto until the legal proceedings are completed.
Bybit said the freeze is designed to protect the identified assets while investigators continue tracking the remaining stolen funds. The company also plans to seek additional legal relief as the case moves forward.
The exchange says its recovery efforts have already produced meaningful results.
According to Bybit CEO Ben Zhou, the company has recovered approximately $48.4 million, while another $30.5 million has been frozen across more than 28 cryptocurrency exchanges and custodians.
Zhou said the progress has only been possible because of close cooperation between exchanges, blockchain analytics firms, custodians, regulators, and law enforcement agencies.
"Since the Lazarus attack in February 2025, Bybit has been working on recovery from every possible angle."
He added that the exchange will continue using every legal tool available to trace, freeze, and recover stolen assets.
Bybit stressed that the lawsuit is not only about recovering its own funds. The company described the Lazarus attack as a threat to trust across the entire crypto industry, saying cybercrime affects every exchange, investor, and blockchain business.
Zhou said that "The attack was against Bybit, but the problem is much bigger than Bybit. Cybercrime is a threat to the entire crypto industry."
The civil lawsuit is separate from ongoing criminal investigations being conducted by U.S. authorities and other international law enforcement agencies.
North Korean hackers stole around $2.02 billion worth of cryptocurrency in 2025, with the Bybit hack accounting for most of that total. Since these attacks were first tracked, the country's cyber groups have stolen an estimated $6.75 billion in digital assets.
Security researchers believe much of the stolen cryptocurrency is eventually used to help finance North Korea's weapons and missile programs.
The rising number of state-backed attacks has also pushed exchanges to spend more on cybersecurity, blockchain monitoring, and compliance systems, increasing costs across the industry.
No comments yet
Be the first to share your take when accounts launch.
