Bybit sues North Korea and Lazarus Group over $1.5B crypto hack

Bybit Lazarus Group cryptocurrency theft North Korea RICO lawsuit

Bybit has filed a civil RICO lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group. The litigation follows a February 2025 cyberattack that resulted in the theft of approximately $1.5 billion in digital assets, including over 400,000 Ethereum tokens. Investigators believe the breach occurred after hackers compromised a developer's computer at Safe{Wallet}.

A U.S. federal judge has granted Bybit expedited discovery, allowing the exchange to request account identities, balances, and transaction histories from platforms operating within the United States. Additionally, the court issued a preliminary injunction to freeze identified assets linked to the hack to prevent further dissipation.

To date, Bybit reports it has recovered approximately $48.4 million and successfully frozen over $30.5 million across more than 28 exchanges and custodians. However, the company noted that roughly 90.2% of the stolen funds remain untraceable due to the extensive use of mixing protocols, cross-chain bridges, and decentralized exchanges to obfuscate the trail.

Entities

Bybit · Chainalysis · FBI · John D. Bates · Lazarus Group · North Korea · Reconnaissance General Bureau · Safe{Wallet}

Claims

What the coverage asserts, and how many sources carry each claim.

[● 2 SOURCES] The hackers compromised a developer's computer at Safe{Wallet} to execute the theft of over 400,000 Ethereum tokens. news.bitcoin.com · www.analyticsinsight.net
[● 9 SOURCES] Bybit filed a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group in the U.S. District Court for the District of Columbia. www.tronweekly.com · crypto.news · en.coin-turk.com · news.bitcoin.com · www.analyticsinsight.net · +3 more
[● 4 SOURCES] Approximately 90.2% of the $1.5 billion stolen in the February 2025 hack is considered untraceable due to use of mixers and cross-chain swaps. crypto.news · news.bitcoin.com · www.analyticsinsight.net
[● 8 SOURCES] Bybit has recovered approximately $48.4 million in stolen assets. crypto.news · en.coin-turk.com · news.bitcoin.com · www.merca2.es · bitcoinethereumnews.com · +3 more
[● 4 SOURCES] A U.S. federal judge granted Bybit expedited discovery to request account identities and transaction histories from U.S.-linked platforms. crypto.news · www.analyticsinsight.net · assodigitale.it
[● 5 SOURCES] The FBI attributed the February 2025 theft to North Korean cyber actors known as TraderTraitor. crypto.news · www.analyticsinsight.net · bitcoinethereumnews.com · en.coin-turk.com · assodigitale.it
[○ 1 SOURCE] The February 2025 Bybit attack is considered the largest single digital theft in cryptocurrency history. en.coin-turk.com
[● 8 SOURCES] Over $30.5 million in stolen funds has been frozen across more than 28 exchanges and custodians. crypto.news · en.coin-turk.com · news.bitcoin.com · www.merca2.es · mycryptoparadise.com · +2 more