Bybit sues North Korea over $1.5B Lazarus hack

Bybit sued North Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group in a U.S. federal court Tuesday, opening a new front in the exchange's campaign to recover assets stolen in the $1.5 billion crypto hack.

The civil lawsuit, filed in the U.S. District Court for the District of Columbia, names the Democratic People's Republic of Korea as a defendant alongside the intelligence agency and the Lazarus hacking collective. The case stems from the Feb. 21, 2025 breach that drained more than 400,000 Ether (ETH) and staked ETH from Bybit's wallets.

The assets were valued at roughly $1.5 billion at the time, making it the biggest cryptocurrency theft on record. The Federal Bureau of Investigation attributed the attack to North Korea weeks after the breach. U.S. authorities track the actors under the name TraderTraitor and have urged exchanges and blockchain firms to block transactions tied to addresses linked to the laundering operation.

Bybit co-founder and CEO Ben Zhou said the exchange has worked with investigators, regulators and law enforcement since the attack.

"Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," Zhou said.

Alongside the lawsuit, Bybit secured a preliminary injunction covering some of the stolen assets held by unidentified individuals and entities listed as John Doe defendants. The order prevents those defendants from moving, selling or otherwise disposing of the assets while the litigation continues. A preliminary injunction preserves property during a case but does not represent a final ruling on liability or ownership.

The exchange said it would seek further relief as the lawsuit moves forward. The civil claim runs parallel to criminal investigations by U.S. law enforcement.

Bybit's recovery push and the fading trace window