Bybit Gets U.S. Court Backing to Chase $1.5B Lazarus Group Theft

Bybit's legal theory extends beyond standard civil recovery. The exchange seeks $1.5 billion in compensatory damages, plus punitive and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act. RICO is typically used against organized crime. Applying it to a state-sponsored hacking operation is aggressive, but Bybit appears determined to use every available tool.

The recovery numbers are sobering. As of the June filing, 90.2% of the stolen funds had been passed through mixers and cross-chain bridges, then through over-the-counter dealers, making them effectively untraceable. That left 9.8% still trackable, with $75.5 million frozen or recovered so far. Bybit CEO Ben Zhou said that over a year earlier, 68.57% of the funds were still traceable. The window closed fast.

The Lazarus Group has executed similar operations before. Forensic investigators found the attack technically sophisticated: compromised developer credentials were used to plant malicious code inside a cloud system, not a brute-force assault on Bybit's front end. The breach was quiet and targeted.

Suing North Korea directly is nearly impossible to enforce. The country will not appear in a U.S. federal court. But the lawsuit creates a legal record, compels third-party platforms to hand over data, and potentially opens the door to seizing assets in jurisdictions where enforcement is feasible. The 20 unidentified defendants are likely the real target – intermediaries who moved money through exchanges with U.S. connections. Some may not yet know they are defendants.

The partial preliminary injunction from July 30 remains under seal, limiting visibility into which assets have been frozen.