Bybit sues North Korea over $1.5B hack, wins asset freeze

Crypto exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group hacking group — plus unidentified defendants whose wallets received the stolen funds. The suit, filed in the U.S. District Court for the District of Columbia under the RICO anti-racketeering statute, CoinDesk reports, concerns the February 2025 hack of Bybit's cold wallet, in which attackers drained roughly $1.5 billion in ether and related tokens — one of the largest exchange hacks in history.

The suit was filed under seal on June 18, 2026; the court issued a temporary restraining order and granted expedited discovery the following day, then partially granted a preliminary injunction on July 30 that froze the traceable portion of the stolen assets. Since North Korea itself can't be served as a conventional defendant, the freeze in practice targets wallets and accounts at exchanges and custodians where traces of the stolen funds turned up — more than 28 platforms in total.

“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable.”

— Ben Zhou, Co-founder and CEO, Bybit

According to the exchange, $48.4 million has been recovered so far and another $30.5 million frozen — roughly 5.3% of the $1.5 billion stolen. Bybit acknowledges that around 90% of the stolen funds are now untraceable: the hackers converted the ether largely into bitcoin and spread it across thousands of wallets using mixers, cross-chain bridges, and unregulated OTC platforms. Part of that laundering pipeline was already disrupted by earlier law enforcement action — including the shutdown of the German exchange eXch and the Cryptomixer.io mixing service — though their direct link to this specific batch of frozen funds isn't specified.

• The RICO suit names North Korea, its intelligence agency, and Lazarus Group plus John Doe defendants
• $48.4M recovered, another $30.5M frozen — about 5.3% of the $1.5B stolen
• Court granted a TRO on June 19 and a partial preliminary injunction on July 30

North Korea remains the single biggest source of major crypto thefts: we previously reported that Lazarus Group was behind 76% of all DeFi hack losses in the first half of 2026 — Bybit's lawsuit shows that even a successful partial freeze comes only after months of legal process, and still covers just a small slice of what was stolen.

Nothing here should be taken as financial advice — just information to consider.