Bybit sues North Korea and Lazarus Group over $1.5B 2025 hack

Bybit has filed a civil lawsuit against North Korea, the country’s Reconnaissance General Bureau and the Lazarus Group over the $1.5 billion hack that hit the exchange in February 2025, according to reports citing the case. The action adds a legal track to Bybit’s effort to recover funds tied to one of the largest crypto thefts on record.

The exchange filed the case in the U.S. District Court for the District of Columbia. Bybit also secured a preliminary injunction aimed at freezing certain stolen assets held by unidentified individuals and entities named as John Doe defendants.

The lawsuit centers on the theft of more than 400,000 ETH and stETH that Bybit said was taken on Feb. 21, 2025. Bybit described the legal move as part of a wider effort to recover the stolen funds and hold those it blames for the attack accountable.

Court action adds pressure to recovery effort

Through ongoing legal action, the exchange aims to freeze the flagged assets and prevent their transfer or liquidation. In addition to unknown individuals and entities, the court filing explicitly targets North Korea, its intelligence agencies, and the Lazarus Group.

According to media reports, the February 2025 cyberattack led to the theft of more than 400,000 ETH and stETH, potentially setting a record for the largest crypto heist in history. However, these figures reflect external coverage rather than officially verified data.

At this stage, what is definitively known is that specialized outlets have reported on the claim and that legal proceedings are underway. Given the staggering scale of the hack and the involvement of state-backed actors, the litigation merges asset recovery, blockchain tracing, and international legal pressure.