# Lazarus Group cryptocurrency theft and litigation

> Live situation record from CLSTR: https://clstr.news/situations/lazarus-group-cryptocurrency-theft-and-litigation
> Updated: 2026-08-08T17:24:39.000Z. Sources: 11. Developments: 3.

The North Korean-linked Lazarus Group continues to engage in large-scale cryptocurrency thefts and movements. In late July 2026, the group transferred approximately $7.7 million in Bitcoin, part of a long-term pattern of laundering stolen digital assets.

In August 2026, the cryptocurrency exchange Bybit filed a civil lawsuit in a U.S. District Court against North Korea, its Reconnaissance General Bureau, and the Lazarus Group. The suit seeks to recover approximately $1.5 billion stolen during a February 2025 cyberattack involving the theft of over 400,000 ETH and stETH. The attackers reportedly compromised a developer's computer at Safe{Wallet}, a multi-signature protocol used by Bybit, to inject malicious code and drain the wallet.

Following the lawsuit, a U.S. federal court issued a preliminary injunction freezing $30.5 million in digital assets linked to the hack. While Bybit has recovered approximately $48.4 million and frozen an additional $30.5 million across more than 28 global exchanges, the company reports that roughly 90% of the stolen funds remain untraceable due to the use of mixers, cross-chain bridges, and unregulated platforms. 

This incident coincides with broader trends; blockchain analytics firm Chainalysis estimated that North Korean-linked actors stole approximately $2.02 billion in cryptocurrency during 2025, a 51% increase from the previous year. U.S. officials suggest these thefts, which total an estimated $6.75 billion to date, help finance the regime's weapons programs.

## Claims

- The lawsuit seeks recovery of about $1.5 billion stolen in February 2025. (corroborated by 5 sources)
- Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and Lazarus Group. (corroborated by 4 sources)
- A preliminary injunction was issued freezing the identified stolen digital assets. (corroborated by 4 sources)
- Bybit CEO Ben Zhou said the company's focus is protecting users, recovering assets, and holding attackers accountable. (corroborated by 4 sources)
- The theft involved over 400,000 ETH and stETH. (corroborated by 3 sources)
- U.S. law-enforcement agencies are conducting a parallel criminal investigation. (corroborated by 3 sources)
- The court granted Bybit expedited discovery to track stolen funds. (corroborated by 2 sources)
- The hack compromised an Ethereum cold wallet. (corroborated by 2 sources)

## Timeline

### 2026-08-08: Bybit wins court order to freeze $30.5 million in massive crypto hack case

A U.S. court froze $30.5 million in assets following a $1.5 billion cryptocurrency hack of Bybit, which the exchange attributes to North Korean-linked actors including the Lazarus Group.

3 sources. https://clstr.news/cluster/bybit-wins-court-order-to-freeze-305-million-in-massive-crypto-hack-case

### 2026-08-06: Bybit sues North Korea and Lazarus Group over $1.5 billion crypto hack

Bybit filed a U.S. civil lawsuit against North Korea and the Lazarus Group to recover $1.5 billion stolen in a February 2025 crypto hack, securing an injunction to freeze identified stolen assets.

8 sources. https://clstr.news/cluster/bybit-sues-north-korea-over-15-billion-crypto-hack

### 2026-07-30: Lazarus Group shifts $7.7 million in Bitcoin, market reaction muted

Lazarus Group moved 121.5 BTC ($7.74 M) on July 30 2026; Bitcoin price stayed steady. The transfer follows years of large crypto thefts by North Korean hackers.

3 sources. https://clstr.news/cluster/lazarus-group-shifts-77-million-in-bitcoin-market-reaction-muted

---
Cite as: Lazarus Group cryptocurrency theft and litigation. CLSTR, https://clstr.news/situations/lazarus-group-cryptocurrency-theft-and-litigation