Bybit Files U.S. Lawsuit Against Lazarus Group Over $1.5 Billion Crypto Hack

Bybit said it has filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group, escalating its effort to recover funds tied to what it alleges was a $1.5 billion crypto theft in February 2025. The exchange also secured a preliminary injunction aimed at preserving identified stolen assets, a move it framed as a critical step in preventing further dissipation while the case proceeds.

The complaint, announced Friday ET, targets alleged state-linked actors long accused by U.S. authorities of conducting high-profile cyberattacks to generate illicit revenue. Bybit, one of the world’s largest crypto exchanges by trading volume, claims the Lazarus Group orchestrated the 2025 theft and then routed the proceeds through a network of wallets and services designed to obscure their origin.

Alongside its claims against named defendants, Bybit said the court order applies to unknown individuals and entities that hold or moved the stolen cryptocurrency. In the filing, those parties are identified as ‘John Doe’ defendants—an approach frequently used in cyber and financial cases when on-chain activity can be traced but the real-world identity of controllers remains unclear.

The preliminary injunction bars transfers or depletion of identified stolen crypto during the litigation. In its order, the court said Bybit had demonstrated a likelihood of success on the merits—language that can strengthen a plaintiff’s ability to maintain asset freezes while discovery and further proceedings unfold. The judge also described the incident in an earlier temporary restraining order as “one of the largest cryptocurrency thefts in history,” according to Bybit.

Bybit positioned the civil case as complementary to the ongoing criminal investigation led by government agencies, including the FBI, saying it has been sharing blockchain intelligence and investigative findings with law enforcement. While criminal probes can take years and prioritize attribution and prosecution, civil proceedings can provide another route to ‘asset preservation’—securing funds that might otherwise be laundered or dispersed across jurisdictions.

Ben Zhou, co-founder and CEO of Bybit, said the exchange’s priorities have remained unchanged: protecting users, recovering funds where possible, and holding the responsible parties accountable. Zhou argued the alleged Lazarus operation was not merely an attack on Bybit but an assault on broader industry trust, prompting the firm to work closely with investigators, exchanges, regulators, law enforcement, and now the courts.

The lawsuit is part of what Bybit described as a broader strategy that combines blockchain analytics, international coordination, and judicial remedies to track illicit actors and disrupt laundering infrastructure. Since the February 2025 incident, Bybit said it has worked with blockchain analysis firms, exchanges, custodians, and international law enforcement to trace stolen assets and cut off laundering routes.

Bybit reported recovering roughly $48.4 million in stolen cryptocurrency to date and said it has helped freeze more than $30.5 million across over 28 exchanges and custody providers, with those assets pending further legal and investigative processes. The firm also pointed to enforcement actions that it said align with wider efforts to dismantle laundering channels allegedly used in the aftermath of the hack, including German authorities’ takedown of the crypto exchange eXch and subsequent moves by German and Swiss authorities to disrupt operations tied to the service “cryptomixer.io.”

Market observers have increasingly warned that large-scale crypto thefts—particularly those attributed to sophisticated, state-backed groups—pose a systemic risk that extends beyond individual platforms. High-value hacks can test ‘liquidity’ at exchanges, strain risk controls across custody providers, and trigger compliance tightening as funds attempt to traverse centralized and decentralized venues.

Bybit said it intends to seek additional judicial relief as the case progresses and reiterated that its goal is to make crypto thefts more difficult, more traceable, and more costly for attackers. Zhou said the real test comes after a crisis, emphasizing that trust must be rebuilt through sustained security upgrades and continuous cooperation with industry partners and investigators.

The civil proceedings remain ongoing. Bybit said it will continue working with relevant authorities and plans to disclose updates to the extent permitted by the court.