Bybit's $1.5B Lazarus Hunt: 5% Frozen, 90% Ghosted 🧊

A U.S. federal judge has granted crypto exchange Bybit a preliminary injunction freezing identified assets linked to the February 21, 2025 theft of approximately $1.5 billion in Ethereum (over 400,000 ETH and stETH), according to court records unsealed Thursday and a company press release issued Friday. The civil suit was filed under seal on June 18 in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea, its Reconnaissance General Bureau (RGB), the Lazarus Group, and 20 unidentified John Doe defendants. The court granted expedited discovery on June 19, issued a temporary restraining order that day, renewed it on July 16, and partially granted the preliminary injunction on July 30; some exhibits remain sealed.

Bybit's complaint alleges that some traceable assets reached exchanges operating or maintaining infrastructure in the United States, and seeks account-holder identities, balances, and transaction histories. The exchange is pursuing approximately $1.5 billion in compensatory damages, punitive damages, and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act. "The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit's ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime," Bybit said in the release. Co-founder and CEO Ben Zhou added: "Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable. The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry."

According to the June 18 filing, 90.2% of the stolen assets have become untraceable after passing through mixers, cross-chain bridges, and over-the-counter dealers, while the remaining 9.8% has been traced to identifiable wallets. Of the total, roughly 5.3% — about $75.5 million — has been frozen or recovered, including approximately $48.4 million recovered and about $30.5 million frozen across more than 28 exchanges and custodians. Bybit said the figure marks a sharp drop from more than a year ago, when Zhou stated that 68.57% of the funds remained traceable. Investigators have previously traced most of the stolen Ethereum converted to $BTC via Thorchain and pushed through Wasabi, Tornado Cash, and Railgun, and Greek authorities issued a seizure order in June against a domestic exchange wallet tied to a portion of the proceeds.

The Feb. 21, 2025 attack drained roughly 500,000 ETH from a Bybit cold wallet after attackers manipulated a signing interface that displayed the correct destination address while altering the wallet's underlying logic; the FBI attributed the theft to North Korea on Feb. 26, 2025. Forensic investigators said compromised credentials belonging to a Safe developer allowed the attackers to inject malicious code into the wallet provider's cloud infrastructure. The hack accounted for the bulk of the $2.02 billion in crypto stolen by North Korea in 2025, bringing the country's cumulative crypto thefts to $6.75 billion, according to Chainalysis data.

Bybit said the civil case runs alongside criminal investigations and that it continues to share blockchain intelligence with agencies including the FBI, pointing to Germany's takedown of the eXch exchange and the disruption of Cryptomixer.io by German and Swiss authorities as evidence of that cooperation. The proceedings remain ongoing.