Major exchange sues North Korea over hack

TLDR

Bybit has filed a U.S. lawsuit against North Korea and its Lazarus Group over a roughly $1.5 billion crypto hack, and secured a court order to freeze some of the stolen funds.

1. Bybit is suing North Korea, its Reconnaissance General Bureau, and Lazarus Group in U.S. federal court over a 2025 exploit that drained more than 400,000 ETH.
2. A U.S. judge has granted a preliminary injunction freezing identified assets, but only a small share of the stolen crypto has been recovered so far.
3. The case could shape future responses to state linked crypto hacks, with implications for exchanges, mixers, and how irreversible stolen crypto really is.

Deep Dive

1. What Bybit Is Alleging

Bybit, a major crypto exchange, has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic Peoples Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group over a record sized 1.5 billion dollar hack.

The hack on 21 February 2025 reportedly involved compromising a Safe{Wallet} developers machine, inserting tailored malware that activated only when Bybits address appeared, and draining more than 400,000 ETH within minutes. The complaint invokes U.S. racketeering and cybercrime statutes, arguing a pattern of organized theft by state backed actors.

Bybit filed the suit under seal in June 2026; it became public in August 2026 after the court issued a temporary restraining order and then a preliminary injunction, formally recognizing that Bybit has a plausible case on the merits.

2. How Much Has Been Recovered

Reports indicate Bybit has recovered about 48.4 million dollars and frozen another 30.5 million dollars across more than 28 platforms, following on chain tracing and cooperation from exchanges and custodians, as highlighted in court focused coverage.

Even after these efforts, that recovery represents only a small slice of the total. Analysis suggests roughly 5 to 6 percent of the stolen funds are frozen or clawed back, with the rest laundered through bridges, mixers, and unregulated venues, underscoring how dependent recovery is on assets touching controllable chokepoints like centralized exchanges or token issuers.

A separate breakdown of the case notes that the injunction landed more than 17 months after the hack, and that most of the 1.46 billion dollars was likely laundered within 45 days, illustrating how legal timelines often lag rapid crypto movements and why most stolen coins remain effectively irreversible.

3. Why This Case Matters For Crypto

The lawsuit pushes beyond public attribution and sanctions into direct civil action against a nation state, which could become a template for how exchanges respond when state linked groups steal crypto at scale.

If courts continue to back tracing and freezes, centralized platforms, custodians, and even stablecoin issuers will be under growing pressure to cooperate quickly whenever funds are linked to sanctioned actors, tightening compliance expectations across the industry.

At the same time, the case highlights a split between assets that can be frozen and those in self custody or privacy tools, which are much harder to reach, so more enforcement attention may shift toward regulating mixers, bridges, and high risk venues that serve as laundering infrastructure.

Conclusion

Bybits lawsuit against North Korea and Lazarus Group shows that exchanges are increasingly turning to courts and global enforcement partnerships to fight state sponsored crypto theft.

For crypto users and platforms, the big takeaway is that while some stolen funds can be frozen once they hit regulated chokepoints, most of the damage happens in the first days after a breach, making security, monitoring, and rapid coordination more critical than any later legal victory.