Ethereum Theft: Bybit Sues North Korea Over $1.5 Billion

Crypto News

Bybit has sued North Korea over the theft of more than 400,000 Ethereum tokens, placing the exchange’s $1.5 billion recovery effort before a federal court. The complaint, brought before the federal trial court in Washington, names the Democratic People’s Republic of Korea, its intelligence arm, the Reconnaissance General Bureau, and the Lazarus Group as the state-linked hacking organization accused of orchestrating the February 2025 exploit. Bybit’s official announcement says the civil action seeks accountability for the largest cryptocurrency theft on record and is being pursued independently of ongoing criminal work by U.S. authorities. The exchange also confirmed that the court has granted a preliminary injunction blocking unnamed individuals and entities, designated as John Doe defendants, from moving or dissipating identified stolen assets while the case proceeds. That order gives Bybit a preservation tool before discovery and damages claims can advance, and it signals that a major exchange is willing to pursue sovereign and state-sponsored defendants through conventional litigation channels. The order does not resolve liability, but it narrows the defendants’ ability to move value before the exchange can press its claims. The filing is important beyond Bybit’s own balance sheet because it treats a cyber-heist as a recoverable civil claim, not only as a forensic tracing exercise. It also gives the exchange a formal mechanism to contest any future attempt to launder, convert, or rehypothecate the frozen funds. Bybit framed the step as part of a broader effort to protect users and reinforce confidence in digital-asset custody, a sensitive issue for every altcoin and major token market when a top venue is hit. The company has said it supplemented reserves after the theft and kept customer balances intact, while the lawsuit adds a civil recovery track aimed at the alleged perpetrators and their state sponsors before a U.S. federal court.

The asset-freeze angle is the most immediate legal effect, but the underlying theft remains the benchmark for state-linked crypto crime. According to the exchange’s statement, the February 21, 2025 attack exploited a supply-chain weakness in Safe{Wallet}, a third-party multisignature interface used during a routine transfer from cold storage to hot storage. The hackers allegedly compromised developer equipment through social engineering and phishing, then altered the front-end display so that transaction reviewers saw normal addresses while the actual destination had been substituted. More than 400,000 ETH and stETH were moved out in the operation, valued at roughly $1.5 billion at the time. Blockchain-analytics estimates cited in the filing materials show the Bybit incident accounted for most of the $2.02 billion in crypto attributed to North Korean actors in 2025, and for a large share of the $6.75 billion cumulative total linked to the country’s hacking operations. Those proceeds are widely believed to support weapons programs, which is why the case carries sanctions and national-security implications as well as commercial ones. Bybit previously offered a bounty of as much as 10% for information helping trace the funds, an incentive program rather than an airdrop, and it has emphasized that the injunction does not end the recovery effort. The exchange said it will seek additional relief from the court, leaving open further orders related to custody, turnover, or damages. For the market, the key distinction is that the freeze targets identified assets, not the entire stolen sum, so the final recovery may depend on tracing forks, swaps, and bridges over time. This is not a price event, but it touches the risk premium applied to exchange custody and to assets such as Ethereum, where a single large forced-sale or laundering path can influence sentiment even when markets are far from an all-time high. That makes the legal record as important as the blockchain trail.

COINOTAG’s analysis centers on the court’s own order rather than the surrounding publicity. The federal district court in Washington, D.C. granted a preliminary injunction, an interlocutory posture, requiring John Doe defendants to preserve identified stolen digital assets and prohibiting transfer or dissipation during litigation. That holding creates a preservation mechanism, but it does not establish final ownership or guarantee restitution. The harder test will be converting frozen addresses into enforceable turnover, especially against state-linked actors. Still, the filing demonstrates that large-scale custody breaches can be met with civil process, not only forensic response, an important precedent for Ethereum and broader algorithmic stablecoins custody risk.