Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction Freezing Stolen Assets in Landmark Crypto Asset Recovery Effort

Lawsuit accuses North Korea and Lazarus Group of orchestrating the $1.5 billion theft, as court-ordered asset freeze supports recovery efforts and  Bybit expands collaboration with law enforcement and industry partners to strengthen accountability for crypto-related cybercrime

DUBAI, UAE, Aug. 8, 2026 /PRNewswire/ -- Bybit, the world's second-largest cryptocurrency exchange by trading volume, today announced that it has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group, which U.S. authorities have identified as the DPRK-linked hacking group responsible for the February 2025 cyberattack.

Bybit has also secured a preliminary injunction freezing identified stolen assets held by the unidentified individuals and entities holding or moving those funds, named in the case as John Doe defendants. The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit's ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime. Indeed, the court found that "Bybit has demonstrated a likelihood of success on the merits" in its lawsuit.

The legal action forms part of a broader strategy combining blockchain intelligence, international cooperation, and judicial remedies to pursue the illicit actors responsible for what the court, in granting the initial temporary restraining order, described as "one of the largest cryptocurrency thefts in history." While criminal investigations remain the responsibility of government authorities, the civil proceedings provide an additional avenue for preserving assets and protecting the interests of affected stakeholders.

"Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," said Ben Zhou, Co-founder and CEO of Bybit. "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. We hope this marks another step toward making crypto a much harder place for criminals to operate in and  a much safer place for everyone else."

Strengthening Accountability Through Legal Action

The preliminary injunction prohibits the transfer or dissipation of identified assets connected to the case while litigation continues. Bybit intends to seek additional judicial relief as the proceedings advance.

The civil action is being pursued independently of ongoing criminal investigations conducted by U.S. law enforcement authorities. Bybit continues to cooperate closely with relevant agencies, including the FBI, by sharing blockchain intelligence and investigative findings that may support broader enforcement efforts.

As digital assets increasingly become a target of sophisticated cross-border cybercrime, the company believes legal remedies, alongside criminal enforcement, can play an important role in preserving recoverable assets and strengthening accountability.

Global Collaboration Driving Asset Recovery

Since the February 2025 incident, Bybit has worked alongside blockchain analytics firms, exchanges, custodians, and international law enforcement agencies to trace stolen assets and disrupt laundering networks.

To date:

• Approximately US$48.4 million in stolen assets has been recovered.
• Over approximately US$30.5 million has been frozen across more than 28 exchanges and custodians, pending further legal and investigative action.

These efforts have also supported broader enforcement actions targeting infrastructure allegedly used to launder stolen funds. Authorities in Germany dismantled the cryptocurrency exchange eXch, while German and Swiss authorities later disrupted Cryptomixer.io, removing key channels used to move illicit proceeds. Together, these actions demonstrate the impact of effective cooperation between the private sector and law enforcement in combating transnational cybercrime.

"The real test comes after the crisis," Ben added. "That's when you show whether your commitment is real. For us, that means continuing to strengthen our security, working hand in hand with investigators and industry partners, and doing everything we can to protect our users. Trust isn't something you claim. You have to earn it through action, every single day."

Building a More Resilient Digital Asset Ecosystem

The legal proceedings represent one component of Bybit's broader commitment to improving security standards across the cryptocurrency industry. The company continues to invest in advanced blockchain intelligence capabilities, deepen cooperation with exchanges and regulators, and support initiatives aimed at making digital asset theft increasingly difficult, traceable and costly for criminal organisations.

This action reflects Bybit's commitment to holding state-sponsored threat actors accountable and using all available legal avenues, both civil and in cooperation with law enforcement, to disrupt cybercrime targeting the digital asset industry.

The civil proceedings remain ongoing. Bybit will continue to cooperate with relevant authorities and provide updates as permitted by the court.

#NewFinancialPlatform

About Bybit

Bybit is The New Financial Platform.

We believe every person should have access to every financial opportunity on earth. That's why we're building the first intelligent platform that connects anyone, anywhere to the world's finance.

Trusted by more than 80 million users worldwide, Bybit brings together investing, trading, payments, and wealth-building in a single secure and intelligent ecosystem. Through the combination of AI-powered technology, deep global liquidity, robust security, and transparent operations, Bybit makes global finance more accessible, efficient, and empowering for everyone.

Built for everyone. Powered by intelligence. Open to the world.

Learn more at Bybit.com.

For more details about Bybit, please visit Bybit Press
For media inquiries, please contact: media@bybit.com
For updates, please follow: Bybit's Communities and Social Media

Discord | Facebook | Instagram | LinkedIn | Reddit | Telegram | TikTok | X | Youtube