Summary
Bybit's civil lawsuit against North Korea, its Reconnaissance General Bureau (RGB) intelligence agency, and the Lazarus Group — accompanied by a preliminary injunction freezing stolen assets — represents a landmark attempt to hold state-sponsored hackers accountable through the civil legal system. The case highlights the scale of North Korean crypto theft ($6.75 billion total) and signals a shift toward using legal mechanisms, alongside law enforcement cooperation and on-chain tracing, to recover stolen funds and deter future attacks.
Key Points
- The case: Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against the DPRK, its RGB intelligence agency, and the Lazarus Group. The exchange won a preliminary injunction freezing certain stolen assets held by unidentified individuals and entities named as John Doe defendants.
- The hack: On February 21, 2025, the North Korean state-sponsored Lazarus Group executed the largest cryptocurrency heist in history, stealing ~$1.5 billion in Ethereum (over 400,000 ETH and stETH) from Dubai-based Bybit. The Bybit hack made up a bulk of the $2.02 billion in crypto stolen by North Korea last year.
- The scale of North Korean theft: North Korean hackers have stolen $6.75 billion worth of crypto total, according to Chainalysis data. The country is widely believed to use its ill-gotten crypto to fund its weapons program.
- The legal mechanism: The preliminary injunction means a federal judge ordered the respondents not to transfer or sell the assets they're holding while the case is ongoing. This is a powerful tool — it prevents the identified assets from being dissipated, potentially enabling recovery. Bybit said it will look for further relief from the court.
- The strategy: Bybit CEO Ben Zhou: "Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable. The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry." The civil action is pursued independently of ongoing U.S. criminal investigations.
- The industry implication: The lawsuit signals a shift toward using legal mechanisms — alongside law enforcement cooperation and on-chain tracing — to recover stolen funds and deter future attacks. Crypto's transparency, which enables tracing, is also becoming a tool for accountability. The case could set a precedent for how exchanges respond to state-sponsored theft.