Bybit filed a lawsuit in U.S. District Court for the District of Columbia on August 7 against North Korea and the Lazarus Group, seeking recovery of $1.5 billion in Ethereum stolen in a February 2025 hack. The exchange secured an asset freeze as part of the action.
The theft marked one of the largest single losses in crypto exchange history. Bybit's legal move tests whether U.S. courts can enforce judgments against a nation-state and a designated hacking group, both of which typically operate outside the reach of conventional legal remedies.
Lazarus Group, a North Korean state-sponsored hacking operation sanctioned by the U.S. Treasury, has been attributed to major breaches across the crypto and traditional finance sectors since at least 2014. The group was linked to the 2014 Sony Pictures attack and the 2016 Bangladesh Bank heist. Intelligence agencies including the FBI and CISA have publicly attributed multiple crypto exchange compromises to Lazarus, including the 2022 Ronin bridge theft that cost $625 million and the Harmony protocol loss of $100 million the same year.
Bybit ranks among the top five crypto derivatives exchanges by trading volume. The platform processes hundreds of billions of dollars in annual volume across futures and spot markets. A breach of that scale would expose operational vulnerabilities that could affect customer confidence across the industry.
The February 2025 attack resulted in the direct theft of funds rather than a bridge exploit or protocol vulnerability. Bybit named North Korea as a co-defendant alongside Lazarus Group. Intelligence consensus holds the group operates as an instrument of the regime's state apparatus and reports directly to its leadership.
The asset freeze injunction, if enforced through international banking channels and blockchain monitoring, could complicate the movement of stolen funds through traditional finance or on-chain bridges. Crypto-to-fiat conversion typically requires banking relationships that can be interdicted through U.S. financial sanctions.
Bybit's litigation opens a novel procedural question: whether a U.S. judgment against a sanctioned foreign government can compel recovery of digital assets held or transited through U.S.-jurisdiction entities or regulated exchanges. A successful asset freeze would set precedent for future exchange theft cases; a dismissal on sovereign immunity grounds would likely end the action at the trial court level.
