Bybit Sues North Korea in DC Court to Recover $1.5B in Stolen Crypto

Woofun AI reports that Bybit initiated legal proceedings in the U.S. District Court for the District of Columbia, naming the Democratic People's Republic of Korea, the Reconnaissance General Bureau, the Lazarus Group, and unidentified John Doe defendants as parties to the suit.

A preliminary injunction was granted by the court to cover certain assets connected to the case, effectively barring their transfer or dissipation while the litigation continues. This legal measure stems from the February 21, 2025 attack that drained approximately $1.5 billion in virtual assets from Bybit. Five days later, the FBI formally attributed the theft to North Korea, identifying the malicious cyber activity as 'TraderTraitor.'

The agency warned that the actors were rapidly converting portions of the stolen assets into Bitcoin and other cryptocurrencies, dispersing them across thousands of addresses on multiple blockchains. Its IC3 public-service announcement urged exchanges, bridges, DeFi services, blockchain analytics firms, and other virtual-asset businesses to block transactions connected to addresses being used to launder the stolen funds. Bybit states that the injunction is intended to preserve digital assets that may still be recoverable and plans to seek further relief from the court.

Historical context reveals that in September 2019, the U.S. Treasury Department sanctioned Lazarus Group, along with Bluenoroff and Andariel, describing them as North Korean state-sponsored cyber groups controlled by the RGB. Treasury identifies the RGB as North Korea's primary intelligence bureau. A joint FBI, CISA, and Treasury advisory on TraderTraitor noted that North Korean actors had targeted cryptocurrency exchanges, DeFi protocols, blockchain companies, venture funds, and individual crypto holders. The advisory described social engineering and malicious applications among the methods used to reach their targets. Per Woofun AI, the company submitted this legal action to address these sophisticated intrusion vectors.

The financial implications extend beyond immediate theft, as Treasury has separately linked stolen virtual currency to North Korea's wider revenue operations. In a 2023 sanctions action, the department said the DPRK uses stolen crypto and laundering networks to generate revenue for its unlawful weapons of mass destruction and ballistic missile programs. This structural reliance on illicit digital finance underscores the strategic importance of disrupting these flows. The laundering networks serve not merely as exit ramps but as critical infrastructure for state-funded military expansion.

Bybit is not the first party to use the D.C. federal court system to pursue crypto linked to North Korean operations. In June 2025, the Justice Department filed a civil forfeiture complaint in the same federal district court involving more than $7.74 million allegedly tied to North Korean IT-worker schemes and cryptocurrency theft. DOJ said the funds had been frozen and seized while the actors attempted to launder them. These U.S. criminal investigations highlight a growing trend of leveraging civil mechanisms to combat state-sponsored cybercrime. The precedent set by the Justice Department provides a procedural framework for private entities like Bybit to seek restitution.

Recovery remains uncertain, as the filing does not establish how much of the original $1.5 billion remains identifiable, reachable, or recoverable through the U.S. court process. The new court order can help preserve assets that Bybit manages to identify and bring within the scope of the case.

However, the dispersion of funds across multiple blockchains complicates any potential restitution. This marks a significant escalation in the legal battle against state-sponsored cyber theft, yet the actual recovery of funds remains highly speculative.