Bybit has sued North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the 2025 USD 1.5 billion hack and secured an asset freeze.
According to CoinDesk, the lawsuit was accompanied by a preliminary injunction, a court order preventing a group of unidentified asset holders, named in the filing as ‘John Doe’ defendants, from moving or selling the disputed funds while proceedings continue. Bybit said the order is intended to preserve the identified assets during litigation and that it will seek further relief from the court as the case develops.
The exchange described the breach as an attack on trust across the crypto industry rather than a loss confined to Bybit itself, and said it has worked with investigators, regulators and law enforcement, and is now pursuing the matter through the courts, to hold those responsible to account. The civil action is being pursued separately from ongoing US criminal investigations into the hack.
Record-scale theft attributed to North Korea
The breach occurred in February 2025, when roughly 400.000 ether and staked ether tokens, worth approximately USD 1.5 billion at the time, were drained from Bybit, a UAE-based exchange. The incident ranks among the largest cryptocurrency thefts on record.
Data from analytics firm Chainalysis shows the Bybit hack accounted for the bulk of the USD 2.02 billion in crypto assets North Korea stole during 2025, part of an estimated USD 6.75 billion taken by North Korea-linked hackers over time.
A widening pattern of state-linked hacks
The theft fits a broader trend documented by blockchain analytics firm TRM Labs, which found that North Korea-linked hackers have stolen more than USD 6 billion in cryptocurrency through attributed incidents since 2017. Their share of total crypto hack losses has risen sharply, from under 10% in 2020 to 64% in 2025 and 76% so far in 2026.
The scale of North Korea-attributed thefts has drawn sustained attention from exchanges, regulators and law enforcement agencies seeking to disrupt the laundering and use of stolen digital assets. Bybit’s decision to pursue a civil claim, in parallel with criminal proceedings already under way in the US, adds a further legal avenue aimed at recovering funds and constraining the movement of assets linked to the hack.
