Bybit Sues North Korea Over $1.5B Hack, US Court Freezes Lazarus Assets

Bybit Takes the Largest Crypto Heist Ever to a US Court

Bybit has filed a civil lawsuit against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group in the US District Court for the District of Columbia, seeking to recover assets from the $1.5 billion February 2025 attack on the exchange. The filing, confirmed by CoinDesk, is the first time a private company has taken a sovereign nation to a US federal court over a cryptocurrency theft.

The exchange did not stop at filing. The court has already granted a preliminary injunction that freezes identified stolen assets held by so-called John Doe defendants, the unnamed individuals and entities suspected of holding pieces of the stolen crypto. The order blocks any transfer, sale, or dissipation of those assets while the case proceeds.

Preliminary Injunction Freezes Lazarus-Linked Funds

In the court’s own framing, Bybit has “demonstrated a likelihood of success on the merits,” a standard judges apply before issuing this kind of pre-trial freeze. That threshold matters. It means the court has looked at the blockchain evidence and considered the tracing credible enough to lock the funds down before either side has filed a full argument.

Bybit chief executive Ben Zhou framed the strategy in a public statement: “Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable.” The exchange added that the order “is intended to preserve identified stolen digital assets while the litigation continues.” Bybit has not disclosed the dollar value of assets currently under the freeze, and the court order does not enumerate wallet addresses in the public docket.

How a Preliminary Injunction Actually Works in Crypto

A preliminary injunction is a court order that keeps things still while a case is heard, and in a crypto context that means custodians, exchanges, and OTC desks holding the flagged funds have a legal duty to comply. Ignoring a US court order carries penalties that a polite request from an exchange does not, which is why litigation can succeed where voluntary cooperation stalls.

The mechanism is worth understanding for anyone tracking the latest crypto news around stolen funds. When a hacker moves crypto through mixers or into an exchange, that exchange usually only freezes on request, and only if it wants to. A federal freeze order converts that request into a requirement, and it applies to anyone the court can reach, which in practice covers most large regulated platforms operating in or through the United States.

Inside the $1.5 Billion February 2025 Heist

The underlying attack, dated February 21, 2025, remains the largest cryptocurrency theft ever recorded. Attackers linked to the Lazarus Group drained more than 400,000 ETH and staked ether (stETH) from a Bybit cold wallet during a routine transfer, according to the exchange’s own post-mortem and blockchain analytics firms that traced the funds. The total value at the time of the breach was roughly $1.5 billion.

In the months that followed, the stolen crypto was routed through a chain of mixers, bridges, and instant-swap services in an effort to break the trail. Bybit says it waited eighteen months before filing to allow that tracing work to mature, per analysis by Crypto.news, which noted the delay was likely strategic rather than administrative.

Why Suing a Sovereign Country Is So Rare

Foreign governments are usually shielded from US lawsuits by the Foreign Sovereign Immunities Act, or FSIA. The statute has narrow exceptions, and one of them covers states designated by the US as sponsors of terrorism, a list North Korea has been on since 2017. That designation is the door Bybit is walking through.

The novel part is the subject matter. Prior FSIA terrorism-exception cases have centred on physical violence, hostage-taking, and material support for terrorist groups. Applying it to a purely financial cyber-heist is untested. Crypto.news observed that “a cryptocurrency hack committed for financial gain rather than political violence may test the boundaries of the statute,” which suggests the case’s precedent value could stretch well beyond the immediate recovery effort.

Could Civil Suits Become Crypto’s Next Recovery Playbook

State-linked crypto theft has grown into a chronic threat for exchanges, which shows up on dashboards for crypto market prices each time a fresh hack hits. Criminal enforcement has struggled to keep pace, in part because indictments do not travel to Pyongyang. A civil suit with an enforceable freeze order sidesteps that limitation, since the target is the money rather than the person.

If Bybit’s case holds up on appeal, exchanges may increasingly pair post-incident forensics with civil filings against the entities behind the theft. That could tilt the calculus for state-backed groups, whose current model assumes stolen crypto is effectively unrecoverable once it clears the initial swap. For anyone who chooses to buy crypto on a centralised platform, it may also raise expectations that a serious venue treats recovery as a long-term legal project, not a press release closing the file.

A New Legal Front in the War Against State-Backed Crypto Theft

The Bybit filing shifts an argument that used to live only in sanctions offices into an open federal courtroom. Whether the exchange ever recovers a full $1.5 billion is almost secondary. The immediate signal is that a US court has agreed the blockchain trail can support enforceable orders against a foreign state, and has issued one. That precedent, if it survives further motions, is likely to outlast this particular case.

For an industry that has spent a decade being told its wins are irreversible and its losses are permanent, the reversal of that framing on the losses side is a genuinely new development, and one worth watching as it moves through the next stages of litigation.