Cryptocurrency exchange Bybit has taken an unusual step in its effort to recover funds stolen during a major cyberattack. The exchange has filed a civil lawsuit in a US federal court against North Korea, the country’s Reconnaissance General Bureau, and the Lazarus Group.
The case relates to the February 21, 2025, hack that drained more than 400,000 ETH and staked Ether from Bybit. The stolen assets were worth approximately $1.5 billion at the time, making the incident the largest recorded cryptocurrency theft.
Bybit filed the case in the US District Court for the District of Columbia. The exchange is seeking to recover stolen funds and hold the alleged parties responsible for the attack.
The lawsuit may sound difficult to enforce, especially because North Korea is a sovereign country. However, the case has already achieved an important early result: a federal judge issued a preliminary injunction freezing certain assets linked to the theft.
What Happened During the Bybit Hack?
The attack began when hackers compromised Bybit’s security process during what appeared to be a regular transfer from an offline storage wallet. The attackers then moved more than 400,000 ETH and stETH from the exchange.
US investigators later attributed the attack to North Korean hackers operating under the name TraderTraitor. The group is widely associated with Lazarus, a cybercrime network that Western governments have linked to North Korea.
After the initial theft, the attackers moved quickly. They converted part of the funds, moved assets across different blockchains, and spread the money across thousands of wallets. Blockchain bridges, decentralized exchanges, and crypto mixers were reportedly used to make the transactions more difficult to follow.
This type of laundering process creates a race between investigators and hackers. The longer stolen funds remain in one wallet or on one exchange, the easier they may be to freeze. Once they move through several networks and services, tracing and recovery become much harder.
Why the Court Freeze Matters
The preliminary injunction is not a final decision in Bybit’s favor. It does not prove that every defendant is legally responsible, and it does not guarantee that the exchange will recover the entire amount.
Instead, the order temporarily prevents certain unidentified people and entities, known in the lawsuit as John Doe defendants, from transferring, selling, or disposing of assets connected to the hack.
This step is important because stolen cryptocurrency may eventually reach a centralized exchange, custodian, or other service that can identify its holder. With a federal court order in place, Bybit has more than a simple request for cooperation. It can point to a legal obligation to preserve the assets covered by the order.
The court action could also help Bybit identify people or companies that currently control some of the stolen funds. If investigators discover their identities, those parties may be added to the case.
Can Bybit Really Sue North Korea?
Suing a sovereign nation is far more complex than suing an individual hacker. Under US law, foreign governments generally receive protection from lawsuits through the Foreign Sovereign Immunities Act.
There are, however, exceptions to that protection. The lawsuit will likely test whether the alleged cyberattack falls within one of those exceptions and whether a US court can exercise jurisdiction over North Korea and its intelligence agency.
Even if North Korea refuses to participate in the case, Bybit may still pursue a default judgment. That would not automatically make it easy to collect money from the North Korean government. North Korea has limited interaction with the traditional global financial system, and the country is unlikely to voluntarily pay a US court judgment.
The more practical target may be the stolen assets themselves. If the funds are found at exchanges, custodians, or wallets connected to identifiable people, the court order could help Bybit pursue those assets.
A Lower Legal Burden Than Criminal Charges
The lawsuit is separate from criminal investigations by US law enforcement. That distinction could benefit Bybit.
Criminal prosecutors generally need to prove guilt beyond a reasonable doubt. A civil case uses a lower standard of proof. Bybit also controls its own legal strategy instead of waiting for a criminal prosecution to reach its conclusion.
A civil lawsuit can provide several tools for asset recovery, including subpoenas, discovery requests, and injunctions. These tools may help the exchange learn more about where the stolen funds moved.
The case could become especially useful if it creates legal precedent for crypto thefts involving state-linked hacking groups. Future victims may use the same approach after major exchange breaches or DeFi exploits.
The Larger North Korean Crypto Threat
The Bybit incident is part of a wider pattern. North Korean hacking groups have been accused of stealing billions of dollars in digital assets through attacks on exchanges, bridges, and DeFi protocols.
According to the reference report, North Korean groups stole an estimated $2.02 billion in cryptocurrency during 2025. Their total alleged crypto theft has reached approximately $6.75 billion over several years.
These funds are believed to help support North Korea’s government programs, including weapons development. That makes crypto security more than a private industry concern. It also gives governments a reason to improve cooperation with exchanges, blockchain analytics companies, and law enforcement agencies.
For crypto platforms, the attacks show why wallet security, transaction approvals, access controls, and emergency response plans are essential. A single compromised transfer process can expose billions of dollars in customer assets.
What Happens Next?
Several developments could shape the future of the Bybit lawsuit:
- The court may decide whether the case can proceed against North Korea and its intelligence agency.
- Bybit may identify more individuals or companies linked to the stolen assets.
- Exchanges and custodians may freeze additional funds covered by the injunction.
- North Korea may ignore the case, challenge the court’s authority, or decline to respond.
- Other victims of Lazarus-linked attacks may consider similar legal action.
The biggest challenge remains the amount of money that has become difficult to trace. The longer stolen assets remain in circulation, the more likely they are to pass through multiple chains, mixers, and decentralized services.
Why This Case Could Set a Precedent
Bybit’s lawsuit may not recover the full $1.5 billion. Still, it could prove that civil courts have a useful role in crypto asset recovery.
The case combines blockchain tracing with traditional legal enforcement. That combination could make it harder for hackers to move stolen funds through regulated exchanges and custodians.
The lawsuit also sends a message to state-backed hacking groups: stolen crypto may remain legally vulnerable even after it crosses multiple blockchains. For Bybit and the wider crypto industry, that may be the most important development of all.
