Bybit Wins Court Order Freezing Lazarus Group Assets From Its $1.5 Billion Hack
A U.S. district court granted Bybit a preliminary injunction freezing stolen assets tied to North Korea's Lazarus Group, stemming from a February 2025 exchange breach.
BY SAM OKAFOR4 MIN READ
A U.S. court granted an injunction freezing digital assets connected to the Lazarus Group and the Bybit breach.
The case behind the injunction
Bybit suffered a $1.5 billion breach in February 2025, one of the largest exchange hacks on record, which investigators later attributed to North Korea's state-backed Lazarus Group. The exchange pursued civil litigation in U.S. District Court, and the newly granted preliminary injunction freezes assets tied to the hackers wherever U.S. courts have jurisdiction to reach them.
Why a civil court, not just criminal charges
State-backed hacking groups rarely face meaningful criminal consequences, since their operators are typically shielded by the country sponsoring them. A civil injunction sidesteps that problem by targeting the stolen assets directly — freezing exchange accounts, intermediary wallets, and any downstream funds that can be traced and reached through U.S. courts, regardless of whether any individual is ever prosecuted.
WHY IT MATTERS
This sets a legal precedent: exchanges can use civil courts, not just law enforcement, to chase state-sponsored hackers' assets. Expect more victims of major breaches to pursue the same strategy going forward.
What to watch next
1.How much of the $1.5 billion in stolen assets is ultimately recovered under the injunction.
2.Whether other hacked exchanges file similar civil suits against Lazarus Group-linked wallets.
3.Any diplomatic or law-enforcement response tied to North Korea's state-sponsored hacking operations.
Frequently asked questions
What is the Lazarus Group?
A hacking group widely attributed to North Korea, responsible for some of the largest cryptocurrency thefts on record, including the 2025 Bybit breach.
How much did Bybit lose in the original hack?
Approximately $1.5 billion in digital assets, in a breach that occurred in February 2025.
What does the injunction actually do?
It legally freezes assets tied to the hack that U.S. courts have jurisdiction over, preventing them from being moved or cashed out while the case proceeds.
SOURCES & DATA
Education, not financial advice. See our editorial process and corrections policy.
Sam Okafor
Bitcoin Almanack's editorial byline for hardware wallets, software wallets, seed backups, multisig, recovery, and self-custody security.
Sources, standards & corrections
Sources are linked inline. Read our editorial information, AI disclosure and corrections policy, or report an error.
Sources are linked inline. Read our editorial information, AI disclosure and corrections policy, or report an error.