Crypto exchange sues North Korea for $1.5B

TLDR

Crypto exchange Bybit has filed a major civil lawsuit against North Korea over a roughly $1.5 billion hack tied to the Lazarus Group.

1. Bybit is suing North Korea, its Reconnaissance General Bureau, and Lazarus Group in a U.S. court over a February 2025 theft of about $1.5 billion in crypto.
2. A federal judge has granted asset freezes and expedited discovery, helping Bybit trace and lock a small fraction of the stolen funds but leaving most of the $1.5 billion unrecovered.
3. The case tests whether courts, exchanges, and analytics firms can meaningfully claw back state?linked crypto thefts and may influence future industry security and legal strategies.

Deep Dive

1. What Happened In The $1.5B Hack And Lawsuit

Bybit alleges that on 21 February 2025, attackers linked to North Koreas Lazarus Group stole over 400,000 ETH during a cold?wallet transfer, exploiting compromised infrastructure at Safe{Wallet} to inject malicious code and drain funds in minutes, according to detailed reporting on the RICO lawsuit.

The FBI publicly attributed the theft to North Korea shortly after the incident, and Bybit later filed a sealed civil complaint in the U.S. District Court for the District of Columbia naming the Democratic Peoples Republic of Korea, its Reconnaissance General Bureau, Lazarus, and various unidentified intermediaries as defendants.

The suit seeks the return of the stolen assets and around $1.5 billion in damages under statutes including the Racketeer Influenced and Corrupt Organizations Act, arguing a pattern of organized cyber?theft by state?linked actors.

2. How Much Has Been Recovered Or Frozen So Far

Court filings and industry coverage indicate that Bybit has recovered roughly $48.4 million and frozen about $30.5 million across more than 28 exchanges and custodians, for a total of about $78.9 million, a small portion of the $1.5 billion loss.

A U.S. judge has granted a temporary restraining order, a preliminary injunction, and expedited discovery, allowing Bybit to demand account identities and balances from cooperating platforms and to block transfers of identified assets, as described in Cointelegraphs summary of the case.

Analysts estimate that over 90 percent of the stolen crypto has already been laundered through mixers, bridges, and over?the?counter channels, making full recovery highly unlikely and shifting the focus toward freezing residual funds and establishing accountability.

3. Why This Matters For Crypto And What To Watch

Bybits case is one of the clearest attempts to use U.S. civil courts to go after a sovereign state over a crypto hack, building on law?enforcement attribution and on?chain tracing to target both North Korea and its alleged laundering network.

For the broader market, the case highlights that security is not just a technical issue but also a legal one, where asset recovery depends on chokepoints such as exchanges, custodians, and protocols that can be compelled to freeze funds.

Next, watch for further court orders, any additional assets frozen or surrendered, and whether other exchanges adopt similar litigation strategies against state?linked groups. These outcomes could shape future incident response playbooks and regulatory expectations.

Confidence: high because multiple court records and independent news sources align on the hack, defendants, amounts, and legal steps.

Conclusion

Bybits $1.5 billion lawsuit against North Korea turns a record?setting hack into a test case for how far courts and cooperation can go in clawing back state?linked crypto theft.

Even if most funds are gone, the injunctions, tracing, and public attribution raise the legal and operational costs of such attacks and may push exchanges to invest more heavily in both security and formal recovery strategies.