Bybit sues North Korea, Lazarus Group over $1.5B crypto theft
In brief
- Bybit sued North Korea, the Reconnaissance General Bureau, and Lazarus Group in US District Court for the District of Columbia
- The lawsuit targets a $1.5 billion theft of over 400,000 ETH and stETH on February 21, 2025, the largest crypto theft on record
- A preliminary injunction freezes identified stolen assets held by John Doe defendants
The Theft and Legal Action
The Lazarus Group allegedly stole more than 400,000 ETH and stETH from Bybit on February 21, 2025, in what became the largest crypto theft on record. The preliminary injunction prevents the defendants from transferring or selling the identified assets while the case proceeds.
Bybit's decision to pursue civil litigation represents a direct escalation in the exchange's response to the attack. The exchange said the legal action is part of its broader effort to recover stolen funds and hold those responsible for the attack accountable. The company also plans to seek additional relief from the court as the litigation advances.
Civil and Criminal Paths
The civil case is being pursued separately from ongoing criminal investigations by US law enforcement. This dual-track approach allows Bybit to pursue asset recovery through the courts while federal authorities investigate the theft as a criminal matter.
Suing a foreign nation and its intelligence apparatus presents significant enforcement challenges. Bybit's strategy of securing a preliminary injunction against John Doe defendants—unidentified individuals and entities holding the stolen assets—may prove more practical. The injunction creates a legal barrier preventing movement of identified funds, even if direct enforcement against North Korean entities remains limited by sovereignty and diplomatic considerations.
