Bybit sues North Korea; audit your exchange rails now

Bybit secured a preliminary asset freeze order and filed civil suit in connection with the $1.5 billion hack attributed to North Korea's Lazarus Group. The court action is notable because it demonstrates that common law jurisdictions will entertain large-scale crypto theft claims and grant interim relief, even when the named defendant is effectively a sovereign actor. Recovery of the frozen assets is a separate and much harder problem, but the legal mechanism worked at the first stage.

The Lazarus breach itself, disclosed in early 2025, was the largest single crypto theft on record. Attackers compromised Bybit's cold wallet infrastructure through a supply chain attack on the signing interface, bypassing multi-sig controls without triggering standard alerts. The funds moved through a network of mixers and bridge protocols within hours.

The lawsuit shifts the conversation from "can you sue over a crypto hack" to "what is your documented security posture." Courts are now part of the post-incident framework. That changes the risk calculus for every operator using centralized exchanges as payment rails.