North Korea faces suit over $1.5B hack

TLDR

Crypto exchange Bybit has sued North Korea and its Lazarus Group over a $1.5 billion hack, securing a US court order freezing some of the stolen crypto assets.

1. Bybit filed a civil case in Washington, D.C., over the February 2025 theft of more than 400,000 ETH and staked ETH, the largest recorded crypto hack.
2. A US federal judge granted expedited discovery and preliminary injunctions, letting Bybit trace funds via US venues and freeze a slice of the stolen assets.
3. The suit tests how courts, regulators and forensic tools can curb state-backed crypto theft, with limited recovery so far and rising pressure on exchange security.

Deep Dive

1. The Hack And Lawsuit

Bybit, one of the largest crypto exchanges, is suing the Democratic Peoples Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group over a February 21, 2025 attack that stole about $1.5 billion in Ethereum assets, over 400,000 ETH and stETH, from the exchange, making it the biggest crypto theft on record. The FBI previously attributed the hack to North Korean actors, tracked as TraderTraitor, and tied it to a broader campaign of state-linked cybercrime targeting wallets and infrastructure. Bybits civil complaint in the US District Court for the District of Columbia seeks the return of stolen assets plus compensatory, punitive and treble damages under the Racketeer Influenced and Corrupt Organizations Act, according to court reporting and Bybits announcement.

2. Court Orders And Asset Recovery

US court records show that a federal judge granted expedited discovery and issued a temporary restraining order, later renewed and partially converted to a preliminary injunction, allowing Bybit to demand account identities, balances and transaction histories from exchanges with US operations and to block movement of identified stolen funds while the case proceeds. As of the filing, about 90.2 percent of the stolen assets had already gone dark through mixers, cross chain bridges and over the counter dealers, with only 9.8 percent still traceable and roughly 5.3 percent, around $75.5 million, frozen or recovered.

3. Broader Impact On Crypto And State Cybercrime

Chainalysis data cited in coverage indicates North Korean groups stole roughly $2.02 billion in crypto in 2025, with the Bybit incident comprising most of it and pushing estimated cumulative DPRK crypto theft above $6.7 billion. Bybits move from public attribution to formal litigation, combined with cooperation with agencies like the FBI and actions against laundering venues such as mixers and shady exchanges, marks a stronger institutional response to state backed crypto hacking. For exchanges and users, this reinforces two trends: rising geopolitical risk around crypto infrastructure and growing reliance on courts, sanctions and asset freezes, not just on chain analytics, to manage that risk.

Confidence: high because multiple independent news, court and industry sources report consistent facts on the hack, lawsuit and recovery progress.

Conclusion

Bybits lawsuit against North Korea and Lazarus turns a record breaking $1.5 billion hack into a test case for using civil courts, asset freezes and forensic discovery against state backed crypto theft. It improves accountability at the margins and may deter some intermediaries, but with most funds already laundered, it also underscores that stronger exchange security and faster incident response remain the primary defenses for crypto users.