{"investigation":{"slug":"bybit-v-dprk-lazarus-group-1-5b-hack-civil-lawsuit-august-2026","entity_name":"Bybit v. DPRK Lazarus Group -- $1.5B Hack Civil Lawsuit (August 2026)","trust_score":14,"severity_base":null,"score_modifier":-6,"confidence":0.88,"status":"published","content_type":"investigation","summary":"On August 7-8, 2026, cryptocurrency exchange Bybit announced that it had filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group over the February 21, 2025 theft of approximately $1.5 billion in Ethereum-denominated assets -- the largest recorded cryptocurrency theft in history. Alongside the lawsuit, the court granted a preliminary injunction freezing identified stolen assets held by unnamed intermediary defendants. This is the first known instance of a major cryptocurrency exchange filing civil suit against a nation-state actor for a crypto theft and securing a judicial asset freeze order at this scale.","sections":[{"content":"On February 21, 2025, Bybit -- then the world's second-largest cryptocurrency exchange by volume -- suffered a theft of approximately $1.5 billion in Ethereum and staked Ether (stETH) from a cold wallet during a routine transfer process. The incident surpassed the 2022 Ronin Bridge theft ($620 million) to become the single largest cryptocurrency theft on record. Forensic investigation by multiple blockchain analytics firms, including Elliptic, Chainalysis, TRM Labs, and independent investigator ZachXBT, attributed the attack within 72 hours to the Lazarus Group, a DPRK-linked threat actor. The root cause was identified as a supply-chain compromise of Safe{Wallet}, the multisig platform used by Bybit for cold wallet signing. Attackers -- alleged by investigators to be Lazarus Group -- compromised a Safe{Wallet} developer's macOS workstation in early February 2025 through a social engineering attack involving a malicious Docker project. They subsequently replaced legitimate JavaScript on app.safe.global with malicious code beginning February 19, 2025 at approximately 15:29 UTC. The payload selectively altered transactions involving Bybit's Ethereum multisig cold wallet while appearing normal to other users, activating during Bybit's next scheduled transaction on February 21, 2025 at approximately 14:13 UTC. The stolen funds were rapidly converted into Bitcoin and dispersed across thousands of blockchain addresses using mixing services and cross-chain protocols to obscure their trail.","heading":"Background: The February 2025 Hack","sources":[{"url":"https://www.ic3.gov/psa/2025/psa250226","name":"FBI/IC3 Public Service Announcement: North Korea Responsible for $1.5 Billion Bybit Hack","type":"regulatory","credibility":1},{"url":"https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit","name":"The Bybit Hack: Following North Korea's Largest Exploit -- TRM Labs","type":"research","credibility":2},{"url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html","name":"Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers -- The Hacker News","type":"news_article","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/lazarus-hacked-bybit-via-breached-safe-wallet-developer-machine/","name":"Lazarus Hacked Bybit via Breached Safe{Wallet} Developer Machine -- BleepingComputer","type":"news_article","credibility":2}],"severity":"critical"},{"content":"On February 26, 2025, the U.S. Federal Bureau of Investigation (FBI) publicly attributed the Bybit theft to TraderTraitor, also known as Lazarus Group, APT38, Jade Sleet, Slow Pisces, and UNC4899 -- a cluster of DPRK state-sponsored cyber actors. The FBI advisory listed 50 specific Ethereum wallet addresses identified as holding or having held stolen assets and called on exchanges, RPC node operators, and blockchain analytics firms to block associated transactions. Multiple private-sector firms -- Elliptic, Chainalysis, TRM Labs, and ZachXBT -- conducted independent blockchain forensic investigations and reached consistent attribution conclusions. The CSIS described the Bybit heist as part of a broader pattern of DPRK cryptocurrency theft used to fund state programs. North Korean-linked hackers stole approximately $2.02 billion in cryptocurrency across all incidents in 2025, with the Bybit hack comprising the dominant share, according to data from Chainalysis.","heading":"Government Attribution","sources":[{"url":"https://www.ic3.gov/psa/2025/psa250226","name":"FBI/IC3 Public Service Announcement: North Korea Responsible for $1.5 Billion Bybit Hack","type":"regulatory","credibility":1},{"url":"https://www.picussecurity.com/resource/blog/fbi-north-korean-lazarus-group-bybit-crypto-heist","name":"FBI Confirms North Korean Lazarus Group Behind $1.5 Billion Bybit Crypto Heist -- Picus Security","type":"news_article","credibility":2},{"url":"https://www.csis.org/analysis/bybit-heist-and-future-us-crypto-regulation","name":"The ByBit Heist and the Future of U.S. Crypto Regulation -- CSIS","type":"research","credibility":1},{"url":"https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html","name":"North Korea-Linked Hackers Steal $2.02 Billion in 2025 -- The Hacker News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Bybit filed a civil lawsuit under seal on June 18, 2026, in the U.S. District Court for the District of Columbia. The complaint was unsealed and publicly announced on August 7-8, 2026. Defendants named in the lawsuit are the Democratic People's Republic of Korea, the DPRK's Reconnaissance General Bureau intelligence agency, the Lazarus Group, and approximately 20 unnamed 'John Doe' defendants identified as exchanges, custodians, and intermediaries currently holding traceable portions of the stolen funds. The legal claims include three primary theories: (1) RICO (Racketeer Influenced and Corrupt Organizations Act), arguing that Lazarus Group's documented pattern of large-scale crypto thefts -- including the $620 million Ronin Bridge theft in 2022 and approximately $100 million Harmony hack in 2022, in addition to the Bybit theft -- constitutes 'organized, ongoing criminal conduct' meeting RICO's 'pattern of racketeering activity' standard; (2) the Computer Fraud and Abuse Act (CFAA), addressing the technical mechanics of the breach; and (3) the Alien Tort Statute, an 18th-century statute permitting civil claims in U.S. courts for violations of international law. Bybit seeks return of the stolen funds, approximately $1.5 billion in damages, and additional punitive damages. The Court found that Bybit 'demonstrated a likelihood of success on the merits' in granting the preliminary injunction.","heading":"The Civil Lawsuit: Filing and Claims","sources":[{"url":"https://www.prnewswire.com/news-releases/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-302846491.html","name":"Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction -- PR Newswire (Bybit official press release)","type":"official","credibility":1},{"url":"https://www.coindesk.com/policy/2026/08/07/bybit-sues-north-korea-and-lazarus-group-over-usd1-5-billion-hack-secures-asset-freeze","name":"Bybit Sues North Korea and Lazarus Group over $1.5 Billion Hack, Secures Asset Freeze -- CoinDesk","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/crypto-news/bybit-unleashes-rico-lawsuit-on-north-korea-over-1-5b-hack/","name":"Bybit Unleashes RICO Lawsuit on North Korea Over $1.5B Hack -- Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/09/bybit-sues-north-korea-over-1-5b-hack-freezes-assets/","name":"Bybit Sues North Korea Over $1.5B Hack, Secures Court-Ordered Asset Freeze -- CryptoTimes","type":"news_article","credibility":2}],"severity":"high"},{"content":"Suing a sovereign state in a U.S. federal court faces significant threshold obstacles. The Foreign Sovereign Immunities Act (FSIA) generally bars lawsuits against foreign governments in U.S. courts. Bybit's complaint argues around this default immunity using two of FSIA's narrow statutory exceptions: (1) the 'commercial activity' exception, arguing that cryptocurrency theft and laundering through U.S.-connected exchanges constitutes commercial activity with a direct effect in the United States; and (2) the 'expropriation' exception, arguing that assets traceable to U.S.-based exchanges were expropriated in violation of international law. The FSIA also contains a state-sponsored terrorism exception, which has been applied in prior cases involving Iran, Syria, and Libya in the District of Columbia. However, those precedents involved acts of physical violence or support for terrorism rather than cybercrime and theft, and whether the terrorism exception or expropriation exception will be sustained in a cyber-theft context remains legally untested as of August 2026. Because North Korea is not expected to appear or contest the proceedings, much of the litigation's practical effect depends on compliance by the named John Doe intermediaries -- exchanges, custodians, and over-the-counter brokers -- who hold traceable stolen assets and are subject to U.S. court jurisdiction. Legal commentary has noted that the suit's viability depends less on North Korea's participation than on how many exchanges and custodians comply with court orders.","heading":"Jurisdictional and Sovereign Immunity Challenges","sources":[{"url":"https://www.blockhead.co/2026/08/11/bybit-sues-north-korea-over-its-1-5-billion-hack-and-wins-an-asset-freeze/","name":"Bybit Sues North Korea Over Its $1.5 Billion Hack -- and Wins an Asset Freeze -- Blockhead","type":"news_article","credibility":2},{"url":"https://crypto.news/bybit-sues-north-korea-lazarus-group-crypto-hack-lawsuit/","name":"Bybit is Suing North Korea, and It Might Actually Work -- Crypto.news","type":"news_article","credibility":2},{"url":"https://www.cryptacount.com/en/news/bybit-lazarus-group-lawsuit-asset-freeze-2026/","name":"Bybit Sues DPRK and Lazarus Group: What Firms Must Know -- Cryptacount","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On June 19, 2026, the court granted Bybit a temporary restraining order (TRO) concurrent with the sealed complaint. On July 30, 2026, the court issued a partial preliminary injunction prohibiting the transfer, sale, or dissipation of identified stolen assets held by the John Doe defendants -- exchanges, custodians, and other intermediaries -- while litigation continues. The injunction does not require North Korea's participation and operates against traceable asset holders subject to U.S. jurisdiction. As of August 8, 2026, Bybit reported $48.4 million in funds recovered and $30.5 million frozen across more than 28 exchanges and custodians, totaling approximately $78.9 million, or approximately 5.26% of the $1.5 billion stolen. The injunction functions as a legal ceiling preventing further dissipation of identifiable assets but has not substantially accelerated the recovery pace: between the June 18 court filing (reporting $75.5 million recovered or frozen) and August 8, the total grew by approximately $3.4 million over 51 days -- a daily rate consistent with the pre-lawsuit recovery pace. Approximately 90% of the stolen funds are estimated, per Bybit's own court filings, to have been laundered beyond current traceability.","heading":"Preliminary Injunction and Asset Freeze","sources":[{"url":"https://www.prnewswire.com/news-releases/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-302846491.html","name":"Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction -- PR Newswire","type":"official","credibility":1},{"url":"https://cryip.co/bybit-recovery-barely-moved-after-suing-north-korea/","name":"Bybit's Own Filings Show Recovery Barely Moved in 7 Weeks After Suing North Korea","type":"news_article","credibility":2},{"url":"https://en.coin-turk.com/us-court-freezes-30-5-million-in-bybit-hack-case-as-asset-recovery-expands/","name":"US Court Freezes $30.5 Million in Bybit Hack Case as Asset Recovery Expands -- Coin-Turk","type":"news_article","credibility":2}],"severity":"high"},{"content":"In parallel with Bybit's civil action, international law enforcement agencies have targeted infrastructure used to launder funds from the Bybit hack. On April 30, 2025, Frankfurt's Public Prosecutor's Office and Germany's Federal Criminal Police Office (BKA) shut down the cryptocurrency mixer eXch, seizing server infrastructure, more than 8 terabytes of data, and approximately $38.2 million in cryptocurrency. Elliptic estimated that more than $200 million in Bybit stolen funds were laundered through eXch. German investigators estimated approximately $1.9 billion in total cryptocurrency had flowed through eXch since its 2014 launch. In November 2025, Swiss and German authorities conducted a coordinated operation against Cryptomixer.io, seizing servers in Zurich and confiscating approximately 25 million euros in Bitcoin. Cryptomixer.io had processed more than 1.3 billion euros in laundering activity since 2016 and was linked to laundering proceeds from the Bybit hack. These enforcement actions are distinct from Bybit's civil suit but operate in parallel with criminal investigations.","heading":"International Law Enforcement: Laundering Infrastructure Disrupted","sources":[{"url":"https://therecord.media/exch-cryptocurrency-mixer-germany-takedown","name":"German Operation Shuts Down Crypto Mixer eXch, Seizes Millions in Assets -- The Record (Recorded Future News)","type":"news_article","credibility":2},{"url":"https://yellow.com/news/swiss-german-authorities-dismantle-billion-euro-bitcoin-mixing-platform-cryptomixerio","name":"Swiss, German Authorities Dismantle Billion-Euro Bitcoin Mixing Platform Cryptomixer.io -- Yellow.com","type":"news_article","credibility":2},{"url":"https://www.dlnews.com/articles/regulation/german-police-shutter-crypto-mixer-tied-to-bybit-hack/","name":"German Police Shutter Crypto Anonymiser Tied to Bybit Hack and Seize $38m -- DL News","type":"news_article","credibility":2}],"severity":"high"},{"content":"Legal commentators have characterized this lawsuit as a landmark civil action for several reasons. First, it is the first known instance of a cryptocurrency exchange filing a civil lawsuit naming a sovereign nation-state as a defendant over a cryptocurrency theft and securing a judicial preliminary injunction. Prior civil suits against sovereign states under FSIA's terrorism exception have been documented in cases involving Iran, Syria, and Libya, but these involved acts of physical violence rather than cybercrime. Second, the lawsuit applies civil RICO -- a statute historically associated with domestic organized crime -- to a state-sponsored foreign hacking campaign, arguing Lazarus Group's documented pattern across multiple major thefts constitutes a RICO 'enterprise.' Third, the legal strategy, combining civil litigation with blockchain forensics against intermediary John Doe defendants who are subject to U.S. jurisdiction, has been described in legal commentary as 'a new recovery playbook' for large-scale crypto theft. The Bybit hack also constituted approximately 74% of all cryptocurrency stolen by DPRK-linked actors in 2025, underscoring its significance to discussions of state-level crypto sanctions enforcement. The outcome of the FSIA jurisdictional arguments -- expected to be litigated in 2026 and 2027 -- may determine whether the civil litigation pathway is viable for future crypto exchange victims of state-sponsored theft. As of August 2026, no default judgment or final ruling on the merits has been entered.","heading":"Legal Precedent and Industry Significance","sources":[{"url":"https://crypto.news/bybit-sues-north-korea-lazarus-group-crypto-hack-lawsuit/","name":"Bybit is Suing North Korea, and It Might Actually Work -- Crypto.news","type":"news_article","credibility":2},{"url":"https://fintechnews.ae/32810/crypto/bybit-us1-5-billion-lazarus-north-korea-lawsuit/","name":"Bybit Files US$1.5 Billion Lawsuit Against North Korea, Lazarus Group -- Fintech News Middle East","type":"news_article","credibility":2},{"url":"https://www.blockhead.co/2026/08/11/bybit-sues-north-korea-over-its-1-5-billion-hack-and-wins-an-asset-freeze/","name":"Bybit Sues North Korea Over Its $1.5 Billion Hack -- and Wins an Asset Freeze -- Blockhead","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html","name":"North Korea-Linked Hackers Steal $2.02 Billion in 2025 -- The Hacker News","type":"news_article","credibility":2}],"severity":"medium"},{"content":"As of August 2026, the practical recovery outlook from the civil lawsuit is limited. Approximately 90% of stolen funds have been laundered beyond current traceability, according to Bybit's own court filings. The total recovered and frozen ($78.9 million) represents approximately 5.26% of the $1.5 billion theft. At the recovery pace observed between June and August 2026 -- approximately $66,700 per day -- recovering the outstanding $1.42 billion would take an estimated 58 years at current velocity. The preliminary injunction provides legal authority to freeze additional assets as they become traceable, but the rate of new discoveries has been slow. Bybit CEO Ben Zhou stated the company's focus is on protecting users, recovering what it can, and establishing accountability. The company has stated it coordinated with the FBI, international law enforcement, other exchanges, and regulatory agencies throughout the recovery effort. The lawsuit and injunction represent legal instruments for potential future enforcement should additional assets become traceable or identifiable intermediaries become subject to U.S. jurisdiction, but they do not eliminate the fundamental challenge posed by the laundering of the large majority of stolen funds.","heading":"Recovery Outlook and Practical Constraints","sources":[{"url":"https://cryip.co/bybit-recovery-barely-moved-after-suing-north-korea/","name":"Bybit's Own Filings Show Recovery Barely Moved in 7 Weeks After Suing North Korea","type":"news_article","credibility":2},{"url":"https://www.prnewswire.com/news-releases/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-302846491.html","name":"Bybit Sues North Korea and Lazarus Group -- PR Newswire","type":"official","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2025-02-19","event":"Malicious JavaScript code replaces legitimate Safe{Wallet} app code at 15:29 UTC, targeting Bybit's Ethereum multisig cold wallet, per Verichains forensic analysis.","source":"Bybit Hack Traced to Safe{Wallet} Supply Chain Attack -- The Hacker News","source_url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html"},{"date":"2025-02-21","event":"Approximately $1.5 billion in Ethereum and stETH stolen from Bybit cold wallet at approximately 14:13 UTC during a routine transfer, in what becomes the largest recorded cryptocurrency theft in history.","source":"FBI/IC3 Public Service Announcement","source_url":"https://www.ic3.gov/psa/2025/psa250226"},{"date":"2025-02-26","event":"FBI issues public advisory (IC3 PSA250226) attributing the theft to TraderTraitor (Lazarus Group), listing 50 Ethereum wallet addresses and requesting assistance from exchanges and analytics firms to block transactions.","source":"FBI/IC3 PSA250226","source_url":"https://www.ic3.gov/psa/2025/psa250226"},{"date":"2025-04-30","event":"German federal authorities (BKA) and Frankfurt's Public Prosecutor's Office shut down cryptocurrency mixer eXch, seizing approximately $38.2 million and 8+ terabytes of data. Elliptic estimates more than $200 million in Bybit stolen funds were laundered through eXch.","source":"German Operation Shuts Down Crypto Mixer eXch -- The Record","source_url":"https://therecord.media/exch-cryptocurrency-mixer-germany-takedown"},{"date":"2025-11-28","event":"Swiss and German authorities dismantle Cryptomixer.io following coordinated actions in Zurich, seizing approximately 25 million euros in Bitcoin. Cryptomixer was linked to laundering proceeds from the Bybit hack.","source":"Swiss, German Authorities Dismantle Cryptomixer.io -- Yellow.com","source_url":"https://yellow.com/news/swiss-german-authorities-dismantle-billion-euro-bitcoin-mixing-platform-cryptomixerio"},{"date":"2026-06-18","event":"Bybit files civil lawsuit under seal in U.S. District Court for the District of Columbia naming DPRK, RGB, and Lazarus Group as defendants; court grants a temporary restraining order (TRO) the same day.","source":"Bybit Sues North Korea and Lazarus Group -- PR Newswire","source_url":"https://www.prnewswire.com/news-releases/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-302846491.html"},{"date":"2026-07-30","event":"U.S. District Court for the District of Columbia grants partial preliminary injunction prohibiting transfer or dissipation of identified stolen assets held by John Doe defendants; court finds Bybit 'demonstrated a likelihood of success on the merits.'","source":"Bybit Sues North Korea and Lazarus Group -- PR Newswire","source_url":"https://www.prnewswire.com/news-releases/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-302846491.html"},{"date":"2026-08-07","event":"Bybit publicly announces the civil lawsuit and preliminary injunction. Reports $48.4 million recovered and $30.5 million frozen across 28+ exchanges -- approximately 5.26% of stolen funds. Case described as a landmark first in crypto civil litigation against a nation-state.","source":"Bybit Sues North Korea and Lazarus Group over $1.5 Billion Hack, Secures Asset Freeze -- CoinDesk","source_url":"https://www.coindesk.com/policy/2026/08/07/bybit-sues-north-korea-and-lazarus-group-over-usd1-5-billion-hack-secures-asset-freeze"}],"sources_used":[{"url":"https://www.coindesk.com/policy/2026/08/07/bybit-sues-north-korea-and-lazarus-group-over-usd1-5-billion-hack-secures-asset-freeze","name":"Bybit Sues North Korea and Lazarus Group over $1.5 Billion Hack, Secures Asset Freeze -- CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260808033954/https://www.coindesk.com/policy/2026/08/07/bybit-sues-north-korea-and-lazarus-group-over-usd1-5-billion-hack-secures-asset-freeze","credibility":2,"archive_timestamp":"2026-08-08T03:39:54+00:00"},{"url":"https://www.prnewswire.com/news-releases/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-302846491.html","name":"Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction -- PR Newswire (Bybit official press release)","type":"official","archive_url":"http://web.archive.org/web/20260809101757/https://www.prnewswire.com/news-releases/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-302846491.html","credibility":1,"archive_timestamp":"2026-08-09T10:17:57+00:00"},{"url":"https://www.ic3.gov/psa/2025/psa250226","name":"FBI/IC3 PSA250226: North Korea Responsible for $1.5 Billion Bybit Hack","type":"regulatory","archive_url":"http://web.archive.org/web/20260812004132/https://www.ic3.gov/psa/2025/psa250226","credibility":1,"archive_timestamp":"2026-08-12T00:41:32+00:00"},{"url":"https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit","name":"The Bybit Hack: Following North Korea's Largest Exploit -- TRM Labs","type":"research","archive_url":"http://web.archive.org/web/20260509172534/https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit","credibility":2,"archive_timestamp":"2026-05-09T17:25:34+00:00"},{"url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html","name":"Bybit Hack Traced to Safe{Wallet} Supply Chain Attack -- The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260806103431/https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html","credibility":2,"archive_timestamp":"2026-08-06T10:34:31+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/lazarus-hacked-bybit-via-breached-safe-wallet-developer-machine/","name":"Lazarus Hacked Bybit via Breached Safe{Wallet} Developer Machine -- BleepingComputer","type":"news_article","archive_url":"http://web.archive.org/web/20260712011209/https://www.bleepingcomputer.com/news/security/lazarus-hacked-bybit-via-breached-safe-wallet-developer-machine/","credibility":2,"archive_timestamp":"2026-07-12T01:12:09+00:00"},{"url":"https://www.picussecurity.com/resource/blog/fbi-north-korean-lazarus-group-bybit-crypto-heist","name":"FBI Confirms North Korean Lazarus Group Behind $1.5 Billion Bybit Crypto Heist -- Picus Security","type":"news_article","archive_url":"http://web.archive.org/web/20260419192006/https://www.picussecurity.com/resource/blog/fbi-north-korean-lazarus-group-bybit-crypto-heist","credibility":2,"archive_timestamp":"2026-04-19T19:20:06+00:00"},{"url":"https://www.csis.org/analysis/bybit-heist-and-future-us-crypto-regulation","name":"The ByBit Heist and the Future of U.S. Crypto Regulation -- CSIS","type":"research","archive_url":"http://web.archive.org/web/20260729222534/https://www.csis.org/analysis/bybit-heist-and-future-us-crypto-regulation","credibility":1,"archive_timestamp":"2026-07-29T22:25:34+00:00"},{"url":"https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html","name":"North Korea-Linked Hackers Steal $2.02 Billion in 2025 -- The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260508232125/https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html","credibility":2,"archive_timestamp":"2026-05-08T23:21:25+00:00"},{"url":"https://news.bitcoin.com/crypto-news/bybit-unleashes-rico-lawsuit-on-north-korea-over-1-5b-hack/","name":"Bybit Unleashes RICO Lawsuit on North Korea Over $1.5B Hack -- Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260809045345/https://news.bitcoin.com/crypto-news/bybit-unleashes-rico-lawsuit-on-north-korea-over-1-5b-hack/","credibility":2,"archive_timestamp":"2026-08-09T04:53:45+00:00"},{"url":"https://www.cryptotimes.io/2026/08/09/bybit-sues-north-korea-over-1-5b-hack-freezes-assets/","name":"Bybit Sues North Korea Over $1.5B Hack, Secures Court-Ordered Asset Freeze -- CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260810062423/https://www.cryptotimes.io/2026/08/09/bybit-sues-north-korea-over-1-5b-hack-freezes-assets/","credibility":2,"archive_timestamp":"2026-08-10T06:24:23+00:00"},{"url":"https://www.blockhead.co/2026/08/11/bybit-sues-north-korea-over-its-1-5-billion-hack-and-wins-an-asset-freeze/","name":"Bybit Sues North Korea Over Its $1.5 Billion Hack -- and Wins an Asset Freeze -- Blockhead","type":"news_article","archive_url":"https://web.archive.org/web/20260825025515/https://www.blockhead.co/2026/08/11/bybit-sues-north-korea-over-its-1-5-billion-hack-and-wins-an-asset-freeze/","credibility":2,"archive_timestamp":"2026-08-25T02:55:15+00:00"},{"url":"https://crypto.news/bybit-sues-north-korea-lazarus-group-crypto-hack-lawsuit/","name":"Bybit is Suing North Korea, and It Might Actually Work -- Crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260810204331/https://crypto.news/bybit-sues-north-korea-lazarus-group-crypto-hack-lawsuit/","credibility":2,"archive_timestamp":"2026-08-10T20:43:31+00:00"},{"url":"https://cryip.co/bybit-recovery-barely-moved-after-suing-north-korea/","name":"Bybit's Own Filings Show Recovery Barely Moved in 7 Weeks After Suing North Korea","type":"news_article","archive_url":"http://web.archive.org/web/20260812073339/https://cryip.co/bybit-recovery-barely-moved-after-suing-north-korea/","credibility":2,"archive_timestamp":"2026-08-12T07:33:39+00:00"},{"url":"https://therecord.media/exch-cryptocurrency-mixer-germany-takedown","name":"German Operation Shuts Down Crypto Mixer eXch, Seizes Millions in Assets -- The Record (Recorded Future News)","type":"news_article","archive_url":"http://web.archive.org/web/20260314234254/https://therecord.media/exch-cryptocurrency-mixer-germany-takedown","credibility":2,"archive_timestamp":"2026-03-14T23:42:54+00:00"},{"url":"https://www.dlnews.com/articles/regulation/german-police-shutter-crypto-mixer-tied-to-bybit-hack/","name":"German Police Shutter Crypto Anonymiser Tied to Bybit Hack and Seize $38m -- DL News","type":"news_article","archive_url":"http://web.archive.org/web/20260701175015/https://www.dlnews.com/articles/regulation/german-police-shutter-crypto-mixer-tied-to-bybit-hack/","credibility":2,"archive_timestamp":"2026-07-01T17:50:15+00:00"},{"url":"https://yellow.com/news/swiss-german-authorities-dismantle-billion-euro-bitcoin-mixing-platform-cryptomixerio","name":"Swiss, German Authorities Dismantle Billion-Euro Bitcoin Mixing Platform Cryptomixer.io -- Yellow.com","type":"news_article","archive_url":"https://web.archive.org/web/20260825051012/https://yellow.com/news/swiss-german-authorities-dismantle-billion-euro-bitcoin-mixing-platform-cryptomixerio","credibility":2,"archive_timestamp":"2026-08-25T05:10:12+00:00"},{"url":"https://en.coin-turk.com/us-court-freezes-30-5-million-in-bybit-hack-case-as-asset-recovery-expands/","name":"US Court Freezes $30.5 Million in Bybit Hack Case as Asset Recovery Expands -- Coin-Turk","type":"news_article","archive_url":"https://web.archive.org/web/20260825003941/https://en.coin-turk.com/us-court-freezes-30-5-million-in-bybit-hack-case-as-asset-recovery-expands/","credibility":2,"archive_timestamp":"2026-08-25T00:39:41+00:00"},{"url":"https://fintechnews.ae/32810/crypto/bybit-us1-5-billion-lazarus-north-korea-lawsuit/","name":"Bybit Files US$1.5 Billion Lawsuit Against North Korea, Lazarus Group -- Fintech News Middle East","type":"news_article","archive_url":"http://web.archive.org/web/20260825004137/https://fintechnews.ae/32810/crypto/bybit-us1-5-billion-lazarus-north-korea-lawsuit/","credibility":2,"archive_timestamp":"2026-08-25T00:41:37+00:00"},{"url":"https://www.crowdfundinsider.com/2026/08/295948-bybit-sues-north-korea-lazarus-group-over-2025-crypto-heist/","name":"Bybit Sues North Korea, Lazarus Group Over 2025 Crypto Heist -- Crowdfund Insider","type":"news_article","archive_url":"https://web.archive.org/web/20260825025738/https://www.crowdfundinsider.com/2026/08/295948-bybit-sues-north-korea-lazarus-group-over-2025-crypto-heist/","credibility":2,"archive_timestamp":"2026-08-25T02:57:38+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-08-24T23:12:41.266499+00:00","updated_at":"2026-08-25T05:10:28.273857+00:00"}}