Bybit Sues North Korea Over $1.5B Hack, Wins Asset Freeze

The Lawsuit and Initial Recoveries

Bybit filed a civil action in US federal court naming North Korea, the country's intelligence agency, and the Lazarus Group as defendants in connection with the $1.5 billion hack that occurred in February 2025. A federal judge granted Bybit's request for a preliminary asset freeze. According to Decrypt, the exchange has recovered $48.4 million of the stolen funds and frozen an additional $30.5 million, totaling $78.9 million or roughly 5% of the amount taken. The order represents an early procedural victory and suggests the court found sufficient evidence of the theft and traceable proceeds to justify the freeze.

How This Differs From Typical Enforcement

Civil suits against state actors are rare in practice, though not novel in law. The US has historically pursued criminal cases against individuals associated with state-backed hacking operations — the Justice Department's 2018 indictment of Lazarus members over the Sony hack and WannaCry are precedent. A civil remedy is lighter-touch and allows plaintiffs like Bybit to pursue recovery without requiring criminal prosecution or international extradition.

Practical Limits and Recovery Outlook

Enforcement against North Korean assets faces obvious obstacles: the country has minimal legitimate holdings in US jurisdiction, and Lazarus-linked cryptocurrency wallets are difficult to attribute with certainty. The recovered and frozen assets likely represent proceeds already traced to US-accessible exchanges or custodians. The remaining $1.42 billion presents a far harder recovery problem. The lawsuit tests whether courts will recognize such claims and whether judgment can ultimately lead to repatriation of funds, or merely serve as a legal precedent for future cases.