Bybit Takes North Korea to Court and Freezes $1.5B Stolen in Record Hack

Bybit sues North Korea over record crypto theft

Bybit filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group. The Lazarus Group is the DPRK-linked unit that Bybit blames for the breach. The case targets about $1.5 billion stolen from the exchange in February 2025. Bybit filed the suit in the US District Court for the District of Columbia. It also named unidentified John Doe defendants who hold parts of the traced assets.

A US court froze the identified stolen assets

The court granted a preliminary injunction on 7 August 2026, the same day Bybit filed the case. The order freezes identified stolen digital assets held by the defendants. It prohibits any transfer or sale of those assets while the case proceeds. Bybit said the ruling preserves the funds and marks a step in its ongoing recovery effort. A preliminary injunction is a temporary measure that a court can revisit as the case develops.

The February 2025 hack drained over 400,000 ETH

The Lazarus Group drained more than 400,000 ETH and staked ether (stETH) from Bybit on 21 February 2025. Investigators have called it the largest cryptocurrency theft on record. The stolen assets were worth about $1.5 billion at the time. Since the breach, Bybit has pursued recovery through exchange coordination and financial incentives. It ran a bounty program that rewards analysts who help trace and freeze the stolen funds.

Bybit's CEO links the case to industry trust

Ben Zhou, Bybit's co-founder and chief executive officer (CEO), framed the lawsuit as one part of a broader recovery strategy. He tied the theft to wider confidence in the crypto market.

"Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable", 7 August 2026. — Ben Zhou, Co-founder and CEO, Bybit

"The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts", 7 August 2026. — Ben Zhou, Co-founder and CEO, Bybit

Ethereum traded near $1,916 at publication

Ether (ETH) traded at $1,916 at the time of publication, up 0.9% over the past 24 hours (CoinPaprika, 8 August 2026). The token held a market value of about $231 billion. The theft removed more than 400,000 ETH from Bybit, though token prices have shifted since the 2025 breach. The dollar value of any frozen assets therefore moves with the market.

The civil case runs beside criminal probes

The civil action proceeds separately from criminal investigations by US law enforcement. Bybit said it continues to work with investigators, exchanges, regulators, and now the courts. According to Chainalysis, North Korea-linked hackers stole about $2.02 billion in crypto during 2025, with the Bybit breach making up the bulk of that total. A preliminary injunction is a temporary measure, not a final judgment. The outcome now depends on further proceedings in Washington.