Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group over the $1.5 billion crypto theft that hit the exchange way back in February 2025. The Dubai-based exchange filed the case in the US District Court for the District of Columbia and has already secured a preliminary injunction freezing stolen assets tied to unidentified defendants named in the suit as John Doe. The move marks one of the first times a major exchange has pursued North Korean state actors directly in US civil court.
Behind the Record-Breaking Hack, Bybit Is Now Suing Over
The Lazarus Group allegedly stole more than 400,000 ETH and stETH from Bybit on February 21, 2025, in what remains the largest crypto theft on record. Bybit says the lawsuit is separate from ongoing criminal investigations by US law enforcement, and the exchange plans to seek additional relief from the court as the case moves forward.
The preliminary injunction bars the John Doe defendants from transferring or selling the assets the court has linked to the hack, giving Bybit a legal tool to keep the stolen funds in place while it works to identify who is holding them.
Ben Zhou, Bybit’s co-founder and CEO, said the exchange’s priority has been to protect users, recover what it can, and hold the attackers accountable. He described the Lazarus hack as an attack on trust across the entire industry, not just on Bybit, and said the exchange has worked with investigators, regulators, and law enforcement before taking the case to court.
According to Chainalysis, North Korean hackers stole about $2.02 billion in cryptocurrency in 2025, a figure that includes the Bybit attack and brings total assets North Korea has been linked to stealing to roughly $6.75 billion.
What This Means for Exchange Users
Bybit says the lawsuit is part of a broader effort to recover stolen funds and hold those responsible accountable, a step that could set a precedent for how exchanges respond to state-linked hacks going forward.
For anyone using centralized exchanges, it’s a reminder that platforms are increasingly willing to pursue legal action across borders when large-scale thefts happen, rather than writing off stolen funds. Readers newer to crypto security can find more of our coverage on safeguarding your crypto assets.
Bybit’s Next Move in Court
Bybit has said it will seek additional relief from the US District Court for the District of Columbia as the civil case proceeds, which could bring further asset freezes or new defendants into the suit in the coming months.
What this means for you: If you keep funds on a major exchange, this case shows one of the industry’s biggest platforms is willing to name a nation-state in US court and freeze assets tied to it, rather than simply writing off a hack as a loss.
