Crypto exchange sues North Korea hackers

TLDR

Crypto exchange Bybit has sued North Korea and its Lazarus Group in US federal court over a $1.5 billion hack, securing an order that freezes part of the stolen crypto.

1. Bybit filed a civil lawsuit in Washington, D.C., alleging DPRK-linked hackers stole roughly $1.5 billion in Ether and staked Ether from the exchange in February 2025.
2. A judge granted a preliminary injunction freezing identified stolen assets, with about $48 million recovered and $30 million frozen so far, testing a new path for exchange-level asset recovery.
3. The case will hinge on how US courts handle a sovereign defendant and whether any judgment can be enforced, while North Korean crypto hacking and AI-driven attacks remain a major industry risk.

Deep Dive

1. Lawsuit And Hack Details

Bybit has filed a civil lawsuit in the US District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group, alleging they stole around $1.5 billion in Ether and staked Ether in a February 2025 breach, described as the largest crypto hack on record civil lawsuit.

US authorities, including the FBI, have attributed the attack to North Korean actors under the TraderTraitor designation, and court filings say roughly 500,000 ETH was drained from a Bybit cold wallet after attackers manipulated a signing interface so approvers saw a legitimate address while the underlying logic sent funds elsewhere preliminary injunction.

The suit names not only North Korean entities but also unidentified holders of the stolen crypto as John Doe defendants, aiming to pull anyone currently custodying tainted funds into the case.

2. Impact On Exchanges And Users

A US federal judge has issued a preliminary injunction that freezes identified stolen assets, blocking their transfer or sale while the case proceeds and signaling that the court views Bybit as likely to succeed on the merits court order freezing assets.

Bybit reports roughly $48.4 million recovered and about $30.5 million frozen across more than 28 exchanges and custodians, only about 5 percent of the total loss but still meaningful in showing that cross-venue tracing and legal action can reclaim some value asset recovery progress.

Broader context is severe: research firms estimate North Korean actors stole around $2 billion in crypto in 2025 and account for a majority of hacking losses, with some groups now integrating local AI systems to automate phishing and malware targeting digital asset firms North Korea hacking trend.

3. What To Watch Next

Legally, key milestones will be whether North Korea and associated entities respond to the complaint, whether Bybit can secure a default judgment if they do not, and how any judgment is enforced against assets within US reach lawsuit context.

Practically, watch for updates on additional frozen or seized funds as international regulators and exchanges cooperate, plus any precedent the court sets around treating state-sponsored crypto theft under terrorism-related exceptions in US law.

Policy pressure is also building: former US Defense Secretary Mark Esper has urged Congress to pass the CLARITY Act partly to tighten tools against North Korean crypto activity, underscoring that cases like Bybits are now framed as national security as well as financial disputes CLARITY Act debate.

Conclusion

Bybits lawsuit against North Korea moves a massive state-linked crypto hack from pure incident response into formal litigation, backed by a court order freezing some stolen assets. For crypto users and exchanges, the case is an early test of whether civil courts plus cross-border cooperation can meaningfully claw back funds from sophisticated, sovereign-backed hackers. The outcome will shape expectations for future hack responses and inform how regulators and platforms strengthen defenses against increasingly AI-boosted attacks.