Bybit, the world’s second-largest cryptocurrency exchange, has filed a civil lawsuit against the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the state-sponsored Lazarus Group for the $1.5 billion Ethereum hack that shook the industry in February 2025.
This unprecedented legal action follows the largest crypto heist in history, which drained over 400,000 ETH from Bybit’s hot wallet. The attack has prompted institutions to reconsider their Ethereum exposure; for instance, Intesa Sanpaolo Slashes Bitcoin ETF Stake by 94%, Triples Ether ETF Holdings in Q2 Shift.
The lawsuit, filed in the U.S. District Court for the District of Columbia, names the DPRK, its RGB intelligence agency, and Lazarus Group as defendants, along with unidentified “John Doe” holders of the stolen funds. As Ethereum confronts these security challenges, the network is also navigating a new phase of development, as detailed in Ethereum Enters Second Decade After Foundation Upheaval: What’s Next?.
Bybit simultaneously obtained a preliminary injunction that freezes certain stolen assets, barring the transfer or dissipation of identified funds while the litigation proceeds. The case underscores how law enforcement and private actors are innovating in crypto recovery, much like Hyperliquid Brings Composability to Perpetual Futures Through HyperEVM is reshaping DeFi infrastructure.
Background: The $1.5 Billion Ethereum Heist
On February 21, 2025, the North Korean hacking unit Lazarus Group breached Bybit’s security, making off with roughly $1.5 billion in Ethereum. The attack exploited a vulnerability in the exchange’s multi-signature cold wallet migration, orchestrating fraudulent transactions that moved the funds to wallets controlled by the DPRK. The sheer scale of the theft eclipsed all previous crypto heists, sending shockwaves through the market and triggering a reevaluation of exchange security protocols globally.
Blockchain analytics firms quickly traced the stolen ETH as it was mixed through tumblers and cross-chain bridges, a pattern consistent with Lazarus’s long history of siphoning crypto to fund Pyongyang’s weapons programs. The incident renewed calls for stronger real-time on-chain monitoring and cross-jurisdictional cooperation to counter state-sponsored cybercrime.
The Legal Offensive and Its Broader Implications
Bybit’s lawsuit marks a rare instance of a private exchange directly taking a sovereign state to U.S. federal court. The asset freeze injunction obtained from Judge Randolph Moss effectively prevents the DPRK and Lazarus from moving, selling, or otherwise using the identified stolen cryptocurrency. While collecting a judgment against a nation like North Korea remains difficult, the legal victory establishes a precedent for crypto platforms pursuing stolen funds through Western judicial systems.
The case also highlights the growing intersection of national security and digital asset regulation. U.S. authorities have increasingly targeted crypto mixers and exchanges that facilitate money laundering for rogue states. Bybit’s aggressive legal stance could encourage other victimized platforms to use civil litigation as a tool for restitution, especially as Ethereum’s ecosystem matures and institutional adoption deepens.
