Bybit has filed a civil lawsuit against North Korea over the $1.5 billion theft from the exchange in February 2025 and secured a US court order freezing stolen assets while the case proceeds.
The complaint, filed August 7 in the US District Court for the District of Columbia, names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group as defendants. US authorities have identified Lazarus as the DPRK-linked group responsible for the attack, which remains the largest recorded cryptocurrency theft.
A federal judge granted a preliminary injunction prohibiting the transfer, sale or dissipation of identified stolen assets held by unnamed individuals and entities, listed in the case as John Doe defendants. The court found that Bybit had demonstrated a likelihood of success on the merits, according to the exchange.
“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable,” said Ben Zhou, co-founder and chief executive of Bybit, in a statement. “The Lazarus attack wasn’t just an attack on Bybit. It was an attack on trust in our industry.”
Bybit, the world’s second-largest exchange by trading volume, said it will seek further relief from the court.
The injunction matters more than the defendants
The practical value of the filing lies in the John Doe order rather than the case against North Korea itself.
A judgment against the DPRK would be close to unenforceable. North Korea holds no meaningful assets within US jurisdiction, does not participate in US litigation and has no incentive to comply with any ruling. Bybit is unlikely ever to collect from the named state defendants.
The injunction operates differently. It applies to whoever currently holds or moves the identified stolen assets, and it binds them regardless of whether they were involved in the theft. When a court orders assets frozen, the custodian holding them carries a legal obligation to comply, and non-compliance carries consequences.
That converts what has until now been a voluntary process into a mandatory one. Exchanges and custodians have historically responded to blockchain analytics reports and law enforcement requests by freezing suspicious deposits as a matter of policy. A court order removes the discretion. It also gives compliance teams legal cover for acting, which reduces the risk calculation on their side.
Why the case was filed 18 months later
The gap between the February 2025 hack and the August 2026 filing reflects both legal strategy and the accumulation of evidence.
Criminal investigations into the theft remain ongoing, with US agencies including the FBI pursuing their own cases against the North Korean actors. Bybit’s civil action is explicitly separate from those proceedings, meaning the exchange is not dependent on prosecutors’ timelines or priorities.
Tracing also takes time. Funds stolen in the Bybit attack were laundered through mixers, cross-chain swaps and over-the-counter brokers over an extended period. Identifying specific assets and the parties holding them is a prerequisite for a John Doe injunction, and that work could not have been completed immediately after the hack.
One question the filing raises but does not answer publicly is how Bybit intends to overcome sovereign immunity. The Foreign Sovereign Immunities Act generally shields foreign states from US court jurisdiction, with limited exceptions including one covering designated state sponsors of terrorism. The United States redesignated North Korea as a state sponsor of terrorism in 2017, which would provide a plausible route, though the specific arguments in Bybit’s complaint have not been detailed in public reporting.
Context: a persistent and growing problem
The suit lands amid sustained North Korean activity against crypto platforms.
Blockchain security firm Blockaid reported that DPRK-linked actors accounted for nearly $600 million of the more than $1 billion lost to crypto exploits in the first half of 2026, close to half the total. The group carried out both the $285 million Drift exploit and the $292 million KelpDAO exploit, primarily through social engineering aimed at multisignature signers rather than code vulnerabilities.
Researchers recorded $2.02 billion in DPRK-linked thefts during 2025, a 51% increase on 2024, bringing cumulative losses since 2019 to roughly $6.75 billion.
Senator Cynthia Lummis has separately begun framing the stalled CLARITY Act as a response to this activity, pointing to provisions that would extend anti-money-laundering obligations to digital asset firms and create a safe harbour allowing exchanges to freeze suspicious funds before obtaining a court order. The Senate delayed a vote on the bill to September, with prediction market odds of 2026 passage falling to around 20%.
What happens next
Bybit said it will pursue additional relief and is continuing to work with investigators, exchanges, regulators and law enforcement. The John Doe structure allows the exchange to add defendants as tracing identifies further holders of the stolen assets.
The wider significance is procedural rather than financial. If a civil suit backed by blockchain forensics can reliably produce enforceable freeze orders against downstream holders, it creates a recovery mechanism that operates independently of criminal prosecution and does not require the cooperation of any government.
For an industry where roughly $6.75 billion has flowed to a single state actor since 2019, and where criminal enforcement has recovered a fraction of it, that is a route worth testing. Whether it produces returned funds rather than frozen ones will depend on how the litigation develops.
FAQ
What did Bybit file and against whom?
Bybit filed a civil lawsuit on August 7, 2026, in the US District Court for the District of Columbia against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group, over the $1.5 billion theft from the exchange on February 21, 2025. The suit also names John Doe defendants, unidentified individuals and entities holding or moving the stolen funds. A federal judge granted a preliminary injunction freezing identified assets while litigation continues.
Can Bybit actually recover money from North Korea?
Directly, almost certainly not. North Korea holds no meaningful assets within US jurisdiction and will not participate in the proceedings. The practical value lies in the injunction against the John Doe defendants, which binds whoever currently holds the identified stolen assets and obliges custodians to comply. That converts what were previously voluntary freezes based on analytics reports into a legal requirement.
Why did Bybit wait 18 months?
The delay reflects legal strategy and the time required to trace laundered funds through mixers, cross-chain swaps and over-the-counter brokers. Identifying specific assets and the parties holding them is a prerequisite for a John Doe injunction. Bybit’s civil action is separate from ongoing criminal investigations by US agencies including the FBI, meaning the exchange is not bound by prosecutors’ timelines.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any investment decisions.
