North Korea and Cyber Warfare (Lazarus Group and ByBit Hack – Lawsuit Filed)
Kanako Mita, Sawako Utsumi, and Lee Jay Walker
Modern Tokyo Times
North Korea’s alleged involvement in the $1.5 billion cryptocurrency theft from ByBit in early 2025 highlights the evolving relationship between cyber warfare, intelligence operations, international sanctions, and state financing. In August 2026, Bybit, one of the world’s largest cryptocurrency exchanges, filed a civil lawsuit in the United States against the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group. U.S. authorities have identified Lazarus as a DPRK-linked hacking organisation allegedly responsible for the February 2025 cyberattack. ByBit also secured a preliminary injunction to freeze identified stolen assets while legal proceedings continue.
The legal action represents more than an attempt to recover stolen digital assets. It reflects the growing international effort to challenge cybercrime networks that operate across national borders, financial systems, and jurisdictions. North Korea’s alleged use of cyber-enabled financial theft raises broader questions concerning the relationship between state security institutions, economic pressure, sanctions evasion, and the financing of military capabilities. However, attribution and responsibility must remain grounded in documented investigations and judicial proceedings rather than assumptions.
The Lazarus Group, also associated with names including Guardians of Peace and Whois Team, has gained international notoriety for sophisticated cyber operations. Last year, the 2025 ByBit attack involved the theft of approximately $1.5 billion in digital assets, making it one of the largest cryptocurrency heists ever recorded. Hence, this case illustrates how vulnerabilities in digital-asset infrastructure can have consequences extending beyond individual companies, affecting confidence in the wider international financial and technological ecosystem.
ByBit announced, “The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in ByBit’s ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime.”
The preliminary injunction provides a judicial mechanism for preserving identified assets, although its practical reach depends on the cooperation of relevant intermediaries and jurisdictions. However, the lawsuit does not automatically establish that every defendant has accepted the court’s authority, nor does it guarantee that the stolen funds will be recovered. North Korea’s response and the wider question of enforcing a U.S. court judgment against a sovereign state remain important legal and geopolitical considerations.
Following the theft, ByBit worked to restore liquidity and maintain customer withdrawals through emergency funding and reserve replenishment. CNBC reported that “The company secured nearly 447,000 ether tokens through emergency funding from firms such as Galaxy Digital, FalconX, and Wintermute.” The response underlines the importance of financial resilience when a major digital-asset exchange faces a systemic security crisis.
The FBI has warned that the stolen assets were being rapidly transferred across cryptocurrency networks. It stated: “TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains.”
The movement of funds demonstrates the international character of blockchain-based financial crime, where digital transactions can cross numerous platforms and jurisdictions in a short period. Tracking and freezing such assets therefore requires cooperation between law enforcement agencies, exchanges, blockchain intelligence firms, and financial institutions.
The theft targeted digital assets held through an Ethereum-related wallet infrastructure, with the attackers exploiting a compromise associated with Safe’s wallet-management environment. This incident demonstrates that cryptocurrency security depends not only on blockchain technology itself but also on the software, authentication systems, and human processes supporting digital-asset custody.
The historical record provides further context. In 2022, the Lazarus Group was linked to the theft of approximately $600 million from the Axie Infinity ecosystem, with only a portion of the stolen funds subsequently recovered. Such incidents highlight the difficulties of international asset recovery, particularly when stolen cryptocurrency is rapidly moved through multiple addresses and conversion channels.
INCC Group explains the distinctive relationship between state-linked cyber actors and North Korea’s financial operations: “State actors are cyber threat groups that operate in the interests of their state. They generally engage in espionage, stealing sensitive information to benefit their homeland politically or economically; Sometimes, they perform sabotage, as part of broader military operations, for reasons of national security or to political ends. They are rarely financially motivated, and this is where the North Korean threat group known as Lazarus differs from most other state actors: starting in 2009, it robs banks and hacks into cryptocurrency exchanges to fill its state coffers.”
This distinction is geopolitically significant. Cyber operations associated with North Korea have been linked by international authorities and analysts to efforts to generate revenue while circumventing sanctions. The alleged use of stolen cryptocurrency to support state priorities, including military development, raises concerns about the ability of international sanctions regimes to restrict financial resources in an increasingly digital global economy. Nevertheless, the precise allocation of stolen funds to particular government programmes requires evidence rather than assumption.
The BBC reports, “Cryptocurrencies, which have become popular with investors, have sparked division as many criticize their value for being based purely on speculation, allowing their value to be easily manipulated.” This observation adds an important economic dimension to the discussion. Cryptocurrency markets operate within a combination of technological innovation, investment speculation, regulatory uncertainty, and security risks. Major thefts can consequently damage confidence among investors and raise questions concerning the protection of digital assets.
Chainalysis describes North Korea’s cyber activities as “notorious for their sophisticated and relentless tradecraft, often employing advanced malware, social engineering, and cryptocurrency theft to fund state-sponsored operations and circumvent international sanctions.”
Such assessments place the ByBit incident within a wider pattern of alleged DPRK-linked cyber-enabled financial activity. The geopolitical implications extend beyond cryptocurrency exchanges, encompassing international security, financial governance, and the ability of states to respond collectively to cyber threats.
Ben Zhou, the co-founder and CEO of ByBit, stated, “The Lazarus attack wasn’t just an attack on Bybit. It was an attack on trust in our industry. That’s why we’ve worked closely with investigators, exchanges, regulators, law enforcement, and now the courts.”
The ByBit case demonstrates how cybercrime has become intertwined with international statecraft. North Korea’s alleged cyber-enabled financial operations, the role of intelligence-linked organisations, and the limitations of cross-border legal enforcement all reflect the changing nature of geopolitical competition. As digital finance continues to expand, protecting financial infrastructure will require greater international cooperation, improved cybersecurity, and sustained efforts to establish accountability for large-scale cybercrime.
The broader lesson is that cyber warfare cannot be separated from the economic and diplomatic realities of the modern international system. Thus the ByBit lawsuit is not merely a corporate dispute concerning stolen cryptocurrency. It represents another significant test of how governments, courts, and financial institutions respond when alleged state-linked cyber operations cross borders and threaten trust in the global digital economy.
https://moderntokyonews.com/category/info-and-technology/ Past articles on INFO AND TECHNOLOGY via MODERN TOKYO NEWS
MODERN TOKYO TIMES – MODERN TOKYO NEWS – please check https://moderntokyonews.com
Please check Modern Tokyo News at https://moderntokyonews.com for articles going back over 12 years. Sadly, Modern Tokyo Times got hacked and lost 14 years of articles…
Modern Tokyo News is part of the Modern Tokyo Times group
http://moderntokyotimes.com Modern Tokyo Times – International News and Japan News
http://sawakoart.com – Sawako Utsumi and Modern Tokyo Times artist
https://moderntokyonews.com Modern Tokyo News – Tokyo News and International News
PLEASE JOIN ON FACEBOOK
https://www.facebook.com/moderntokyotimes