Bybit Secures US Asset Freeze in $1.5B Lazarus Hack Lawsuit

Bybit secured a preliminary injunction in a U.S. court that freezes certain identified assets linked to the $1.46–1.5 billion Lazarus hack, according to a report published around Aug. 8, 2026 by CryptoSlate.

The order blocks movements of assets identified in the case. The report does not disclose the amount covered by the injunction.

The action follows the FBI’s Feb. 26, 2025 Public Service Announcement that attributed the Bybit theft to North Korea-linked actors tracked as TraderTraitor or Lazarus Group, and listed Ethereum addresses for industry-wide blocking (FBI). Bybit also launched a recovery initiative, LazarusBounty, in response to the Feb. 21, 2025 incident (Bybit).

U.S. asset-freeze order: confirmed details

• A U.S. court granted Bybit a preliminary injunction that freezes specified assets tied to the alleged Lazarus operation. CryptoSlate reported the order was entered around Aug. 8, 2026, and did not state a protected dollar value.

• The FBI’s Feb. 26, 2025 PSA publicly attributed the approximately $1.5 billion Bybit theft to North Korea-linked actors and circulated Ethereum addresses for blocking by private-sector entities (FBI).

• Bybit detailed its LazarusBounty recovery program following the Feb. 21, 2025 hack, outlining incentives and early freeze and recovery steps (Bybit).

Immediate impact on exchanges, compliance teams, and users

This order is a legal freeze, not a recovery of funds. It appears to give Bybit a stronger footing to prevent dissipation of assets that the case has already identified, which could aid later claims or clawbacks.

Exchanges and service providers that touch U.S. jurisdiction may face added pressure to screen for the addresses and assets cited in court filings and in the FBI’s PSA. That could reduce mobility of the flagged funds and raise the cost of laundering attempts, although determined actors may still pivot to less regulated venues.

For users, the step signals that parts of the stolen flow can be slowed or immobilized within the U.S. legal system. It does not resolve the broader exposure created by cross-chain swaps, mixers, or overseas infrastructure.

What happens next

Watch for additional court filings that could expand the identified asset set or convert the preliminary relief into a longer-standing order. Any public updates from Bybit’s LazarusBounty program on freezes or recoveries would be notable (Bybit).

Industry participants should also monitor whether more addresses connected to the Feb. 2025 theft surface through law enforcement advisories. Further coordination around the FBI-circulated identifiers could determine how much of the stolen value remains effectively immobilized (FBI).

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.