Bybit's North Korea lawsuit shows how frozen crypto works

A Lazarus-linked theft from the crypto platform Rain drew a similar response. The FBI froze roughly 2,204 SOL at the exchange WhiteBIT and served a seizure warrant. WhiteBIT transferred the funds to the U.S. government, and a federal court later granted default judgment forfeiting the crypto outright.

Holders of old terrorism judgments against North Korea served a restraining notice on roughly 30,766 ETH, worth about $71 million, that had been frozen when an unrelated exploit hit the Kelp protocol on Arbitrum. Arbitrum's governance records show a DAO vote that later moved ETH to an Aave-controlled wallet, with the restraining notice accompanying the assets to their new location.

No public record shows that competing creditors have claimed the assets Bybit is now pursuing. The Kelp episode establishes a real pattern. Once DPRK-linked crypto sits frozen somewhere reachable, other parties holding judgments against North Korea can try to get in line for it too.

The U.S. Treasury Department designated Lazarus Group, Bluenoroff and Andariel in 2019 as entities controlled by North Korea through their ties to the Reconnaissance General Bureau. Treasury says the country's cyber operations generate revenue that can fund weapons and ballistic missile programs.

Chainalysis says North Korean hackers stole over $2 billion in crypto in 2025 alone, a 51% jump from the year before, even as the number of known attacks fell sharply. Cumulative DPRK crypto theft has reached at least $6.75 billion. The pattern points toward fewer, larger hits and away from a broad spray of small ones.

The bull case for Bybit is that more of the stolen $1.46 billion will turn up at reachable chokepoints than anyone currently expects. Investigators trace additional funds held by exchanges, stablecoin issuers, bridges, or custodians willing to cooperate. Bybit's injunction becomes a template other victims use to chase down DPRK-linked funds long into a hack's aftermath. Recovery climbs meaningfully above the roughly $85.9 million secured so far. Courts prove that persistence still beats time even against a state-backed hacking operation.

The bear case is that the injunction covers only a small residual balance already trapped by ordinary compliance systems before Bybit filed suit. Most of the $1.46 billion stays gone, laundered through the 45-day window Chainalysis describes long before any court could act. The lawsuit proves that legal reach exists. It also proves that a 17-month head start is nearly fatal to recovery.

Bybit's lawsuit is proving that the assets sitting at the end of one blockchain transaction can still be stopped. Just not for free, and never on a predictable schedule.