Bybit Takes Unprecedented Legal Action After Crypto Hack

The $1.4 billion hack suffered by Bybit is no longer just a technical matter. Indeed, the exchange platform has just initiated legal proceedings against North Korea and the hacker group Lazarus, accused of being behind the attack. This is an unprecedented initiative that could redefine how Web3 players respond to state-attributed cyberattacks and open a new chapter in the legal protection of cryptos.

In Brief

• Bybit sues North Korea, the Lazarus group and North Korean intelligence (RGB) before a US federal court.
• The US court grants an injunction ordering the immediate freezing of stolen assets worldwide.
• About $48.4 million has been recovered and more than $30.5 million frozen on 28 partner platforms.
• CEO Ben Zhou reaffirms the top priority of protecting users and bringing perpetrators to justice.

Bybit’s Legal Offensive in US Courts

The exchange Bybit filed a federal lawsuit of exceptional scope with the US federal court for the District of Columbia. This legal action directly targets several key players in the state-sponsored threat and quickly led to strong conservatory measures :

• The entities sued : the complaint names the Democratic People’s Republic of Korea (DPRK), its foreign intelligence service, the Reconnaissance General Bureau (RGB), the hacker collective Lazarus Group, as well as anonymous defendants referred to legally as “John Doe defendants” ;
• The court’s decision : the federal court granted a preliminary injunction ordering the freeze of identified stolen assets, expressly stating that “Bybit has demonstrated a likelihood of success on the merits”.

This legal offensive follows the devastating attack suffered by the platform on February 21, 2025, considered by magistrates as “one of the largest crypto thefts in history”. On that day, the hackers compromised a cold Ethereum wallet by manipulating the Safe UI user interface through an address spoofing and targeted phishing technique.

The hackers seized a colossal haul estimated at nearly $1.5 billion, composed precisely of 401,347 ETH, 90,375 stETH, 15,000 cmETH, and 8,000 mETH. By choosing to initiate an independent civil action in the United States alongside criminal investigations conducted by law enforcement agencies like the FBI, Bybit activates a binding legal lever enabling it to legally compel financial intermediaries worldwide to block suspicious flows.

Accounting Overview and Official Response from Bybit Leadership

On an accounting and operational level, the international hunt jointly conducted with blockchain analysis companies is beginning to bear fruit despite the complexity of laundering. To date, about $48.4 million of the total stolen has been physically recovered, while more than $30.5 million is currently frozen across a network of more than 28 exchanges and third-party custodial entities. These conservatory seizures demonstrate the effectiveness of immediate technical coordination among major digital finance players during a critical incident.

Reacting to these advances, Ben Zhou, co-founder and CEO of Bybit, reaffirmed his group’s top priority: “our goal has never changed: protect our users first, recover what we can, and ensure those behind these attacks are held accountable.”

He also emphasized the global scope of this battle, underlining that “Lazarus’s attack was not just an attack on Bybit. It was an attack on trust in our industry. That is why we have worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. We hope this marks a new milestone in making crypto a much harder sector for criminals and a much safer ecosystem for everyone else.” The executive concluded on the rigor required in managing such financial trauma: “the real test comes after the crisis. That’s when you show if your commitment is real.”

The Noose Tightens on North Korean Funding

The scale of this case fits into a global security context where digital assets have become major geopolitical targets. The on-chain data published by Chainalysis indicates that North Korean hackers stole about $2.02 billion in cryptos over the entire year 2025, bringing the cumulative total attributed to the Pyongyang regime to about $6.75 billion, largely intended to finance its weapons programs.

However, the unprecedented volume of the break-in suffered by Bybit saturated Lazarus’s usual mixing protocols, forcing the cybercriminals to attempt converting large amounts of Ether into Bitcoin via over-the-counter (OTC) markets. This technical constraint left exploitable digital footprints on public ledgers, enabling the identification and isolation of destination addresses.

In the future, this unprecedented junction between blockchain traceability, inter-company cooperation, and US civil law could transform risk management for the entire sector. Even if the sovereignty of North Korea makes the direct enforcement of judgments legally complex, the ability to obtain international freezing injunctions locks the hackers’ access to fiat currency exit ramps. If this jurisprudence consolidates, the opportunity cost and operational difficulty of laundering stolen funds could reduce the attractiveness of state-sponsored attacks against Web3 infrastructures.