Bybit Sues DPRK, RGB, and Lazarus Group Over $1.5 Billion Crypto Hack

Bybit sues DPRK

Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) intelligence agency, and the Lazarus Group over a $1.5 billion hack last year.

The exchange said the preliminary injunction it secured freezes certain stolen assets held by a group of unidentified individuals and entities named as John Doe defendants while litigation continues.

CoinDesk reported that on February 21, 2025, the North Korean state-sponsored Lazarus Group executed what it called the largest cryptocurrency heist in history, stealing approximately $1.5 billion in Ethereum (over 400,000 ETH and stETH) from Dubai-based Bybit.

CoinDesk also said the Bybit hack made up a bulk of the $2.02 billion in crypto stolen by North Korea last year, and that North Korean hackers have stolen $6.75 billion worth of crypto, according to data from Chainalysis.

Reporting for this sectionCoinDeskbloomingbit

Injunction and intent

Bybit said the order is intended to preserve identified stolen digital assets while the litigation continues, and CoinDesk quoted the exchange describing it as an important step in efforts to recover funds and reinforce accountability for large-scale cybercrime.

In the same release, Ben Zhou, co-founder and CEO of Bybit, said, "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry."

CoinDesk reported that the preliminary injunction means a federal judge ordered the respondents not to transfer or sell the assets they’re holding while the case is ongoing.

bloomingbit added that Bybit secured a preliminary injunction barring the transfer or disposal of certain assets tied to the case while the litigation proceeds, and that the civil case is separate from an ongoing criminal investigation by U.S. law enforcement authorities.

Reporting for this sectionCoinDeskbloomingbit

What’s at stake

Bybit’s lawsuit frames the Lazarus operation as DPRK-linked, identifying the Lazarus Group as responsible for stealing $1.5 billion from the exchange last year. CoinDesk said the exchange is widely believed to use ill-gotten crypto to fund its weapons program, and it reported that Bybit’s civil action is being pursued independently of ongoing criminal investigations conducted by U.S. law enforcement authorities.

In DiarioBitcoin, Bybit described the case as the biggest cryptocurrency hack, stating that the attack occurred on 21 de febrero de 2025 and that the Lazarus Group robbed approximately USD $1.500 millones en Ethereum. DiarioBitcoin also said that the preliminary judicial order freezes the stolen assets linked to the attack and prohibits their transfer or dissipation while the litigation continues, with the case naming John Doe defendants among the parties identified in the order.

Reporting for this sectionDiarioBitcoinCoinDesk