Bybit Sues North Korea and Lazarus Group Over $1.5 Billion Crypto Hack, Secures Asset Freeze
Key Takeaways
- •Bybit filed a civil lawsuit in U.S. federal court seeking to recover approximately $1.5 billion in digital assets stolen during the largest cryptocurrency heist on record.
- •The February 21, 2025 attack compromised one of Bybit's Ethereum cold wallets, resulting in the theft of more than 400,000 Ether and staked Ether.
- •The FBI attributed the operation to North Korea under the designation "TraderTraitor," and the Lazarus Group, a U.S.-sanctioned state-sponsored hacking unit, has been linked to the theft.
- •Bybit secured a preliminary injunction prohibiting unidentified defendants from transferring or selling assets traced to the stolen funds while the litigation is ongoing.
- •The civil action is separate from ongoing U.S. criminal investigations and demonstrates the growing role of civil litigation in cryptocurrency recovery efforts targeting state-sponsored cybercrime.
Cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea, its intelligence agency, and the Lazarus Group over the theft of approximately $1.5 billion in digital assets in February 2025. The Dubai-based exchange is seeking to recover funds connected to what ranks as the largest cryptocurrency heist on record, exceeding the $620 million stolen from the Ronin Network bridge in 2022.
The complaint was filed in a U.S. federal court, where Bybit also secured a preliminary injunction. The injunction prohibits unidentified defendants holding assets traced to the theft from transferring or selling them while the litigation is ongoing.
The February 21, 2025 attack compromised one of Bybit's Ethereum cold wallets, resulting in the theft of more than 400,000 Ether and staked Ether from the exchange. The U.S. Federal Bureau of Investigation (FBI) attributed the operation to North Korea and designated it under the name "TraderTraitor." The Lazarus Group, a North Korean state-sponsored hacking unit sanctioned by the U.S. Treasury Department, has been linked by law enforcement agencies to a series of high-profile cryptocurrency thefts over recent years. United Nations Security Council panel reports have documented that stolen digital assets serve as a significant revenue source for Pyongyang's weapons programs, with total North Korean crypto thefts estimated in the billions.
Bybit stated that the civil action is separate from ongoing U.S. criminal investigations and that it intends to seek further relief from the court. The lawsuit provides the exchange with an additional legal avenue to pursue the stolen funds, as blockchain tracing technology enables investigators to identify and track the movement of assets across wallets and trading platforms even as stolen funds are rapidly laundered through decentralized exchanges, cross-chain bridges, and mixing services.
The case underscores the growing role of civil litigation in cryptocurrency recovery efforts, complementing criminal enforcement actions aimed at state-sponsored cybercrime targeting the digital asset industry.