Bybit sues North Korea, Lazarus, and others over $1.5 billion crypto theft in Washington, DC

Bybit, the Dubai-based crypto exchange ranked second globally by trading volume, has taken the North Korean state, its Reconnaissance General Bureau, the Lazarus group, and unnamed individuals and entities to federal court in Washington, DC. The case is about one thing high-risk operators know well: once stolen crypto moves across chains and addresses, recovery turns into a legal and tracing exercise, not just a tech problem.

1. Bybit says Lazarus, which it describes as operating under North Korean control, carried out the theft on February 21 last year and stole more than 400,000 ETH and stETH from the exchange.
2. At the time, Bybit put the value of the stolen assets at about $1.5 billion. The exchange is asking the court to order the return of all funds taken in the attack.
3. The lawsuit was filed in a federal court in Washington, DC. Bybit said the civil case is separate from the criminal investigations being handled by US law enforcement.
4. The FBI has also formally said North Korea was behind the Bybit hack. According to the bureau, the attackers converted part of the stolen funds into bitcoin and other digital assets, then spread them across thousands of addresses on different blockchains.
5. Bybit’s claimed loss made up most of the $2.02 billion stolen last year by hackers linked to North Korea. Chainalysis says North Korea-linked cybercrime groups were the most active in the world, accounting for 76% of all service hacks in 2025, while the value of crypto assets stolen by North Korean hackers was 51% higher than in 2024. TRM Labs says the total value of crypto stolen by North Korean hackers over nine years exceeded $6 billion.

For PSPs, exchanges, and banks touching crypto flows, the practical takeaway is simple: large-scale thefts tied to sanctioned or state-linked actors are not just incident-response stories. They become sanctions, tracing, freezing, and court-enforcement problems across multiple blockchains and jurisdictions.