Bybit sues North Korea over 1.5 billion dollar hack

Bybit filed a civil lawsuit in federal court in Washington on 7 August 2026 against the Democratic People’s Republic of Korea, the Reconnaissance General Bureau and the Lazarus Group. The case stems from the February 2025 attack, in which roughly 1.5 billion dollars (about €1.31 billion) in crypto was stolen from the exchange.

The judge granted a preliminary freeze on identified stolen funds held by parties who have yet to be named, referred to in the filings as John Doe. The ruling states that Bybit has shown it is likely to win the case on the merits.

Where the recovery stands

So far, roughly 48.4 million dollars (about €42.4 million) has actually been recovered and more than 30.5 million dollars (about €26.7 million) has been frozen, spread across more than 28 exchanges and custodians. Together that comes to around 5 percent of the amount stolen. Chief executive Ben Zhou said the commitment has not changed: protect users, recover what can be recovered and hold those responsible to account.

Two European links

For European readers, the most interesting part of this is not in Washington but closer to home. German authorities took the exchange eXch offline, and German and Swiss investigators shut down Cryptomixer.io. Both were used to move the proceeds on, according to the parties involved.

That is the pattern you tend to see in cases like this: the lawsuit produces the legal basis to freeze funds, but the actual interception is done by police forces that sit closer to the infrastructure. Without those German and Swiss operations, less would probably have been frozen.

What this does and does not mean

A preliminary freeze is not a final judgment. The judge ruled that Bybit has a reasonable chance, not that the case has been won. And suing a state is legally a different matter from suing a criminal network: with North Korea, sovereign immunity comes into play, and a ruling against a country that does not appear and holds no assets within reach is largely symbolic. The practical value lies in the freezing orders aimed at exchanges and custodians that can be reached.

That is what is new here. Two years ago this route barely existed; now a civil case yields an instrument that lets you have a single address locked down at twenty-eight platforms at once.

What this means for you

The practical point for you sits in those twenty-eight platforms. Freezing works because exchanges and custodians cooperate, and they can only do so for funds they hold themselves. Crypto you hold yourself falls outside that net — in both directions. If you are robbed, there is no party that can step in.

So choose deliberately. For amounts you actively use, a licensed exchange with a compliance department is a real advantage when something goes wrong. For amounts you want to hold for the long term, self-custody is stronger, provided you handle the keys properly. That is not a contradiction but a division.

And pay attention to where the funds you receive come from. Freezing orders hit addresses, not people. If crypto reaches you that once passed through a flagged route, your withdrawal can stall without you having done anything wrong.

Sources: Bybit (press release 7 August 2026), CoinDesk (7 August 2026), Crypto Briefing. Last checked: 8 August 2026.