Bybit Sues North Korea and Lazarus Group, Obtains Asset Freezing Order
N.R. Finch
Bybit, the world's second-largest crypto exchange, has sued North Korea and its Lazarus Group hacking unit in U.S. federal court over a $1.5 billion theft — and secured a preliminary asset-freeze order in what marks the crypto industry's first civil suit directly targeting a state-sponsored hacker.
What actually happened?
On February 21, 2025, Bybit was hit by an attack that drained over 400,000 ETH and stETH — roughly $1.5 billion — making it the largest single crypto theft on record.
Bybit then filed a civil lawsuit in the U.S. District Court for the District of Columbia, naming North Korea, its Reconnaissance General Bureau — the country's military intelligence arm — and the Lazarus Group as defendants.
This means → an exchange has, for the first time, hauled a sovereign state and its military intelligence apparatus into a civil courtroom. The signal matters more than the suit itself.
What can the freeze order actually lock down?
The court issued a preliminary injunction barring a group of unnamed defendants — listed as "John Doe" defendants — from moving or selling the stolen assets they hold.
In plain terms = the freeze order's job is to "pin the money in place" so it cannot be laundered or cashed out while the case proceeds.
The catch: North Korean hackers typically move assets fast through mixers and cross-chain bridges. How much the order can enforce depends on whether the on-chain assets can still be located.
How big is the North Korean hacking operation?
According to blockchain analytics firm Chainalysis, North Korean hackers have stolen a cumulative $6.75 billion in crypto. In 2025 alone the figure is roughly $2.02 billion, with the Bybit breach accounting for the bulk.
North Korea is widely believed to funnel stolen crypto into funding its weapons programs.
This reflects a threat that goes far beyond ordinary cybercrime — the industry faces systematic attacks backed by state resources, which is precisely why Bybit chose to sue a sovereign nation rather than just trace individual wallets.
How do the civil suit and the criminal probe relate?
Bybit stressed that its civil suit is independent of the ongoing criminal investigation by U.S. law enforcement. The two legal tracks run in parallel.
This means → the civil suit, initiated by Bybit, aims to recover and freeze assets; the criminal probe, led by the U.S. government, aims to prosecute. Neither depends on the other, but each can reinforce the other.
Bybit CEO Ben Zhou stated: "Lazarus's attack was not just an attack on Bybit — it was an attack on trust across the entire industry." Whether the case can materially recover any assets, however, still hinges on how the judicial process unfolds.
Content is for reference only, not financial advice.