source_3904.pdf (2 MB)

Bybit alleges that Lazarus Group, acting for North Korea’s Reconnaissance General Bureau, stole approximately $1.5 billion in Ethereum-based assets on February 21, 2025. The attackers reportedly compromised a Safe{Wallet} developer, accessed its AWS-hosted infrastructure, and served malicious JavaScript that deceived Bybit signers into approving a backdoored smart-contract upgrade. The complaint says the proceeds were dispersed through mixers, exchanges, cross-chain bridges, and thousands of blockchain addresses, with only about $75.5 million frozen or recovered by the June 18, 2026 filing. Bybit seeks damages, identification of the asset controllers, and court orders freezing and returning traceable proceeds.