Bybit Sues North Korea, Freezes Assets After $1.5 Billion Lazarus Hack
Bybit, the world’s second-largest cryptocurrency exchange, has sued North Korea and the Lazarus Group in civil court. It also secured a preliminary injunction freezing some of the stolen assets. The case follows the alleged $1.5 billion hack on February 21, 2025. This is a sharp turn. Crypto companies have spent years building technical defenses; Bybit is now trying another route: a US courtroom. My take: the legal strategy matters almost as much as the freeze. The exchange wants its money back—and it wants the alleged attackers held responsible.
Bybit filed the complaint in the US District Court for the District of Columbia. The defendants include the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) intelligence agency, and the Lazarus Group. Bybit says hackers linked to the DPRK stole about $1.5 billion in Ethereum from the Dubai-based exchange, including more than 400,000 ETH and stETH. The scale is difficult to ignore. Chainalysis estimates that North Korea stole $2.02 billion in crypto during 2024 and $6.75 billion altogether. Why does that matter? Because governments and researchers have connected those funds to the country’s weapons programs. This is not ordinary exchange theft.
The lawsuit arrives as regulators scrutinize illicit finance in crypto more closely. By freezing assets held by unidentified “John Doe” defendants, the court has shown that exchanges can sometimes use standard legal orders to protect customers and pursue stolen money. Most commentary treats asset freezes as decisive. That’s only half right. An injunction can stop a transfer within reach of the court; it cannot erase years of costly breaches or magically recover assets outside that reach. Investors who distrust centralized exchanges may still find the order encouraging. Institutional interest has not disappeared, either. After regulators approved spot Bitcoin ETFs, BTC rose above $61,400 in early March as investors put money into the funds. Then another major theft happens. Can the infrastructure holding this capital keep it safe? I’ll be honest: the question remains unresolved.
The alleged connection between Lazarus and North Korea’s weapons program also makes Bitcoin’s safe-haven argument less convincing. Investors often buy gold during wars or political turmoil, while Bitcoin is commonly marketed as “digital gold.” I have trouble with that comparison when a government-backed group can steal $1.5 billion from a major exchange. North Korean hackers have reportedly stolen $6.75 billion in crypto in total. That money left the market. Some trust went with it. If the stolen BTC, ETH, or related assets reach public markets, subsequent sales could push prices down. Bitcoin rose 8% within 72 hours of the January 2020 strike that killed Qassem Soleimani, so buyers may turn to it during a geopolitical crisis. Counter to the usual safe-haven pitch, however, this case involves attackers targeting the crypto system itself.
Bybit co-founder and CEO Ben Zhou said, “Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable. The Lazarus attack wasn’t just an attack on Bybit. It was an attack on trust in our industry.” That can sound like standard executive language. In this case, it has practical consequences: traders rely on exchanges to safeguard their deposits. The injunction prohibits the respondents from transferring or selling the assets listed in the order. Bybit said the civil lawsuit is separate from criminal investigations already underway in the United States. The exchange will pursue its claim while law enforcement handles possible criminal charges. Two tracks. Different jobs.
What this means
Bybit’s case shows how exchanges can pair blockchain tracing with US civil litigation to pursue stolen funds. If it succeeds, other hacked platforms will probably examine the same approach. To my eye, that offers investors some comfort because centralized exchanges remain common entry points for individual buyers and institutions. But the popular takeaway—trace the coins, obtain an order, recover the money—is too neat. A court order only helps when investigators can locate the assets and bring them within the court’s reach. The decision to freeze funds controlled by anonymous defendants suggests investigators have traced at least part of the haul. That is especially relevant to the ETH and stETH stolen from Bybit. Is a civil lawsuit worth the expense? Future victims may use this case to answer that question.
Investors should watch for proof that Bybit can recover the funds or identify the “John Doe” defendants. The more than 400,000 ETH and stETH will be the main focus. If Bybit gets those assets back, they could restore liquidity to the exchange. If someone sells them instead, the market could feel the pressure. My view: recovery—not the initial injunction—is the real test. SEC or CFTC action on exchange security also bears watching. So do fresh sanctions against people or companies linked to North Korean hacking. Upcoming deadlines and hearings in the District of Columbia may disclose which assets the court froze and how Bybit intends to chase the rest. The injunction gives Bybit a foothold. Getting the money back will be much harder.