< Back to situations

Get alerts on this situation

We’ll email you as it develops, and you can follow the whole thread from day one.

Unsubscribe anytime.

[SITUATION] · [ACTIVE]

3 clusters · 11 sources · 10 days · First seen 10 days ago · Last updated about 5 hours ago

Categories: BUSINESS · CRIME

Lazarus Group cryptocurrency theft and litigation

Entities: Lazarus Group · Reconnaissance General Bureau · Bybit · North Korea · Lookonchain

Overview

The North Korean-linked Lazarus Group continues to engage in large-scale cryptocurrency thefts and movements. In late July 2026, the group transferred approximately $7.7 million in Bitcoin, part of a long-term pattern of laundering stolen digital assets.

In August 2026, the cryptocurrency exchange Bybit filed a civil lawsuit in a U.S. District Court against North Korea, its Reconnaissance General Bureau, and the Lazarus Group. The suit seeks to recover approximately $1.5 billion stolen during a February 2025 cyberattack involving the theft of over 400,000 ETH and stETH. The attackers reportedly compromised a developer's computer at Safe{Wallet}, a multi-signature protocol used by Bybit, to inject malicious code and drain the wallet.

Following the lawsuit, a U.S. federal court issued a preliminary injunction freezing $30.5 million in digital assets linked to the hack. While Bybit has recovered approximately $48.4 million and frozen an additional $30.5 million across more than 28 global exchanges, the company reports that roughly 90% of the stolen funds remain untraceable due to the use of mixers, cross-chain bridges, and unregulated platforms.

This incident coincides with broader trends; blockchain analytics firm Chainalysis estimated that North Korean-linked actors stole approximately $2.02 billion in cryptocurrency during 2025, a 51% increase from the previous year. U.S. officials suggest these thefts, which total an estimated $6.75 billion to date, help finance the regime's weapons programs.

Claims

What the coverage asserts, and how well corroborated each claim is across sources.

[● 5 SOURCES] The lawsuit seeks recovery of about $1.5 billion stolen in February 2025. (The lawsuit seeks recovery of about $1.5 billion stolen in February 2025.)
[● 4 SOURCES] Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and Lazarus Group. (Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaisas)
[● 4 SOURCES] A preliminary injunction was issued freezing the identified stolen digital assets. (A preliminary injunction was issued freezing the identified stolen digital assets.)
[● 4 SOURCES] Bybit CEO Ben Zhou said the company's focus is protecting users, recovering assets, and holding attackers accountable. (Bybit CEO Ben Zhou said the company's focus is protecting users, recovering assets, and holding attackers accountable.)
[● 3 SOURCES] The theft involved over 400,000 ETH and stETH. (The theft involved over 400,000 ETH and stETH.)
[● 3 SOURCES] U.S. law-enforcement agencies are conducting a parallel criminal investigation. (U.S. law-enforcement agencies are conducting a parallel criminal investigation.)
[● 2 SOURCES] The court granted Bybit expedited discovery to track stolen funds. (The court granted Bybit expedited discovery to track stolen funds.)
[● 2 SOURCES] The hack compromised an Ethereum cold wallet. (The hack compromised an Ethereum cold wallet.)

Timeline

about 5 hours ago

[BUSINESS] 3 sources
Bybit wins court order to freeze $30.5 million in massive crypto hack case
A U.S. court froze $30.5 million in assets following a $1.5 billion cryptocurrency hack of Bybit, which the exchange attributes to North Korean-linked actors including the Lazarus Group.
2 days ago

[BUSINESS] 8 sources
Bybit sues North Korea and Lazarus Group over $1.5 billion crypto hack
Bybit filed a U.S. civil lawsuit against North Korea and the Lazarus Group to recover $1.5 billion stolen in a February 2025 crypto hack, securing an injunction to freeze identified stolen assets.
10 days ago

[CRIME] 3 sources
Lazarus Group shifts $7.7 million in Bitcoin, market reaction muted
Lazarus Group moved 121.5 BTC ($7.74 M) on July 30 2026; Bitcoin price stayed steady. The transfer follows years of large crypto thefts by North Korean hackers.

Sources

abmedia.io · ambcrypto.com · bitcoinethereumnews.com · criptotendencias.com · cryptobreaking.com · cryptonomist.ch · en.coin-turk.com · europesays.com · mycryptoparadise.com · news.bitcoin.com · nu-vera.com

This summary has been updated 1 time: see revision history