Bybit Sues DPRK and Lazarus Group Over $1.5B Ethereum Heist, Secures Asset Freeze
Bybit filed a civil lawsuit against the DPRK, its Reconnaissance General Bureau, and the Lazarus Group in U.S. District Court over the February 2025 theft of approximately $1.5 billion in Ethereum. A federal judge granted a preliminary injunction freezing certain stolen assets held by unidentified
A federal injunction freezes peripheral wallets. North Korea doesn't have a registered agent.
Key takeaways
- Bybit filed a civil lawsuit on August 7, 2026, against the DPRK, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group in U.S. District Court for the District of Columbia over the February 21, 2025 theft of approximately $1.5 billion in Ethereum, the largest crypto heist in history.
- A federal judge granted Bybit a preliminary injunction freezing certain stolen assets held by unidentified John Doe defendants (peripheral intermediaries), not the sovereign state itself, which holds no attachable U.S. assets and does not submit to American jurisdiction.
- The attack vector was third-party custodial infrastructure: attackers compromised a Safe{Wallet} developer machine, injected malicious JavaScript into the signing interface, and tricked Bybit's own signers into approving a fraudulent cold-wallet transfer, a structural vulnerability no court filing resolves.
Bybit, the world's second-largest cryptocurrency exchange by trading volume, filed a civil lawsuit against the Democratic People's Republic of Korea, its Reconnaissance General Bureau (RGB) intelligence agency, and the Lazarus Group on August 7, 2026, in U.S. District Court for the District of Columbia, per Bybit's press release. A federal judge simultaneously granted a preliminary injunction freezing certain stolen assets held by a group of unidentified individuals named as John Doe defendants, the exchange confirmed.
The hack itself occurred on February 21, 2025. According to the FBI's IC3 public service announcement, North Korea's state-sponsored Lazarus Group (also designated TraderTraitor) stole approximately $1.5 billion in virtual assets from Bybit in what the FBI confirmed as the largest cryptocurrency heist in history. The Bybit theft represented the bulk of the $2.02 billion in crypto North Korea stole across all of 2025, per Chainalysis. North Korean hackers have now stolen $6.75 billion in crypto all-time, according to the same Chainalysis report, with the proceeds widely assessed to fund the country's weapons program.
What the Injunction Actually Covers
The preliminary injunction prohibits respondents from transferring or selling the identified assets while litigation continues. Bybit said the civil action is being pursued independently of ongoing U.S. criminal investigations.
"The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit's ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime," Bybit stated.
Ben Zhou, co-founder and CEO of Bybit, put it plainly: "Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable. The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts."
The injunction's practical scope is narrow. The DPRK does not appear in U.S. courts, does not hold attachable U.S. assets, and does not recognize American jurisdiction. The freeze covers John Doe defendants: peripheral wallets, possible OTC desk accounts, and intermediary addresses where traceable proceeds may still sit.
The Structural Problem No Lawsuit Solves
Here is the thesis, stated plainly: a U.S. court injunction against a sovereign state that holds nothing in American courts, laundered the stolen funds through cross-chain bridges, and answers to no American judge is legal process doing its best against a threat it was not built to stop. That is the ceiling Bybit's legal team is working within.
The attack vector matters more than the lawsuit. Lazarus didn't break Bitcoin's cryptography. They compromised a developer machine at Safe{Wallet}, Bybit's multisig infrastructure provider, injected malicious JavaScript into the signing UI, and walked Bybit's own authorized signers into approving a fraudulent cold-wallet transfer. The counterparty risk was baked into the architecture: the exchange held keys, a third party built the signing infrastructure, and a nation-state found the seam between them.
Every dollar sitting in a custodial exchange inherits that surface area. One compromised developer machine at one infrastructure provider is the entire exposure. The legal system's response, arriving 18 months later with a freeze on peripheral wallets, is a lagging indicator. The threat is not lagging.
The falsifiable version of this: if Bybit recovers more than 10% of the $1.5 billion through this civil action, via frozen intermediary wallets, seized OTC assets, or diplomatic enforcement against named John Doe defendants, then the legal route has real teeth and the thesis is wrong. Watch the enforcement actions against those John Doe accounts. That is where any actual recovery lives or dies.
This lawsuit establishes a post-hack playbook (civil suit plus injunction plus John Doe peripheral defendants) that will be replicated if it produces any measurable recovery. Exchanges are now large enough that nation-states have fully industrialized their targeting. $6.75 billion stolen all-time is not a rounding error; it is a weapons-funding line item.
What to Watch
Bybit said it will seek further relief from the court. The case to track is any enforcement action against the named John Doe defendants that results in actual fund repatriation from identified intermediary accounts. Court documents, if and when the complaint docket is posted publicly in U.S. District Court for the District of Columbia, will show the specific accounts and asset types the injunction currently covers. That is the ground truth on whether this freeze has teeth or is holding a perimeter around an empty room.
Sources
Frequently Asked Questions
Bybit's stated priority was protecting users first. The exchange maintained operations and continued processing withdrawals after the hack. Bybit's press release and Ben Zhou's public statements framed the lawsuit as part of ongoing recovery efforts, not as covering an unresolved user loss, but users seeking direct confirmation of how their specific account balances were handled should consult Bybit's official communications from February and March 2025.
No, not against the sovereign state directly. The DPRK does not recognize U.S. court jurisdiction and holds no attachable assets in the United States. The injunction's enforceable reach is limited to third-party actors: intermediaries, OTC desks, and exchanges that may hold traceable proceeds and fall within U.S. legal reach. That is the only layer where a judgment produces real-world consequences.
Attackers compromised a developer machine at Safe{Wallet}, the multisig infrastructure provider Bybit used for cold-storage management. They injected malicious JavaScript into the transaction signing interface. Bybit's own authorized signers, seeing what appeared to be a routine internal transaction, approved the transfer, effectively handing control of the cold wallet to the attackers. The FBI's IC3 PSA confirmed the attack chain and attributed it to the Lazarus Group, also known as TraderTraitor.
