Summary
Bybit, the world's second-largest cryptocurrency exchange, has filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) intelligence agency, and the Lazarus Group — the DPRK-linked hacking group responsible for stealing $1.5 billion from the exchange last year. Filed in the U.S. District Court for the District of Columbia, the lawsuit is accompanied by a preliminary injunction freezing certain stolen assets held by unidentified individuals and entities named as John Doe defendants.
Key Facts
- Bybit filed civil lawsuit against DPRK, RGB intelligence agency, and Lazarus Group
- Filed in U.S. District Court for the District of Columbia
- Won preliminary injunction freezing stolen assets held by John Doe defendants
- Feb 21, 2025: Lazarus Group executed largest crypto heist in history, stealing ~$1.5B in Ethereum (400,000+ ETH and stETH) from Dubai-based Bybit
- Bybit hack made up bulk of $2.02B in crypto stolen by North Korea last year
- North Korean hackers have stolen $6.75B worth of crypto total (Chainalysis data)
- North Korea widely believed to use stolen crypto to fund weapons program
- Bybit CEO Ben Zhou: "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry."
- Civil action pursued independently of ongoing U.S. criminal investigations
- Injunction prohibits respondents from transferring or selling assets while case ongoing
Why It Matters
Bybit's lawsuit against North Korea and the Lazarus Group represents a landmark attempt to hold state-sponsored hackers accountable through the civil legal system. The preliminary injunction freezing stolen assets is a significant legal tool — it prevents the identified assets from being transferred or dissipated while litigation continues, potentially enabling recovery. The case also highlights the scale of North Korean crypto theft: $6.75 billion stolen total, with the Bybit hack alone accounting for $1.5 billion. For the crypto industry, the lawsuit signals a shift toward using legal mechanisms — alongside law enforcement cooperation and on-chain tracing — to recover stolen funds and deter future attacks. The case underscores that crypto's transparency, which enables tracing, is also becoming a tool for accountability.