Bybit Sues North Korea Over $1.5B Crypto Heist: Assets Frozen

Suing a sovereign state is a move most companies would consider pointless. Suing North Korea, a country that doesn't even recognize the authority of American courts, sounds outright absurd. Yet that's exactly what Bybit, one of the world's largest crypto exchanges, has done in response to the $1.5 billion theft it suffered last year. And, remarkably, it's working.

A federal judge has already frozen a portion of the stolen funds. The bigger story, though, isn't the lawsuit itself. It's what makes the lawsuit possible: blockchain's traceable nature allows stolen money to be legally pursued even when an entire nation-state sits behind the theft. A new legal instrument has been born.

What Bybit Actually Did

Here are the facts. Bybit filed a civil lawsuit in a federal court in Washington against three parties: North Korea, its military intelligence agency, and the notorious Lazarus Group, which U.S. authorities identify as the regime's cyber arm responsible for the attack. The complaint covers the February 2025 theft, when approximately $1.5 billion in Ethereum was drained from the exchange in what became the largest crypto heist in history, according to CoinDesk reporting.

Notably, alongside filing the suit, Bybit secured an early concrete result: a judge issued a preliminary injunction freezing a portion of the stolen assets, barring anyone holding them from transferring or selling them while proceedings continue. The court went further, recognizing that the exchange had demonstrated “a likelihood of success on the merits”, a legally meaningful signal that the case has legs.

The Realistic Picture: Who Actually Pays

Honesty is required here, because it's easy to misread the scope of this victory. North Korea will never appear in a U.S. court. Pyongyang doesn't recognize American jurisdiction and holds no attachable assets on U.S. soil. So Bybit won't recover its money by seizing North Korean bank accounts. That would be a fantasy.

The freeze doesn't target the sovereign state. It targets so-called “intermediaries”: unnamed persons and entities listed in court as “John Doe” defendants, who hold or move the stolen funds on behalf of the hackers. That's where the strategic insight lies. For stolen crypto to become usable, it must eventually pass through parties that Western justice can actually reach: exchanges, conversion services, financial intermediaries. The lawsuit creates the legal instrument to strike those chokepoints, freezing funds the moment they surface from the shadows.

Why Blockchain Makes This Possible

This is the heart of the matter, and the reason this lawsuit could only exist in crypto. In a traditional cash heist, once the money vanishes into the opaque banking system of a hostile nation, tracing it is nearly impossible. Crypto works differently, and in a counterintuitive way. Every transaction is permanently and publicly recorded on the blockchain, so investigators can follow the stolen funds step by step, across years if necessary, watching exactly where they move.

That means stolen funds are never truly “safe” for the thieves: they remain visible, flagged, and traceable. The moment hackers try to cash out through a reachable intermediary, those funds can be blocked. Bybit's lawsuit converts this technical visibility into a legal weapon, using blockchain transparency to build a court case and secure real freezing orders. It's the same principle that allowed the U.S. Treasury to sanction networks circumventing U.S. sanctions: the on-chain trail doesn't fade.

LazarusBounty | Instant 10% Rewards for Fund Recovery | Hack Investigation | $140M Bounty Rewards

Join Bybit's LazarusBounty Program: 10% bounty up for grabs, 5% for successfully tracing the funds and 5% for freezing them. Get rewarded instantly upon confirmation!

Terms of Service

The Bigger Picture

Bybit's lawsuit is a historic precedent, whatever its ultimate financial outcome. As Bybit's founder stated publicly, the Lazarus attack wasn't just an attack on a single company. It was an attack on trust in the entire crypto industry. Responding with legal tools, not only technology, marks a maturation: the crypto world is no longer passively absorbing state-sponsored theft, it's building the legal antibodies to fight back.

Recovering money from hackers backed by a rogue state will remain extraordinarily difficult, and expecting miracles would be naive. The real value of this move is establishing a deterrent and a precedent: proving that stealing crypto doesn't guarantee impunity, and that every attempt to launder those funds will leave an exploitable trail in court. It's the construction, brick by brick, of a legal infrastructure that makes crypto theft progressively more costly and risky. Paradoxically, it's the blockchain's much-feared transparency that makes this defense possible. Readers who want to understand how to protect their own holdings can consult our guide on secure crypto custody.