Bybit said on August 7, 2026, it filed a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the $1.5 billion crypto theft of February 2025. A US federal judge also froze identified stolen assets while the case proceeds.
Key Takeaways
- Bybit named North Korea, the Reconnaissance General Bureau, and the Lazarus Group as defendants in a civil suit filed in a US federal court.
- The Lazarus Group allegedly drained more than 400,000 ETH and stETH from the exchange in the February 2025 breach.
- A preliminary injunction bars unidentified John Doe defendants from transferring or selling stolen assets identified in the case.
- Ben Zhou, Bybit’s co-founder and CEO, described the Lazarus attack as an attack on trust in the crypto industry.
- Bybit plans to seek further relief from the court while US criminal investigations continue on a separate track.
What Happened?
Bybit, the world’s second-largest cryptocurrency exchange, filed the case in the US District Court for the District of Columbia. The complaint names the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) intelligence agency, and the state-sponsored Lazarus Group as defendants. The Dubai-based exchange disclosed the filing in a press release.
Alongside the complaint, Bybit secured a preliminary injunction against a group of unidentified individuals and entities, listed in the case as John Doe defendants, who hold assets traced to the theft. “The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit’s ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime,” the exchange said in the release.
Bybit is taking North Korea to court.
— CoinLaw (@coinlaw_io) August 7, 2026
The exchange has sued the DPRK, its spy agency, and the Lazarus Group over the $1.5B hack of Feb 2025, and a US federal judge has already frozen identified stolen assets. pic.twitter.com/EPcm9dwoPR
Inside the Largest Crypto Heist on Record
The lawsuit stems from the breach of February 21, 2025, when the stolen Ethereum left Bybit’s wallets in what remains crypto’s biggest heist on record. The Lazarus Group allegedly executed the attack on behalf of the North Korean state.
The breach accounted for the bulk of the $2.02 billion in crypto that North Korean hackers stole in 2025. According to Chainalysis data, North Korea-linked groups have taken $6.75 billion in digital assets in total. The country is widely believed to channel those proceeds into its weapons programs.
The theft dwarfs every earlier incident tracked in crypto exchange hack statistics, and its scale reshuffled the ranking of the most expensive crypto exchange hacks in a single day.
What the Asset Freeze Does?
The preliminary injunction means a federal judge ordered the John Doe respondents not to transfer or sell the assets they hold while the case is ongoing. Bybit said it will seek further relief from the court as the litigation moves ahead.
Ben Zhou, co-founder and CEO of Bybit, in a statement said:
Bybit added that the civil action is being pursued independently of ongoing criminal investigations by US law enforcement authorities.
The announcement leaves clear open questions. How much of the stolen value do the frozen assets represent? Who are the John Doe defendants holding them? And can any eventual judgment against North Korea itself actually be collected? Bybit’s release answers none of the three.
Implications for Crypto Recovery Efforts
The case could hand exchanges a template for chasing stolen funds through civil courts rather than waiting on criminal prosecutions alone. A freeze aimed at John Doe holders targets assets that blockchain tracing can still follow, which may prove more practical than a damages award against Pyongyang.
The dual-track approach also matters. Because the civil suit runs separately from the criminal investigations, Bybit can pursue recovery on its own timeline while prosecutors build their cases.
For exchange customers, the practical step is simpler. Users can review what their platform discloses about custody arrangements, cold wallet controls, and hack response plans before leaving large balances on any single venue.
CoinLaw’s Takeaway
The lawsuit turns a criminal investigation story into a civil recovery effort. Naming a sovereign state, its intelligence agency, and its hacking arm in a US complaint puts that attribution on the public court record. The John Doe injunction then gives Bybit a legal hold on coins that can still be traced. Frozen assets can eventually come back to users. A paper judgment against Pyongyang may never be collected.
The scale explains the effort. One breach produced most of North Korea’s crypto haul for that year, and the stolen funds sit at the center of a wider enforcement push. Bybit says the freeze also supports international law enforcement investigations, so each preserved wallet keeps evidence intact for those cases too. For an industry still measured against its worst security failures, a court-ordered freeze on stolen assets is a result that does not depend on the hackers’ cooperation.
