Bybit filed a civil lawsuit in U.S. federal court against North Korea to recover assets from a $1.5 billion [1] cryptocurrency hack.
The legal action marks a rare attempt by a private exchange to hold a sovereign state and its intelligence apparatus accountable for cyber theft. By targeting the Democratic People's Republic of Korea and its state-sponsored hacking units, Bybit is testing the reach of U.S. courts in recovering digital assets stolen across borders.
The lawsuit names the North Korean state, its Reconnaissance General Bureau (RGB), and the Lazarus Group hacking outfit as defendants [1]. The legal proceedings are taking place in the U.S. District Court for the District of Columbia [3].
The dispute stems from a massive security breach that occurred in February 2026 [4]. During that event, attackers stole $1.5 billion [1] in crypto assets from the Dubai-based exchange.
Bybit has already reported the recovery of $48.4 million [2]. Furthermore, the exchange secured a preliminary injunction from the court that froze an additional $30.5 million [2] in stolen assets.
The move aims to disrupt the financial pipelines used by the Lazarus Group to move funds. By securing court-ordered freezes, the exchange can prevent the further laundering of stolen tokens through other platforms, a common tactic used by state-sponsored actors to hide the origin of funds.
While the frozen amounts represent a small fraction of the total loss, the legal precedent may assist other victims of the Lazarus Group. The case highlights the ongoing struggle between centralized exchanges and highly organized state hacking operations that target the crypto ecosystem to fund government activities.
“Bybit filed a civil lawsuit in U.S. federal court against North Korea to recover assets from a $1.5 billion cryptocurrency hack.”
This case underscores the increasing intersection of international law and blockchain forensics. By successfully freezing assets through a U.S. court, Bybit demonstrates that while the blockchain is decentralized, the off-ramps where crypto is converted to fiat or moved between exchanges remain vulnerable to legal intervention. It signals a shift toward more aggressive legal strategies against state-sponsored hacking groups like Lazarus, though the difficulty of enforcing judgments against a sovereign state like North Korea remains a significant hurdle.
