Bybit Freeze Order Targets Ethereum Stolen by North Korea

A federal judge in Washington granted Bybit a preliminary injunction freezing crypto wallets tied to the February 2025 hack that drained about $1.5 billion in Ethereum. The order, issued in the U.S. District Court for the District of Columbia, blocks transfers of the remaining stolen assets while the exchange's civil case against North Korea proceeds.

Bybit filed the lawsuit on Aug. 7, 2026, naming the Democratic People's Republic of Korea and the Lazarus Group as defendants. The suit asks the court to order the return of the stolen Ethereum. The complaint also names the Reconnaissance General Bureau, North Korea's intelligence arm. The hack took place Feb. 21, 2025, after attackers exploited a vulnerability in Safe{Wallet}, the multisig service Bybit used to hold the funds. The theft ranks as the largest from a crypto exchange on record.

Within days, the FBI attributed the attack to North Korean state-sponsored actors and linked it to a broader pattern of North Korean cyber operations. Blockchain analytics firm Chainalysis has put North Korean state hackers' cumulative crypto thefts at $6.75 billion across multiple campaigns.

Bybit CEO Ben Zhou described the injunction as one piece of a wider recovery effort. The exchange has been coordinating with other platforms and offering financial incentives for the return of stolen funds. The court order, Zhou said, gives the exchange and its partners legal authority to lock wallets and block transactions, and to coordinate with law enforcement across jurisdictions.

The injunction is a holding action, not a final ruling. The judge has not decided whether North Korea or the Lazarus Group is liable, and the freeze stays in place until the case resolves. In practical terms, the order gives exchanges that cooperate with Bybit a reason to freeze any transaction that moves funds from the named wallets, without waiting for a separate court order in their own jurisdiction.