Bybit's $1.46B Hack, One Year On: Suing North Korea's Lazarus Group

Core facts: Bybit lost $1.46 billion in 2025 — and is now suing North Korea over it

In February 2025, crypto exchange Bybit was hacked for roughly $1.46 billion — the largest crypto theft on record, widely blamed on North Korea's Lazarus Group. In August 2026, Bybit filed a civil lawsuit in a U.S. federal district court against North Korea, its Reconnaissance General Bureau (RGB), and the Lazarus Group, and won a preliminary injunction freezing the stolen assets. About $48.4 million has been recovered, with a further $30.5 million frozen.

What happened

The February 2025 breach drained roughly $1.46 billion from Bybit in a single operation — close to $1.5 billion on some counts — the biggest exchange hack in industry history. Reporting has consistently tied it to the Lazarus Group, the North Korea–linked outfit long accused of hitting exchanges and decentralized protocols to raise funds for the state.

A year on, the story has shifted from the theft to recovery and accountability. In August 2026, Bybit sued North Korea, its RGB, and Lazarus in a U.S. federal district court and obtained a preliminary injunction freezing the stolen assets. Bybit also disclosed that about $48.4 million has been recovered and roughly $30.5 million is currently frozen.

Background and context

Suing the attacker behind an exchange hack is routine. Suing a sovereign state and its intelligence service, and asking a court to freeze the assets, is not. North Korea's defendants are unlikely to ever appear, so the case's practical value lies less in a courtroom win than in the freeze order — a legal foothold for clawing funds back and a signal of cooperation with law enforcement and compliance channels.

Against a $1.46 billion loss, $48.4 million recovered is small, which tracks with how on-chain thefts usually go. Once funds are split, bridged, and pushed through mixers, recovery gets very hard. Freezing $30.5 million is, relatively speaking, a positive result. Bybit says it will keep working with law enforcement and on-chain analytics teams on recovery.

What it means for the market

For users and the industry, the takeaway isn't the dollar figure — it's the playbook. After a breach, an exchange can combine civil litigation, court freeze orders, on-chain tracing, and law enforcement cooperation instead of simply waiting. For North Korea–linked attackers, the risk of frozen funds and legal exposure keeps rising even after the money leaves the exchange.

The size of the $1.46 billion loss also reminds investors how large a single platform's exposure can be. Spreading holdings across venues, rather than parking everything in one place, remains the most direct defense. When comparing platforms, look at the proof of reserves and security mechanisms that majors such as Binance and Bybit publish. For account openings, the main venues' entry points are here: Binance, OKX, or Gate.io.

Risk warning

Recovery is slow and typical rates are low, so don't over-read any single legal development. The practical priority stays the same: choose platforms with a clear security record and transparent reserves, and diversify where funds sit.

Risk disclosure and affiliate notice: Crypto trading and holding carry the risk of losing your principal, and a security incident can leave assets stuck. Nothing here is investment advice. This article contains affiliate links; signing up through them may earn us a commission at no extra cost to you, and it does not affect our independent judgment. Case details and recovery and freeze figures are subject to Bybit's official announcements and are current as of October 2026.