Bybit, the world's second-largest cryptocurrency exchange, has filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its intelligence agency the Reconnaissance General Bureau (RGB), and the state-linked Lazarus Group — the hacking organization identified as responsible for stealing $1.5 billion from the exchange. The case is unusual in targeting a sovereign nation in a U.S. civil court, a path complicated by sovereign immunity doctrines, though North Korea's designation as a state sponsor of terrorism can provide a legal basis for certain claims against the state.

The lawsuit was filed in the U.S. District Court for the District of Columbia. In conjunction with the filing, Bybit announced it had secured a preliminary injunction from a federal judge freezing certain stolen assets currently held by a group of unidentified individuals and entities, referred to in the case as John Doe defendants. The injunction prohibits the respondents from transferring or selling the identified assets while litigation is ongoing, the exchange said in a press release on Friday. Such asset-freeze orders have become one of the few practical tools available to crypto exchanges seeking recovery, as stolen funds are frequently laundered through cross-chain bridges and mixing services designed to obscure their trail.

On February 21, 2025, the North Korean state-sponsored Lazarus Group allegedly carried out the largest cryptocurrency heist on record, stealing approximately $1.5 billion in Ethereum — over 400,000 ETH and stETH — from Dubai-based Bybit. The incident accounted for the majority of the $2.02 billion in crypto stolen by North Korea that year. According to data from Chainalysis, North Korean hackers have stolen a cumulative total of $6.75 billion worth of crypto. The country is widely believed to use proceeds from such thefts to fund its weapons program, and the Lazarus Group itself has been sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC).

"The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit's ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime," Bybit said in the release.

"Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," said Ben Zhou, co-founder and CEO of Bybit, in a statement. "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts."

Bybit indicated that it intends to seek further relief from the court as the case proceeds.

"The civil action is being pursued independently of ongoing criminal investigations conducted by U.S. law enforcement authorities," the firm added. The civil strategy mirrors a growing trend among hacked exchanges and blockchain-analytics firms that have increasingly pursued parallel civil remedies alongside government criminal actions, hoping to lock down identifiable funds before they can be further dispersed.

Source: CoinDesk