Major Exchange sues DPRK over $1.5B theft

TLDR

Bybit has filed a landmark US civil lawsuit against North Korea over a record $1.5 billion crypto theft tied to the Lazarus Group.

1. The case targets DPRK, its intelligence agency, and Lazarus for a 2025 hack that drained around 400,000 ETH and staked ETH from Bybit.
2. A US court has granted asset freezes and expedited discovery, testing how law, sanctions, and blockchain forensics can work together against state-backed crypto theft.
3. Most stolen funds are already laundered, so the key watchpoints are how much can still be recovered and how aggressively other venues tighten controls on DPRK-linked flows.

Deep Dive

1. Lawsuit And Record Hack

Bybit, the worlds second-largest exchange by volume, has sued the Democratic Peoples Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group in US federal court over a February 21, 2025 attack that stole over 400,000 ETH and staked ETH, valued at about $1.5 billion at the time and described as the largest recorded crypto theft. Multiple reports detail the filing and asset-freeze order, including a Bybit-focused summary and coverage from crypto.news.

The FBI had already attributed the hack to North Korean actors, and analytics firm Chainalysis estimates that this incident made up most of the $2.02 billion in crypto stolen by DPRK-linked groups in 2025, pushing total North Korean crypto thefts to roughly $6.75 billion. The lawsuit seeks return of assets plus around $1.5 billion in compensatory, punitive, and treble damages under US racketeering law.

2. Legal, Security, And Geopolitical Impact

A US judge has granted a preliminary injunction freezing identified stolen assets and approved expedited discovery so Bybit can demand wallet and account details from platforms with US operations, as described in court-focused coverage from Cointelegraph. This is a notable shift from merely attributing hacks to Lazarus to formally using courts to trace and lock funds.

For the industry, the case reinforces that major exchanges now rely on a mix of blockchain forensics, sanctions regimes, and civil litigation to respond to large thefts. It also underlines the limits of recovery: Bybit reports that over 90 percent of stolen assets have become untraceable after passing through mixers, bridges, and over-the-counter channels, with only a small fraction recovered or frozen so far.

3. Recovery Prospects And What To Watch

Bybit and law enforcement partners have already frozen tens of millions of dollars in stolen assets across dozens of exchanges and custodians, with dismantling of laundering channels such as the eXch exchange and Cryptomixer.io highlighted in the asset-recovery narrative. The civil case runs alongside ongoing criminal investigations.

Key next steps include:

1. How much additional value can be traced and frozen via discovery orders to cooperating exchanges.
2. Whether the court ultimately issues a large judgment against DPRK entities, even if collection is difficult.
3. How sanctions and compliance rules evolve around Lazarus-linked wallets, increasing pressure on exchanges that fail to block them.

Risk note: Because most stolen funds are already mixed and bridged, any further recovery is likely incremental rather than transformational.

Conclusion

Bybits lawsuit against North Korea turns a headline-grabbing $1.5 billion hack into a test case for using courts, sanctions, and forensic tracing against state-backed crypto crime. It will not fully reverse the theft, but it raises the accountability bar for attackers and increases compliance expectations for exchanges handling high-risk flows.