Bybit Sues North Korea, Lazarus Group Over $1.5B Hack

Bybit filed a civil lawsuit against North Korea in federal court over last year's record $1.5 billion hack, becoming one of the first crypto exchanges to use racketeering law against a state-sponsored cybercrime operation.

The exchange filed the complaint under seal on June 18 in the U.S. District Court for the District of Columbia. It became public this week. The suit names the Democratic People's Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group as defendants.

The case stems from the Feb. 21, 2025 theft of more than 400,000 Ethereum tokens. Hackers struck during a routine transfer from one of Bybit's cold storage wallets. Investigators later determined attackers had compromised a developer's computer at Safe{Wallet}, a multisig protocol Bybit used to manage its addresses. They inserted malicious code that activated only when Bybit's specific wallet address appeared, a person familiar with the investigation said.

After the approval of what looked like a normal internal transfer, the hidden code altered the underlying transaction. That let attackers install a backdoor and drain the wallet in minutes.

Bybit covered more than $4 billion in customer withdrawal requests without freezing accounts, a move the exchange said preserved trust during the crisis. The company also paid $2.3 million through a bounty program that rewarded investigators for tracking stolen funds.

Tracing that money has proven difficult. Attackers converted much of the ethereum into bitcoin and spread it across thousands of wallets using mixers, cross-chain bridges, and unregulated trading platforms. By the time Bybit filed suit, roughly 90% of the stolen assets had become untraceable, the exchange said in the filing.

The theft fits a broader pattern. Chainalysis, a blockchain analytics firm, reported North Korean hackers stole about $2.02 billion in cryptocurrency in 2025, a 51% jump from the year before. Researchers estimate the regime has stolen $6.75 billion in digital assets over time. U.S. officials say the funds help finance weapons programs.