Bybit sues North Korea for $1.5B hack as US court freezes stolen crypto

Bybit filed a civil lawsuit in the US District Court for the District of Columbia on August 7, 2026, against the Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group. The complaint concerns the February 21, 2025, breach that drained more than 400,000 Ether and staked Ether from the Dubai-based exchange. The theft, valued at roughly $1.5 billion at the time, remains the largest recorded cryptocurrency heist.

A federal judge already granted a preliminary injunction. The order freezes identifiable stolen assets held by unnamed individuals and entities listed as John Doe defendants. Those defendants are barred from transferring, selling, or otherwise disposing of the identified assets while the case proceeds. Securing such an order required demonstrating to the court that Bybit is likely to succeed on the merits and that the assets would be at risk of dissipation without the freeze.

Bybit CEO Ben Zhou framed the filing around accountability rather than financial recovery. "Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," Zhou said in a statement.

The case is unusual in several dimensions. A private company is suing a sovereign nation. The defendants include a state intelligence agency and a hacking group that operates under its direction. The stolen assets have been laundered across thousands of wallets, converted between blockchains, and run through mixing services designed to break the transaction trail. The Foreign Sovereign Immunities Act typically shields foreign governments from lawsuits in US courts. Exceptions exist for states designated as sponsors of terrorism. North Korea has been on the State Department's list since 2017. Whether the cryptocurrency theft qualifies under that exception is a legal question the court will need to address.

The timing matters. Bybit waited 18 months after the hack to file. That gap allowed blockchain tracing to mature. The initial weeks after a major theft are chaotic, with funds racing across chains and through mixers. Over time, some of that movement stops. Funds settle in wallets or land on exchanges where withdrawal requires interaction with regulated entities. The preliminary injunction targets those resting points.

The FBI attributed the attack to North Korean actors within days, identifying the perpetrators under the operational name TraderTraitor. The bureau urged exchanges, validators, and blockchain firms to block transactions connected to addresses used in the laundering operation. US intelligence agencies had tracked Lazarus Group operations for years. The on-chain signatures of the Bybit attack matched patterns from previous North Korean campaigns.

The attackers moved fast. Within the first week, a significant portion of the ETH was converted to Bitcoin through cross-chain bridges. The Bitcoin was then dispersed across thousands of wallets in a peel-chain pattern designed to overwhelm tracing tools. By March 2025, Bybit's CEO reported that 88.87 percent of the stolen funds remained traceable, with 7.59 percent lost to mixers and 3.54 percent frozen. By April 2025, 27.6 percent could no longer be tracked.

North Korean groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data. The Bybit attack accounted for most of that total. Cumulatively, North Korea-linked groups have stolen roughly $6.75 billion in digital assets over multiple years. The threat continued into 2026. In April, Lazarus-linked attacks allegedly drained $577 million from Drift Protocol and KelpDAO in two separate incidents.