Bybit sues North Korea, Lazarus Group over alleged $1.5B crypto theft
Bybit said it filed a civil lawsuit in U.S. federal court and won a preliminary injunction to freeze identified stolen assets after a February 2025 cyberattack it says involved $1.5 billion in crypto.
Bybit said on Aug. 8, 2026, that it filed a civil lawsuit in U.S. District Court for the District of Columbia against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group over a February 2025 cyberattack the company says involved $1.5 billion in stolen crypto.
The exchange also said it secured a preliminary injunction freezing identified stolen assets held by unidentified people and entities named in the case as John Doe defendants. Bybit said the court found it had shown a likelihood of success on the merits.
Why it matters
Bybit said the case is part of its recovery and accountability effort after what it described as one of the largest cryptocurrency thefts in history. The lawsuit adds a civil track to the recovery process while the company says it continues to work with law enforcement and other investigators.
Context and background
In its release, Bybit said U.S. authorities have identified Lazarus Group as the DPRK-linked hacking group responsible for the February 2025 attack. The company said it is pursuing the civil action separately from criminal investigations by U.S. law enforcement.
Bybit said it has worked with blockchain analytics firms, exchanges, custodians and international law enforcement since the incident. It also said it shares blockchain intelligence and investigative findings with relevant agencies, including the FBI.
The company said it has supported enforcement actions in Germany against eXch and Cryptomixer.io, which the release said were used to launder illicit proceeds. Bybit said those actions removed key channels used to move such funds.
What the company said
Bybit co-founder and CEO Ben Zhou said the company’s focus was to “protect our users first, recover what we can, and make sure the people behind these attacks are held accountable.” He also said the attack was “an attack on trust in our industry.”
In the same release, Zhou said trust is something companies must earn “through action, every single day.”
What happens next
Bybit said the civil proceedings remain ongoing and that it may seek additional judicial relief as the case progresses. The company said it will continue cooperating with authorities as recovery efforts move forward.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
View the Web StoryA visual, tap-through version of this reportThis is the AMP version of the article. Read the full article on Atlas Watchline.