Bybit has filed a civil lawsuit against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group hacking unit, securing a preliminary injunction from a U.S. federal court that freezes identified assets tied to the $1.5 billion Ethereum theft executed last February, the largest cryptocurrency heist on record.
The complaint and the court
The suit was filed in the U.S. District Court for the District of Columbia against the DPRK, the RGB, and Lazarus Group, plus a roster of John Doe defendants currently holding the stolen funds. Bybit said the order prohibits any transfer or dissipation of those assets while litigation proceeds. The exchange emphasized the civil action is independent of ongoing criminal investigations by U.S. law enforcement.
The scale of the loss
On February 21, 2025, Lazarus Group extracted roughly 400,000 ETH and stETH from Bybit’s wallets, a haul that accounted for the bulk of the $2.02 billion Chainalysis attributes to North Korean crypto theft last year. Since 2017, the same dataset puts total DPRK-linked crypto losses at $6.75 billion, proceeds widely assessed to fund the regime’s weapons programs.
Enforcement reality
A preliminary injunction is a procedural tool, not a recovery mechanism. It preserves specific assets the plaintiff has already traced to specific counterparties; it does not reach funds already moved through mixers, peeled chains, or off-ramped into fiat. Bybit’s release acknowledges the exchange will “look for further relief,” signaling the current freeze covers only a subset of the stolen pile.
What comes next
The case tests whether a U.S. civil court can create enforceable title over bearer instruments held by pseudonymous actors across jurisdictions that do not recognize the judgment. Service on a sovereign state that does not appear is symbolic; service on John Does who control private keys is practical only if they surface in a jurisdiction that honors the order. For investors, the precedent matters less than the recovery rate, and the source is silent on how much of the $1.5 billion has actually been located.