Can Bybit Recover Funds From the $1.5 Billion Lazarus Hack?
Estimated Reading Time: 3 minutes
Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you are unlikely to be protected if something goes wrong. Take 2 minutes to learn more
Key Takeaways:
- Bybit is suing North Korea over the $1.5B Lazarus hack.
- A US court has frozen identified assets linked to the theft.
- Recovering the stolen funds remains uncertain despite the legal action.
Suing a nation-state rarely produces a check in the mail. But eighteen months after crypto’s largest heist on record, Bybit is betting that a US courtroom can accomplish something blockchain forensics alone couldn’t.
Bybit is suing North Korea over the $1.5 billion Lazarus Group crypto heist, with a US federal court issuing a preliminary injunction freezing identified assets linked to the hack as the civil case moves forward.
What Happened, and Who’s Being Sued
The theft occurred on February 21, 2025, when Lazarus-linked hackers compromised the Safe{Wallet} multisig platform Bybit used for cold wallet transfers, tricking executives into approving a transaction that sent roughly 400,000 ETH and staked ETH to attacker-controlled wallets. Bybit has now filed suit in the US District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group directly.
The Injunction Is What Actually Matters
A lawsuit against a sanctioned state is largely symbolic — North Korea won’t appear in court. The real tool is the injunction, which bars unidentified “John Doe” defendants holding traced stolen funds anywhere from transferring or disposing of them while litigation continues, giving Bybit and law enforcement legal leverage over anyone caught holding laundered proceeds.
Recovery Is Still Far From Guaranteed
The civil case runs alongside a separate ongoing US criminal investigation. CEO Ben Zhou called the hack an attack on trust in the crypto industry broadly. But Lazarus’s laundering playbook — rapidly converting stolen ETH into Bitcoin and scattering it across thousands of addresses — was built specifically to defeat this kind of pursuit.
Whether this injunction recovers meaningful funds or simply marks accountability on paper depends on how much of that trail investigators can still follow.
