Cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau (RGB), and the Lazarus Group over the $1.5 billion hack that drained over 400,000 Ether from the platform in February 2025. The case, lodged in the U.S. District Court for the District of Columbia, also secured a preliminary injunction that freezes specific assets linked to the breach while the litigation proceeds.
The attack, which occurred on February 21, 2025, is the largest cryptocurrency theft on record. The Federal Bureau of Investigation (FBI) attributed it to North Korean state-sponsored actors tracked under the name TraderTraitor. Bybit CEO Ben Zhou declared that the Lazarus attack was "not merely an attack on Bybit, but an assault on trust within the entire cryptocurrency industry." He stressed the exchange's commitment to user protection, recovery, and accountability, noting cooperation with investigators, regulators, and other exchanges.
The court order prevents unnamed defendants—listed as John Does—from transferring, selling, or disposing of the identified stolen assets. While the civil case proceeds separately from a parallel U.S. criminal investigation, the injunction offers Bybit a new legal avenue after months of blockchain tracing, voluntary industry freezes, and a bounty program. The stolen funds remain partly traceable: by April 2025, roughly 27.6% had gone dark after the attackers converted Ether into Bitcoin and dispersed it through cross-chain protocols and mixers.
Bybit covered the shortfall following the hack through Ether purchases, loans, and industry deposits, allowing it to maintain customer withdrawals. North Korean-linked groups netted an estimated $2.02 billion in crypto theft during 2025 alone, pushing the nation’s cumulative haul to about $6.75 billion. The Lazarus Group was later accused of draining another $577 million from Drift Protocol and KelpDAO in April 2026.
The lawsuit marks a pivotal moment in the fight against state-sponsored crypto crime and could set a precedent for how exchanges pursue legal recourse against sovereign-backed hackers.
