Bybit Sues North Korea and Lazarus Group Over $1.5 Billion Hack, Wins Federal Asset Freeze

What Happened

Bybit, one of the world's largest crypto exchanges, has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group, the state-linked hacking unit U.S. authorities have repeatedly tied to North Korea's cyber operations. The suit was filed under seal on June 18 and only became public this week. It targets the February 2025 theft of roughly $1.5 billion from Bybit - still the largest single cryptocurrency heist on record.

Rather than a routine breach-of-contract claim, Bybit built its case around the Racketeer Influenced and Corrupt Organizations Act, the law originally designed to dismantle organized crime syndicates, and layered on claims under the Computer Fraud and Abuse Act and the Alien Tort Statute. The exchange is seeking the return of the stolen assets, roughly $1.5 billion in damages, and additional punitive damages on top of that - a scope well beyond simply reporting the theft.

What stands out most is how quickly Bybit backed the filing with results. The exchange secured a preliminary injunction - issued against unidentified "John Doe" defendants believed to be holding or moving the stolen funds - that bars any transfer or dissipation of the identified stolen assets while the case proceeds. In granting it, the court found that "Bybit has demonstrated a likelihood of success on the merits," an early-stage finding that tends to favor the plaintiff going forward.

Why This Matters for Markets - Tracing Meets Legal Pressure

This case is drawing attention well beyond the crypto-security niche for three interlocking reasons.

• Discovery power changes the recovery math. Alongside the injunction, the court granted Bybit discovery authority - a legal tool to formally identify the intermediaries who moved the stolen funds through the crypto ecosystem. Actually enforcing a judgment against the North Korean state is close to impossible, but tracing on-chain fund flows to recover even a fraction of what remains traceable is a realistic path this ruling opens up.
• It's a rare, high-profile civil case against a state-sponsored hacking group. Until now, the response to North Korea-linked hacking has mostly come in the form of U.S. Treasury sanctions, criminal indictments, or FBI advisories. An exchange stepping forward as plaintiff and invoking RICO against a nation-state's hacking apparatus sets a template other exchanges and protocols hit by large-scale theft may look to follow.
• It feeds directly into the industry's ongoing security-and-trust narrative. The February 2025 Bybit breach reportedly occurred during a routine transfer of funds from cold storage to a hot wallet, and it dealt a serious blow to confidence in exchange custody infrastructure at the time. News that a court has already found Bybit likely to prevail sends a signal to the rest of the industry that legal recourse - even if only partial - is a realistic outcome after a catastrophic hack, not just a symbolic gesture.

Some context helps explain why this case carries extra weight. The Lazarus Group has been named repeatedly by the U.S. Treasury and FBI as an arm of North Korea's Reconnaissance General Bureau, with a track record stretching back to the 2014 Sony Pictures hack and the 2016 theft of $81 million from the Bangladesh central bank via the SWIFT system. In recent years its focus has shifted heavily toward crypto exchanges and DeFi protocols, which offer a faster, less-regulated path to converting stolen value into usable funds. United Nations Security Council panel reports have repeatedly alleged that North Korea funnels a significant share of proceeds from these hacks into its nuclear and missile programs, which is part of why this lawsuit carries geopolitical as well as financial stakes.

Tracing the money itself is far from simple. Lazarus-linked actors typically fragment stolen crypto across hundreds of wallet addresses and cycle it through mixers and cross-chain bridges to obscure its origin before any conversion to cash. Even with cooperation from on-chain analytics firms, effective asset freezes generally depend on catching funds at the point they attempt to exit into fiat currency or liquid, seizable assets - which is why this injunction is explicitly limited to "identified" stolen assets. Funds that have already been laundered past that point are likely beyond this order's reach for now.

What to Take Away From This

• What you hold on an exchange is not the same as what you hold yourself. When a hack of this scale hits an exchange, the safety of funds held there depends entirely on that exchange's cold-storage practices and its capacity - and willingness - to make users whole. This case is a reminder of why self-custody via hardware wallets keeps coming up as standard advice for anyone holding meaningful crypto balances.
• Blockchain transparency is a double-edged sword. On-chain transactions are permanently and publicly recorded, which in theory makes fund flows traceable indefinitely. In practice, mixers and cross-chain bridges routinely break that traceability well before recovery becomes possible. Neither "it's all on-chain, so it's safe" nor "it's all on-chain, so it's exposed" is the full picture - both cut in different directions depending on the stage of the trail.
• Exchange risk is a distinct risk from price risk. Independent of whatever a coin's price is doing, the possibility that a specific exchange gets hacked or becomes insolvent never fully goes away. Spreading holdings across exchanges - or moving meaningful balances off exchanges entirely - is a basic way to manage that counterparty exposure, as distinct from managing market volatility.
• Legal precedent-setting matters for the industry's long-run credibility. A court finding early-stage merit in Bybit's case is a signal that crypto is building out the kind of accountability infrastructure long taken for granted in traditional finance. That institutional maturation is one of the factors large asset managers weigh when deciding how much capital to allocate to the space, alongside more visible metrics like ETF inflows.

For related coverage, see our pieces on Bitcoin stalling below $65,000 resistance and Bitcoin's best ETF inflow week since April.

Sources

This article synthesizes and analyzes the reporting below in our own words - it is not a reproduction of the original text. For the latest developments in this ongoing litigation, please consult the original sources directly.

• Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze - CoinDesk
• Bybit Wins Court Support to Trace $1.5B North Korea Hack Funds - Cointelegraph

⚠️ This article is for informational purposes only and is not investment advice. Crypto markets are highly volatile and this litigation is ongoing - always verify the latest information yourself before making any investment decision.