Bybit Sued North Korea Over $1.5 Billion Crypto Theft
The exchange has secured a preliminary injunction to freeze assets linked to a 2025 cyberattack.
Updated on Sept. 30, 2026 in Cybersecurity
Live Poll
Do you trust that cryptocurrency exchanges have the tools to recover your assets if stolen?
Bybit has filed a civil lawsuit in the US District Court for the District of Columbia against the Democratic People's Republic of Korea and the Lazarus Group. The action follows a February 2025 cyberattack in which approximately $1.5 billion in cryptocurrency was allegedly stolen.
Why it matters
The lawsuit represents an attempt to hold state-sponsored entities accountable for large-scale cybercrime while addressing industry-wide trust deficits. It follows broader international enforcement actions targeting platforms that allegedly facilitate the movement of illicit digital assets.
Bybit has recovered $48.4 million and identified an additional $30.5 million in assets currently frozen across 28 exchanges and custodians. These figures are measured against the $1.5 billion total reported stolen in the February 2025 attack.
The players
Bybit
A UAE-based cryptocurrency exchange that manages digital asset trading and platform security.
Lazarus Group
A state-sponsored cyber-adversary attributed by US authorities to sophisticated financial cyberattacks.
Democratic People's Republic of Korea
A sovereign state named as a defendant for its alleged involvement in the state-sponsored cyber-theft.
The details
Bybit collaborates with the FBI to share blockchain intelligence, using on-chain analysis to trace the movement of stolen funds across decentralized ledgers. The court has granted a preliminary injunction, a judicial order that prevents the transfer or dissipation of assets, to ensure the remaining funds stay frozen while the litigation proceeds. This legal maneuver mirrors recent international efforts, such as the dismantling of the eXch exchange in Germany and the disruption of Cryptomixer.io services in Switzerland.
Timeline
The cyberattack occurred in February 2025.
This report on the ongoing litigation was published on September 30, 2026.
The Tech Race
This lawsuit follows a pattern set by the ongoing international crackdown on illicit cryptocurrency mixers by targeting the financial infrastructure used by state-sponsored actors. It marks a shift from relying exclusively on regulatory enforcement to using civil litigation for asset recovery.
The preliminary injunction acts as a legal firewall, preventing the movement of identified stolen funds through the 28 impacted exchanges and custodians. Users should be aware that recovery of stolen assets remains complex, with most funds currently remaining outside of these recovered or frozen sums.
The takeaway
This case highlights the growing role of private-sector blockchain forensics in international asset recovery efforts. Observers should track upcoming rulings in the US District Court for the District of Columbia to see how successfully civil law can be used to reclaim assets from state-backed groups.
What happens next
The litigation is ongoing, and Bybit has stated its intention to seek additional judicial relief as the case proceeds through the US District Court for the District of Columbia.
Further reading
For more on the security landscape of digital assets, visit the Cybersecurity section.
Source note: This article includes information reported by The Fintech Times.
Live Poll
Do you trust that cryptocurrency exchanges have the tools to recover your assets if stolen?
