Bybit takes unprecedented legal action after hacking on cryptocurrency

Bybit suffered a US$1.4 billion hack, prosecuting North Korea and Lazarus Group

The US$1.4 billion hack on Bybit is no longer just a technical issue. The trading platform has filed legal proceedings against North Korea and the Lazarus Group, the hacker group accused of orchestrating the attack. This unprecedented move could redefine how Web3 participants respond to national-backed cyber attacks and open a new chapter in the legal protection of cryptocurrencies.

Brief summary

Bybit sued North Korea, the Lazarus Group, and the North Korean intelligence agency's General Reconnaissance Bureau in U.S. federal court.
A U.S. court issued an injunction requiring an immediate global freeze of stolen assets.
About US$48.4 million has been recovered and more than US$30.5 million has been frozen on 28 cooperation platforms.
CEO Ben Zhou reiterated that protecting users and bringing perpetrators to justice are top priorities.

Bybit launches legal offensive in U.S. courts

Trading platform Bybit has filed a federal lawsuit of special size in the U.S. Federal Court for the District of Colombia. The legal action directly targeted multiple key players in state-backed threats and quickly led to strong safeguards:

Entities indicted: The indictment lists the Democratic People's Republic of Korea, its external intelligence agency, the General Reconnaissance Bureau, the hacker group Lazarus Group, and the anonymous defendants legally known as the "John Doe Defendant."
Court ruling: The federal court issued a preliminary injunction to freeze identified stolen assets and made it clear that "Bybit has shown the possibility of winning on substantive issues."

The legal offensive comes after the devastating attack on the platform on February 21, 2025, which judges regarded as "one of the largest cryptocurrency thefts in history." On the same day, hackers manipulated the Safe UI user interface through address spoofing and targeted phishing technology, breaking the Ethereum cold wallet.

Hackers stole huge assets worth nearly US$1.5 billion, including 401,347 ETH, 90,375 stETH, 15,000 cmETH, and 8,000 mETH. Bybit chose to file an independent civil lawsuit in the United States parallel to criminal investigations by law enforcement agencies such as the FBI, activating binding legal levers that could legally force global financial intermediaries to block suspicious financial flows.

Accounting overview and Bybit leadership's official response

At the accounting and operational levels, an international chase carried out jointly with blockchain analytics firm has begun to bear fruit despite the complexity of money laundering. So far, approximately US$48.4 million in stolen funds have been actually recovered, while more than US$30.5 million is frozen on the networks of more than 28 exchanges and third-party custody entities. These protective freezes demonstrate that immediate technical coordination among major digital finance participants is effective in critical events.

Responding to these developments, Bybit co-founder and CEO Ben Zhou reiterated the group's top priority: "Our goals have never changed: first to protect users, recover losses as much as possible, and ensure that those behind these attacks are held accountable." He also emphasized the global scope of the fight, noting: "The Lazarus Group attack was not only an attack on Bybit, but also an attack on the trust of our industry. That's why we work closely with investigators, exchanges, regulators, law enforcement and now courts. We hope this marks a new milestone in the cryptocurrency industry becoming more difficult for criminals to penetrate and ecologically safer for others." "The real test comes after the crisis," the executive concluded of the rigor needed to manage such financial traumas. Only then can you prove whether your promise is true."

Tightening of North Korea's capital chain

The scale of the case is set in the context of global security, and digital assets have become a major geopolitical target. On-line data released by Chainalysis shows that North Korean hackers stole approximately US$2.02 billion in cryptocurrency throughout 2025, bringing the total amount stolen by the Pyongyang regime to approximately US$6.75 billion. These funds were mainly used to fund its weapons program.

However, Bybit's unprecedented large-scale intrusion overwhelmed the mixed currency protocol commonly used by the Lazarus Group, forcing these cybercriminals to try to convert large amounts of Ethereum into Bitcoin through the over-the-counter market. This technical restriction leaves a digital footprint that can be used on the public ledger, allowing destination addresses to be identified and isolated.

In the future, this unprecedented combination of blockchain traceability, inter-business cooperation, and U.S. civil law could change the way risk management is carried out across the industry. Although North Korea's sovereignty makes direct enforcement of sentences legally complex, the ability to obtain international freezing bans locks off exports from hackers who convert funds into fiat currency. If this jurisprudence is consolidated, the opportunity cost and operational difficulty of laundering stolen funds will make national background attacks less attractive to Web3 infrastructure.