Major Exchange sues North Korea over $1.5B

TLDR

Bybit has sued North Korea and the Lazarus Group to recover around $1.5 billion stolen in a 2025 hack of its exchange.

1. Bybits lawsuit in a U.S. court targets North Korea and Lazarus over the $1.5 billion TraderTraitor hack and has already led to asset-freeze orders.
2. The case shows exchanges are moving from quietly absorbing hacks to using aggressive legal tools against state-backed crypto theft, even though only a small fraction is recoverable.
3. Next, watchers will focus on further court rulings, how much more can be traced or frozen, and whether this feeds into tougher global rules on illicit crypto flows.

Deep Dive

1. What Bybit Is Suing For

Bybit, a major crypto exchange, filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic Peoples Republic of Korea and its Lazarus Group hackers over a February 2025 breach that stole roughly $1.5 billion in crypto, attributed by the FBI to the TraderTraitor operation. The court granted expedited discovery and issued a temporary restraining order, later upgraded to a partial preliminary injunction that freezes identified assets while the case proceeds, turning the hack into one of the largest formal crypto asset-recovery efforts to date, as described in Bybits own account of the case and a detailed legal summary of the Bybit lawsuit and court orders.

Bybit reports about $48.4 million recovered and over $30.5 million frozen across more than 28 exchanges and custodians, roughly $78.9 million in total, while around 90.2% of the stolen funds are now untraceable due to laundering.

2. Why This Matters For Crypto

The lawsuit, framed by Bybit as a landmark recovery effort in a court case against North Korea and Lazarus, pushes state-linked hacking from on-chain attribution into formal litigation, which is rare in crypto. That matters because North Korean actors are responsible for a majority share of recent hack losses, with Lazarus-linked crews accounting for roughly half or more of incidents in 20252026, according to analysis of where stolen crypto goes and how it is laundered.

Even so, recovery remains hard. The laundering cycle typically disperses funds across mixers, bridges and lightly regulated venues within about 45 days, after which only a small fraction can be frozen or clawed back.

3. What To Watch Next

Legally, the key milestones will be how long the preliminary injunction stays in force, whether courts ultimately award damages under U.S. racketeering and related claims, and whether more frozen assets can be identified and attached. Policy-wise, this case feeds into pressure for measures like the CLARITY Act and broader sanctions tools that specifically target state-backed crypto laundering networks.

For market participants, the practical signals are whether other exchanges copy Bybits playbook, how quickly tainted funds are flagged and blocked, and whether new compliance norms emerge around addresses linked to state actors.

Conclusion

Bybits $1.5 billion lawsuit against North Korea and Lazarus turns a record-setting hack into a test case for how far courts and exchanges can go to fight state-backed crypto theft. It highlights both growing enforcement muscle and the harsh reality that most laundered assets are never recovered, making security practices and venue choice central to any long-term crypto strategy.