Bybit secures asset freeze in $1.5 billion North Korea hack lawsuit

Bybit, the world's second-largest cryptocurrency exchange, filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group for stealing approximately $1.5 billion in Ethereum. On August 7, 2026, the exchange announced it had won a preliminary injunction freezing certain stolen assets, per CoinDesk reporting.

The theft occurred on February 21, 2025, when North Korean state-sponsored hackers allegedly executed what CoinDesk characterized as the largest cryptocurrency heist in history. The stolen amount included over 400,000 ETH and stETH. The Bybit hack comprised the bulk of $2.02 billion in crypto stolen by North Korea in 2025, according to exchange disclosures. In total, North Korean hackers have stolen $6.75 billion worth of cryptocurrency since they began large-scale theft operations, per data from blockchain forensics firm Chainalysis.

Bybit won a preliminary injunction freezing certain stolen assets held by a group of unidentified individuals and entities named as John Doe defendants. The order prohibits respondents from transferring or selling assets they are holding while litigation continues.

Bybit stated: "The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit's ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime." Ben Zhou, co-founder and CEO of Bybit, added: "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts."

Bybit clarified that the civil action is being pursued independently of ongoing criminal investigations conducted by U.S. law enforcement authorities, suggesting the two tracks may proceed on separate timelines and evidentiary standards. The exchange stated it will seek further relief from the court, though no specific remedies or timeline were disclosed.

The case faces structural challenges. The defendants named are nation-state actors and intelligence agencies that do not typically appear in U.S. courts or recognize U.S. civil judgment. The John Doe defendants holding the frozen assets remain unidentified, making enforcement mechanisms unclear. North Korea is widely believed to use stolen crypto to fund its weapons program, meaning the stolen assets may have been converted, laundered, or moved through jurisdictions hostile to U.S. enforcement authority.

The preliminary injunction represents a rare assertion of judicial authority over a nation-state theft. Whether it leads to actual asset recovery depends on the court's ability to identify and compel the frozen assets' custodians to surrender them and on the willingness of foreign jurisdictions and cryptocurrency platforms to honor the injunction order.