Bybit filed a civil racketeering lawsuit against North Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group on August 7, and secured a preliminary injunction the same day freezing identified assets tied to the February 2025 theft of roughly $1.5 billion from the exchange.
The suit, filed in the US District Court for the District of Columbia, names the DPRK and its state hacking apparatus as defendants alongside a group of unidentified "John Doe" holders — the exchanges, custodians, and intermediaries currently sitting on traceable portions of the stolen funds. That structure is deliberate: the freeze doesn't depend on North Korea appearing in court or acknowledging the case at all. It operates directly against the specific wallets and accounts investigators have linked on-chain to the theft, regardless of who controls them today. CEO Ben Zhou called the attack "an attack on trust in our industry" and said the exchange had exhausted cooperative channels with investigators, other exchanges, and regulators before turning to the courts.
The numbers underline how much of the theft has already gone dark. According to Bybit's own June 18 court filing, roughly 90% of the stolen assets have vanished from traceable networks, laundered through mixing protocols, cross-chain transfers, and private over-the-counter trades. Of the remaining 10%, Bybit has recovered $48.4 million and frozen another $30.5 million across more than 28 exchanges and custodians — together representing roughly 5% of what was taken. The exchange's cooperation with investigators has also fed enforcement elsewhere: Bybit said its work helped German authorities shut down the exchange eXch and a joint German-Swiss operation take down the crypto mixer Cryptomixer.io.
Suing a country most companies would treat as unreachable isn't as futile as it sounds under US law. The Foreign Sovereign Immunities Act carries a well-established exception for state-sponsored terrorism, with decades of precedent from cases against Iran, Syria, and Libya providing a framework for pursuing sovereign defendants who never appear in court. The practical value isn't a settlement check from Pyongyang — it's the legal instrument the order creates. Exchanges that refuse to freeze assets covered by a federal court order now face legal exposure of their own, giving Bybit far more standing than voluntary cooperation requests ever provided.
Blockhead covered the theft as it happened, reporting in February 2025 that Bybit had suffered the largest crypto heist on record after attackers manipulated a signing interface during a routine cold-to-warm wallet transfer, showing approvers a legitimate destination address while altering the wallet's underlying transaction logic. Eighteen months on, this lawsuit represents the shift from crisis response to a legal campaign for the specific assets still sitting in reachable wallets. Whether civil law can accomplish what criminal enforcement alone hasn't is now a live test — and the answer depends less on North Korea than on how many exchanges and custodians actually comply when Bybit's lawyers come calling with a court order in hand.
