Bybit Sues North Korea's Lazarus Group Over $1.5B Hack

The FBI formally attributed the attack to North Korea's TraderTraitor operation and published lists of associated wallet addresses, urging exchanges, bridges, validators and service providers to block transactions tied to the stolen assets. Blockchain analytics firms including Elliptic and TRM Labs, plus cybersecurity specialists Sygnia, have continued tracking the funds while assisting exchanges trying to identify recoverable assets.

Converting Blockchain Evidence Into Court Orders

Recovering stolen cryptocurrency is a different problem from identifying where it moved. Blockchain ledgers offer a transparent transaction history, letting investigators follow assets across wallets and networks. That visibility does not create legal authority to seize or freeze holdings held by third parties. The civil lawsuit gives Bybit a mechanism to turn the tracing work into enforceable claims, the exchange said, strengthening requests to freeze assets at regulated custodians and exchanges in cooperative jurisdictions. The remaining challenge is converting that visibility into claims that can freeze and recover assets before they vanish into the laundering networks.

The case could also set a precedent for institutional hacks. Exchanges have historically leaned on blockchain analysis and voluntary cooperation from trading platforms, with criminal investigations led by government agencies running in parallel. Bybit's approach adds private civil litigation to those tools, opening a potential recovery path for victims of large-scale theft.

The Bybit attack accounted for most of the roughly $2.02 billion in cryptocurrency attributed to North Korean hacking groups during 2025. Chainalysis data showed DPRK-linked cyber operations have stolen about $6.75 billion worth of digital assets across multiple years, with investigators widely believing the proceeds help fund North Korea's sanctioned weapons and missile programs.

Those campaigns have moved away from exploiting vulnerabilities in blockchain protocols themselves. Recent operations have focused on phishing developers, compromising software supply chains, infiltrating cryptocurrency companies and manipulating the workflows around digital asset custody. The Safe{Wallet} breach showed the same pattern: the attackers did not need to break the multisignature scheme, they needed to compromise the software and operational environment surrounding transaction approval. That evolution has pushed exchanges to reconsider where their greatest security risks sit. For Bybit, the answer pointed to the software and the people around transaction approval, not the blockchain itself.

The litigation will run alongside the blockchain investigations. Whether the strategy works will be measured by recoveries, not by attribution alone, Bybit said. The next major milestone is likely to be additional court filings naming new wallets and counterparties tied to the laundering network, not another tracing report.