Bybit Sued North Korea Over Its $1.5 Billion Hack. A Federal Judge Already Froze $30 Million

What Happened

On Friday, August 7, Bybit filed a civil lawsuit in the US District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group, the state-directed hacking operation US authorities blame for the February 2025 theft of roughly $1.

5 billion from the exchange. The complaint, brought under the Racketeer Influenced and Corrupt Organizations Act (RICO), also names unidentified John Doe defendants: the people and entities currently holding or moving the stolen funds. Alongside the filing, Bybit secured a preliminary injunction freezing identified stolen assets, with the court finding that 'Bybit has demonstrated a likelihood of success on the merits.'

As of this writing, it is the first known case of a crypto exchange taking a nation-state to a US courtroom over a hack.

The underlying theft needs little introduction. On February 21, 2025, attackers compromised Bybit's cold wallet transfer process and moved more than 400,000 ETH and staked ETH out of the exchange, the largest crypto heist on record. The FBI (Federal Bureau of Investigation) attributed the operation to DPRK actors within days, and blockchain analytics firms later counted the Bybit haul as the bulk of the roughly $2 billion North Korea stole across 2025.

Bybit absorbed the loss, restored full backing of client assets within days, and spent the following 18 months funding a bounty-driven tracing effort. Announcing the suit, co-founder and CEO Ben Zhou said the company's focus 'has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable.'

According to that same announcement, the effort has recovered about $48.4 million to date, with more than $30.5 million more frozen across upward of 28 exchanges and custodians pending further legal action.

Bybit just showed you can sue a nation-state and freeze stolen coins wherever custodians stand. It also showed the inverse: where there are no custodians, there is no freeze, for thieves and for you alike.

Suing a State That Will Never Show Up

Sovereign states enjoy default immunity in US courts under the Foreign Sovereign Immunities Act (FSIA), and Pyongyang will not be sending lawyers to Washington. Coverage of the complaint describes a jurisdictional section built to thread FSIA's narrow exceptions, arguing that a for-profit hacking campaign whose proceeds now sit at US-connected venues is commercial activity rather than protected state conduct.

US plaintiffs have won default judgments against North Korea before, in terrorism-related cases the DPRK never appeared to contest, and the realistic endgame here looks similar: a default judgment Pyongyang will ignore, fixing a damages figure the state itself will likely never pay.

That is not the same as saying the suit is theater. The operative instrument is not the eventual judgment against North Korea; it is the injunction against the John Does. A US court order freezing specifically identified stolen assets binds every exchange, custodian, and service provider with US exposure that touches them.

It converts what has been a voluntary process (Bybit asking platforms, often with bounties attached, to freeze flagged deposits) into a legal obligation with contempt risk behind it. And because a RICO judgment can attach to traceable proceeds wherever they later surface, the case builds a standing legal net that outlives the news cycle: a stolen coin that touches a compliant venue years from now is still attachable.

The Freeze Machinery Cuts Both Ways

The numbers put the machinery in proportion. Roughly $48 million recovered and $30 million frozen, against a $1.5 billion theft, is about a 5 percent dent after 18 months. Most of the haul was laundered through mixers and cross-chain swaps within weeks of the attack, and the freeze figures come from Bybit's own announcement, so treat them as a claimant's accounting.

Skeptics who call this cents on the dollar are right. The structural point survives the skepticism: every recovered cent came back through a custodial choke point. Nothing about the base layer clawed anything back, and no protocol was rolled back to undo the theft. Recovery exists exactly where intermediaries exist, and nowhere else.

For exchanges and for states, the case is a template. If the FSIA argument holds, every future victim of state-sponsored theft has a copyable playbook: sue the sovereign, win by default, and use the judgment to deputize the global custodial perimeter as a permanent freeze network.

The G7 designated North Korea's crypto theft program a security threat in June; a civil-court freeze net gives that designation teeth that sanctions alone lack. But freeze authority built for a sympathetic victim is infrastructure once it exists. The list of claimants who can ask a US court to immobilize deposits at 28 custodians will not stay limited to hacking victims, and OPNorange's July coverage of the GENIUS Act's compulsory freeze machinery described the same direction of travel: the custodial layer is being wired for mandatory response.

What This Means for You

The first lesson is the oldest one. Bybit's customers were made whole because Bybit was solvent enough to absorb a $1.5 billion hole, not because the system protected them. That is the shape of custodial risk: an exchange balance is an unsecured claim on a company that is itself a prime target for the best-funded thieves on earth, and your recovery depends on its balance sheet and its lawyers.

If the balance matters to you, hold the private keys yourself. Move long-term holdings to a hardware wallet, put meaningful sums behind multi-sig, and treat anything left on an exchange as working capital you can afford to lose.

The second lesson is the uncomfortable mirror image. Self-custody removes the recovery net along with the counterparty. If your keys are stolen, no court can freeze your coins at 28 custodians, because a competent thief will avoid every venue that would comply. Seizure resistance and recovery resistance are the same property wearing different clothes.

That argues for defense in depth rather than despair: multi-sig or passphrase-hardened wallets so a single compromise is not fatal, tiered storage so hot losses stay small, and honest accounting of which failure modes you have chosen to own.

Concretely, this week: audit where your balances actually sit, and withdraw anything you are not actively trading to keys you control. Verify your hardware wallet firmware is current, given the last month of supply-chain failures. And if you hold funds for others in any capacity, understand that a US court order now reaches flagged deposits faster than voluntary compliance ever did, and plan your legal exposure accordingly.

What to Watch

Watch the FSIA ruling: if the court holds that state-sponsored crypto theft is commercial activity outside sovereign immunity, that holding will be cited for a decade. Watch whether service of process on Pyongyang is perfected and how long the road to default judgment runs. Watch the recovery ledger: whether frozen balances convert into returned assets, and whether any John Doe defendants are ever named as the tracing narrows.

And watch for copycats: other DPRK theft victims first, and eventually less sympathetic plaintiffs, filing the same paperwork against the same custodial perimeter.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.