Overview
- Bybit filed a U.S. civil suit naming the DPRK, its Reconnaissance General Bureau, and the Lazarus Group and on August 7, 2026 a federal judge granted a preliminary injunction freezing specified stolen assets tied to the February 2025 theft.
- The case relates to the Feb. 21, 2025 breach that drained more than 400,000 ETH and staked ETH—about $1.5 billion at the time—and the FBI has attributed that attack to DPRK‑linked Lazarus actors.
- Bybit says the injunction lets exchanges and custodians lock down wallets identified in its tracing work while the company seeks further court relief separate from ongoing criminal investigations.
- Investigators say the attackers exploited a supply‑chain flaw in Safe{Wallet} multisig software and then used cross‑chain bridges, mixers, and conversions into Bitcoin to hide funds, which has reduced the traceable share of the haul.
- Industry data show the Bybit theft is part of a larger pattern of DPRK‑linked crypto crime that Chainalysis put at roughly $2.02 billion in 2025 and about $6.75 billion cumulatively, and Bybit reports tens of millions recovered or frozen so far under joint tracing and exchange cooperation.