Bybit just did something crypto exchanges almost never do: it took a nation-state to court. The exchange filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group — the hacking outfit blamed for draining roughly $1.5 billion in ether and staked ETH from Bybit back in February 2025. It remains the largest crypto theft ever recorded, and now it has a court docket attached to it.
Alongside the filing, a federal judge granted a preliminary injunction ordering the holders of identified stolen assets — currently unnamed "John Doe" defendants — not to move or sell them while the case proceeds. Pyongyang obviously won't show up to defend itself, and no US court ruling will make North Korea pay up directly. That's not really the point. The injunction gives Bybit a legal weapon against whichever exchange, custodian or over-the-counter desk eventually touches those marked coins.
That's usually how recovery actually plays out after a heist like this: stolen tokens get chopped into thousands of transactions, run through mixers and cross-chain bridges, and eventually land somewhere that has to answer to US courts. A freeze order strips those coins of any claim to being "clean" — anyone who accepts them risks violating a federal injunction.
Bybit CEO Ben Zhou called the attack "not just an attack on Bybit" but "an attack on trust in our industry." North Korea is estimated to have stolen around $2 billion in crypto in 2025 alone, and more than $6.7 billion over the years its hackers have been at this. The civil suit runs alongside, not instead of, ongoing FBI investigations and existing sanctions on people tied to the attack — it's simply another lever, this time a civil one.
