Bybit, the world's second-largest cryptocurrency exchange by trading volume, filed a civil lawsuit on June 18, 2026, in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Gr...
"The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry." — Ben Zhou, Co-founder and CEO, Bybit
Bybit, the world's second-largest cryptocurrency exchange by trading volume, filed a civil lawsuit on June 18, 2026, in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group. The suit, filed under Case No. 1:26-cv-02173-JDB, invokes the Racketeer Influenced and Corrupt Organizations Act (RICO), the Computer Fraud and Abuse Act, and the Alien Tort Statute to pursue the return of $1.5 billion in Ethereum stolen during a February 21, 2025, cyberattack — the largest single cryptocurrency theft in history.
The court granted a temporary restraining order on June 19, 2026, renewed it on July 16, and awarded a partial preliminary injunction on July 30, finding that "Bybit has demonstrated a likelihood of success on the merits." Approximately $78.9 million — 5.26% of the stolen funds — has been recovered or frozen across more than 28 exchanges and custodians as of August 8, 2026. Roughly 90.2% of the stolen assets remain untraceable.
The case is the first instance of a private cryptocurrency exchange suing a sovereign nation under RICO for a cyberattack. It raises unresolved questions about sovereign immunity, enforceability of judgments against state actors, and the practical limits of on-chain asset recovery when laundering infrastructure operates faster than the legal system.
On February 21, 2025, attackers compromised Bybit's systems during a routine cold wallet transfer, extracting more than 400,000 ETH and stETH valued at approximately $1.5 billion. The FBI attributed the operation to a DPRK-linked cluster it designates "TraderTraitor," part of the broader Lazarus Group apparatus.
The stolen funds were rapidly dispersed through mixers, cross-chain bridges, and over-the-counter dealers. Within the first 48 hours, Bybit reported $42.89 million frozen through industry cooperation. By March 4, 2025, CEO Ben Zhou stated that roughly 3% of stolen funds had been frozen or recovered. That figure moved to 3.84% by April 21, 2025, and reached 5.3% ($75.5 million) by the time Bybit filed its lawsuit on June 18, 2026 — approximately 16 months after the theft.
The Bybit breach accounted for 74% of the $2.02 billion in cryptocurrency stolen by DPRK-linked actors throughout 2025, according to Chainalysis data.
Bybit filed its complaint under seal on June 18, 2026. The case names four categories of defendants:
The exchange pursues three primary legal theories:
Bybit seeks return of the stolen funds, compensatory damages of approximately $1.5 billion, punitive damages, and treble damages under RICO.
Suing a sovereign state in U.S. court requires navigating the Foreign Sovereign Immunities Act (FSIA), which presumptively blocks such actions. Bybit's complaint engineers around the immunity shield through two FSIA exceptions:
The practical enforceability problem is straightforward: North Korea does not recognize U.S. court jurisdiction and holds no known attachable assets within the United States. A judgment, if obtained, would function primarily as a legal framework to compel third-party custodians — exchanges, mixers, and OTC desks — to freeze and return identifiable funds. The court's preliminary injunction already operates on this principle, binding unnamed custodians rather than the DPRK itself.
The recovery data, drawn from Bybit's own court filings and public statements, presents a stark picture:
| Date | Amount Frozen/Recovered | Percentage | Source | |------|------------------------|------------|--------| | Feb 23, 2025 | $42.89M | 2.86% | Bybit timeline | | Mar 4, 2025 | ~$45M | ~3.0% | CEO Zhou update | | Apr 21, 2025 | ~$57.6M | ~3.84% | CEO Zhou update | | Jun 18, 2026 | $75.5M | 5.3% | Court complaint | | Aug 8, 2026 | $78.9M | 5.26% | Press release |
The breakdown as of August 8: $48.4 million classified as "recovered" and $30.5 million "frozen" across more than 28 exchanges and custodians.
The trajectory raises questions about the lawsuit's practical impact on recovery. In the 51 days between the June 18 filing and the August 8 disclosure, the combined frozen/recovered total increased by approximately $3.4 million — a rate of roughly $66,700 per day. The pre-filing recovery rate was approximately $67,900 per day, according to analysis of the court filings. The pace, in other words, has not measurably changed.
At the current rate, clearing the remaining $1.42 billion would require approximately 58 years. The constraint is not legal but operational: Lazarus Group's laundering infrastructure processed the bulk of the stolen funds through mixers, cross-chain bridges, and OTC desks within the first weeks after the theft. By the time the lawsuit was filed 16 months later, 90.2% of the assets had been rendered untraceable.
The Bybit hack is one data point in a larger pattern. DPRK-linked actors have stolen an estimated $6.75 billion in cryptocurrency cumulatively, according to Chainalysis. Key operations include:
In the first four months of 2026 alone, North Korean hackers accounted for 76% of all crypto hack losses globally — $577 million out of $759 million total. The operation is not opportunistic. According to U.S. government assessments, stolen cryptocurrency funds North Korea's nuclear and ballistic missile programs. A nation locked out of the global financial system has converted crypto theft into a core instrument of statecraft.
DPRK-linked actors stole approximately $2.02 billion in cryptocurrency in 2025, a roughly 51% year-over-year increase over 2024.
The lawsuit operates alongside parallel law enforcement actions. Two infrastructure disruptions directly tied to the Bybit case:
Bybit states it is cooperating with the FBI and sharing blockchain intelligence findings. The exchange also operates a bounty program that has incentivized some third-party recovery efforts, though the program's aggregate contribution to the $78.9 million total is not publicly disclosed.
These actions demonstrate that legal and law enforcement tools can disrupt laundering channels, even when direct recovery of funds proves difficult. The eXch takedown, in particular, eliminated a node that had processed a material portion of the stolen assets — though by the time it was shut down, the funds had already transited through the exchange.
The Bybit case sits within a broader context of low crypto theft recovery rates. According to data compiled by Global Ledger and Chainalysis:
Bybit's 5.26% recovery rate is roughly in line with industry averages for state-sponsored attacks, where laundering infrastructure is sophisticated and fast-moving. Protocol-level exploits that involve DeFi smart contracts sometimes achieve higher recovery rates — the KelpDAO incident, for instance, saw full collateralization restored through a coordinated DeFi response ("DeFi United"), with Lido Finance, EtherFi, and Aave founder Stani Kulechov organizing to cover the shortfall.
The distinction matters: decentralized recovery mechanisms can sometimes outperform legal ones when the exploit involves on-chain assets that can be reissued or recollateralized. State-sponsored theft that moves assets off-chain through mixers and OTC desks does not offer the same recovery vectors.
Bybit's RICO lawsuit establishes a legal precedent regardless of whether meaningful recovery follows. A private company has persuaded a U.S. federal court that a pattern of state-sponsored cryptocurrency theft constitutes racketeering, meriting an injunction against unnamed custodians worldwide. The court's finding of "likelihood of success on the merits" signals that RICO's broad framework can, in principle, reach sovereign cyber operations.
The practical question is whether legal tools can keep pace with laundering infrastructure. The data suggests they cannot — at least not on the timeline required. With 90.2% of the $1.5 billion already untraceable and the daily recovery rate holding steady at $66,700 regardless of the lawsuit's existence, the case functions more as deterrence architecture than recovery mechanism. Its value lies in creating legal obligations for custodians who handle identifiable stolen funds, raising the cost of laundering for future operations, and generating a public record that links DPRK state apparatus to specific financial crimes.
For the cryptocurrency industry, the Bybit case underscores a structural asymmetry: the speed of on-chain laundering exceeds the speed of legal and forensic response. Until that gap narrows — through faster cross-border coordination, real-time asset freezing capabilities, or mandatory compliance requirements for exchanges — recovery rates for state-sponsored attacks are likely to remain in the single digits.