Bybit has sued the North Korean government over the theft of roughly $1.5 billion in Ethereum from the exchange in February 2025, and a federal judge has given the company court-backed powers to chase what is left of the money. Court records unsealed this week show Bybit filed the case under seal on June 18 in the US District Court for the District of Columbia, naming the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency, the Lazarus Group and 20 unidentified defendants. The court granted expedited discovery a day later and partially granted a preliminary injunction on July 30. Bybit made the case public on Friday.
The arithmetic is brutal. By Bybit’s own count in the June filing, 90.2% of the stolen funds had already passed through mixers, cross-chain bridges and over-the-counter dealers and could no longer be followed. A crypto mixer is a service that pools coins from many users and pays them back out in unrelated amounts, breaking the link between where funds came from and where they went.
Key takeaways
- Bybit filed a civil suit on June 18 against North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 John Doe defendants in federal court in Washington, DC.
- A judge granted expedited discovery on June 19, a temporary restraining order the same day, and a partial preliminary injunction on July 30 freezing identified assets.
- Bybit says 90.2% of the stolen crypto is untraceable. About 5.3% of the total, near $75.5 million, has been frozen or recovered.
- The exchange is seeking $1.5 billion in compensatory damages plus punitive and treble damages under the US Racketeer Influenced and Corrupt Organizations Act.
Published: August 8, 2026, 09:30 UTC
What the court actually granted
Expedited discovery is the part that matters commercially, because it lets Bybit demand account records before the defendants respond. The exchange told the court that some traceable assets landed at platforms that operate or maintain infrastructure in the United States, and asked for account-holder identities, balances and transaction histories. Certain platforms had signalled they would cooperate once a court order existed, according to the filing, available on the public docket.
The restraining order issued on June 19 barred the unnamed defendants from moving specific traceable assets. The court renewed it on July 16 before converting part of it into a preliminary injunction on July 30. In granting relief, the court found that Bybit had shown a likelihood of success on the merits. Some exhibits remain sealed.
Why most of the money is already gone
The traceability figure has collapsed since the attack. Bybit chief executive Ben Zhou said in early 2025 that 68.57% of the funds remained traceable. Fifteen months later the filing puts that number at 9.8%, with about 5.3% of the original haul, near $75.5 million, frozen or recovered. In its Friday statement, Bybit put recoveries at roughly $48.4 million with a further $30.5 million frozen across more than 28 exchanges and custodians.
Laundering that fast requires infrastructure, and some of it has since been taken offline. German authorities dismantled the exchange eXch, and German and Swiss investigators later disrupted Cryptomixer.io. Both had been used to move proceeds from the hack, according to Bybit.
The theft itself was a supply chain failure rather than a flaw in Bybit’s own contracts. Attackers compromised credentials belonging to a developer at Safe Wallet and injected malicious code into its cloud infrastructure, which let them redirect more than 400,000 ETH and stETH on February 21, 2025. The FBI attributed the operation to North Korea five days later. Similar third-party and firmware failures have driven this year’s losses too, from the Coldcard firmware flaw to a run of bridge exploits.
Suing a state that will not show up
North Korea is not going to appear in a Washington courtroom, and Bybit knows it. The value of the case sits with the John Doe defendants and the discovery powers attached to them. A default judgment against Pyongyang would be symbolic. A court order compelling a US-connected exchange to hand over the identity behind a receiving wallet is operational.
That distinction matters for every exchange watching this. Civil litigation is becoming a parallel track to sanctions enforcement, which has been the main tool so far. US Treasury sanctions landed on two Iran-linked exchanges this week, following earlier action against a Dubai operator that had routed $676 million to Binance. Sanctions cut off access. Civil discovery names people.
North Korean operators have stolen $6.75 billion in crypto to date, according to Chainalysis data cited by CoinDesk, including $2.02 billion in 2025. Bybit accounted for most of that year’s total.
What happens next
Bybit said it will seek further relief as the case proceeds, and that the civil action runs independently of criminal investigations by US authorities. The immediate question is how many of the platforms named in discovery comply, and how quickly. Every week of delay gives holders of the frozen assets time to test the boundaries of the injunction.
The wider test is whether a treble-damages RICO claim against a sovereign state survives a motion to dismiss. If it does, exchanges that suffer state-linked breaches gain a template. If it does not, the freeze on roughly $75 million may be the practical ceiling on what Bybit recovers.
Frequently asked questions
How much of the Bybit hack money has been recovered?
Bybit says about $48.4 million has been recovered and roughly $30.5 million more is frozen across more than 28 exchanges and custodians. Combined, that is near 5.3% of the $1.5 billion stolen. The June court filing put 90.2% of the funds beyond tracing.
Can a US court enforce a judgment against North Korea?
Collecting directly from Pyongyang is unrealistic. The practical value of the suit lies in the John Doe defendants and the expedited discovery order, which lets Bybit compel exchanges with US operations to identify account holders linked to traceable stolen funds.
What is expedited discovery?
Expedited discovery is a court order allowing a plaintiff to demand documents and records before the normal discovery schedule begins. In fast-moving crypto cases it is used to identify anonymous defendants and preserve evidence before assets move again.
