Crypto exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the notorious Lazarus Group over the 1.5 billion dollar heist that struck the platform in February 2025, marking the first time a major crypto company has directly sued a nation-state in U.S. federal court to recover stolen digital assets.
By Raj Patel | August 10, 2026
The Hook: A Lawsuit Against a Nation-State
The lawsuit, filed in the U.S. District Court for the District of Columbia, names North Korea, its intelligence agency the Reconnaissance General Bureau (RGB), and the Lazarus Group as defendants. Bybit also secured a preliminary injunction freezing certain digital assets linked to the theft and held by unidentified individuals and entities listed as “John Doe” defendants.
The order is designed to preserve identifiable stolen assets while the litigation continues. Bybit plans to seek further relief as investigators trace the funds through blockchain networks.
This legal action represents an unprecedented escalation in how crypto companies respond to state-sponsored theft. Rather than relying solely on law enforcement and insurance, Bybit is using the civil court system to pursue the perpetrators directly, testing whether U.S. courts can effectively adjudicate claims against foreign governments in the digital asset space.
On-Chain Evidence: How the Heist Unfolded
On February 21, 2025, hackers drained more than 400,000 ETH and stETH from a Bybit cold wallet. At the time, the stolen cryptocurrency was worth approximately 1.5 billion USD, making it the largest known crypto theft in history.
The attack was attributed to Lazarus, the North Korean state-linked hacking group that has targeted crypto companies and blockchain projects for years. But the attackers did not break through Bybit’s cold-storage defenses directly. Instead, they compromised infrastructure surrounding the wallet.
- Entry point — A developer associated with Safe{Wallet, the multisignature wallet infrastructure used by Bybit, was compromised.
- Malicious code — Attackers injected code that manipulated what appeared to be a legitimate transaction, changing the wallet’s underlying logic to redirect funds.
- The lesson — Even cold storage and multisignature protections can be undermined when attackers gain access to the people or software surrounding them.
The incident sent shockwaves through the crypto industry because Bybit was considered to have strong security practices. The fact that attackers went after the wallet infrastructure rather than the exchange itself demonstrated that security is only as strong as its weakest link.
The Core Conflict: North Korea’s Multi-Billion Dollar Crypto Industry
The Bybit attack was not an isolated incident. It accounted for the majority of North Korea’s cryptocurrency theft in 2025.
According to Chainalysis, North Korean hackers stole approximately 2.02 billion USD in cryptocurrency during 2025, a 51 percent increase from 2024. The blockchain analytics firm estimates that DPRK-linked hackers have stolen roughly 6.75 billion USD in crypto over time, making state-sponsored theft one of the most significant threats to the digital asset ecosystem.
Stolen cryptocurrency is widely believed to provide revenue for the North Korean regime, including funding associated with weapons programs. Lazarus has previously been linked to several major crypto attacks, including the 620 million dollar Ronin Network bridge hack and the 100 million dollar Harmony Horizon Bridge exploit in 2022.
The scale of the activity has made North Korea one of the most prominent state-linked cyber threats facing the crypto industry, and has pushed exchanges, regulators, and law enforcement agencies to collaborate more closely on tracking and freezing stolen assets.
Market Implications: What Recovery Looks Like in Practice
Recovering stolen crypto assets is extraordinarily difficult. After the Bybit heist, investigators tracked the cryptocurrency across thousands of wallet addresses and multiple blockchain networks. Large amounts of Ethereum were converted into Bitcoin, while other funds moved through cross-chain bridges, mixers, and crypto services designed to make transactions harder to follow.
Blockchain transparency has helped investigators monitor many movements, but tracing does not guarantee recovery. Once assets are divided among thousands of addresses or moved between networks, identifying their ultimate holders becomes increasingly complex.
Bybit has worked with blockchain analytics firms, exchanges, regulators, and law enforcement agencies to track and freeze portions of the stolen funds. The preliminary injunction adds a new legal tool to this effort, preventing certain identifiable assets from being moved or sold while the case proceeds.
For everyday crypto users, the implications are direct. The case highlights both the strengths and weaknesses of blockchain-based finance. Transparency means stolen funds can often be tracked in real time, unlike traditional bank transfers. But the irreversibility of crypto transactions means that prevention and security are far more important than post-incident recovery.
The Verdict: A New Era of Crypto Accountability
Bybit’s lawsuit against North Korea and Lazarus is unlikely to result in the direct recovery of all stolen assets. Suing a nation-state in U.S. court comes with enormous practical and diplomatic hurdles, and the Lazarus Group has demonstrated sophisticated capabilities for laundering cryptocurrency across borders.
But the legal action sends a powerful signal. Crypto companies are no longer treating state-sponsored theft as an unavoidable cost of doing business. They are using every available tool, from blockchain analytics to federal litigation, to pursue perpetrators and protect their users.
For investors, the takeaway is pragmatic. Choose exchanges with strong security practices and insurance coverage, but understand that no platform is immune from determined, state-backed attackers. Use hardware wallets for long-term holdings, enable multisignature protections where possible, and treat any hot wallet as a potential target. The era of passive crypto security is over.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
suing a nation-state for crypto theft is wild. they will never recover that 1.5B but the legal precedent matters more than the money
the part about attackers manipulating the UI to show a legit transaction while changing the underlying logic is genuinely scary. multisig did not help because the signed payload looked correct
technically it was a blind signing exploit not a multisig failure. the hardware wallet signed exactly what it was told, the problem was the user couldnt see what they were approving
suing a nation-state in DC federal court is wild. even if they win the judgment, good luck enforcing it against the RGB
the John Doe injunction is actually the smart part. freeze what you can trace while the case plays out. Lazarus moves funds fast though
Suing a country that doesn’t recognize US courts. I admire the effort but this is theater. The 1.5B is gone.
the real story here is the john doe injunction. freezing wallets tied to lazarus addresses actually does something, the lawsuit itself is symbolic
First time a crypto company sues a nation-state in federal court. Regardless of outcome, that precedent matters for future recovery attempts.
good luck collecting from north korea lmao
1.5 billion stolen and they are just now filing suit 18 months later? the legal strategy timing is interesting. probably waited until they had enough traced wallets to make the freeze meaningful