Bybit Unleashes RICO Lawsuit on North Korea Over $1.5B Hack

The company filed the civil lawsuit under seal on June 18, 2026, in the U.S. District Court for the District of Columbia. It became public this week. The suit names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group, the state’s notorious hacking unit, as defendants.

Hackers Exploit a Routine Transfer

The case centers on the theft of more than 400,000 Ethereum tokens on Feb. 21, 2025. Hackers struck during what looked like a routine transfer from one of Bybit’s cold, or offline, storage wallets. Investigators later determined attackers had compromised a developer’s computer at Safe{Wallet}, a type of multi-signature protocol Bybit used to manage its wallets, and inserted malicious code that activated only when Bybit’s specific wallet address appeared.

After the approval of what looked like a normal internal transfer, the hidden code altered the underlying transaction instead. That let attackers install a backdoor and drain the wallet in minutes.

Bybit Scrambles to Protect Customers

Bybit responded by covering more than $4 billion in customer withdrawal requests without freezing accounts, a move that helped preserve trust in the exchange during the crisis. The company also paid out $2.3 million through a bounty program that rewarded investigators for tracking the stolen funds.

Tracing that money has proven difficult. Attackers converted much of the ethereum into bitcoin and spread it across thousands of wallets using mixers, cross-chain bridges and unregulated trading platforms. By the time Bybit filed suit, the company said roughly 90% of the stolen assets had become untraceable.

North Korea’s Hacking Spree Grows

The theft was not an isolated case. Chainalysis, a blockchain analytics firm, found North Korean hackers stole about $2.02 billion in cryptocurrency in 2025 alone, a 51% jump from the year before. Researchers estimate the regime has stolen $6.75 billion in digital assets over time, funds U.S. officials say help finance its weapons programs.

Lazarus Group has targeted crypto platforms for years, including a $620 million theft from the Ronin bridge in 2022 and a $100 million hack of Harmony that same year. Bybit’s lawsuit argues these incidents form a pattern of organized racketeering, invoking the Racketeer Influenced and Corrupt Organizations Act, or RICO, along with the Computer Fraud and Abuse Act and the Alien Tort Statute.

Court Moves Fast to Freeze Funds

Bybit is seeking the return of its stolen funds, roughly $1.5 billion in damages, and additional punitive damages. The court has already moved on part of that request.

On June 19, a judge issued a temporary restraining order blocking the transfer of certain traceable assets. On July 30, the court partially granted a preliminary injunction freezing assets held by unidentified defendants tied to the stolen funds.

Recovery Efforts Yield Early Results

So far, Bybit has recovered about $48.4 million and frozen another $30.5 million across more than 28 exchanges and custodians. The company said its cooperation with investigators also helped German authorities shut down the exchange eXch and a joint German-Swiss operation take down the crypto mixer Cryptomixer.io.

Zhou described the hack as “an attack on trust in our industry” and said Bybit remains committed to pursuing the case alongside law enforcement.

What Comes Next

Legal experts will be watching how the court handles claims against a sovereign government, since collecting a judgment directly from the country of North Korea remains unlikely. The more immediate impact may come from the asset freezes and continued discovery, which could pressure intermediaries holding stolen funds to surrender them. Readers should watch for further court rulings in the case, additional asset recoveries, and any parallel action from U.S. criminal investigators as the litigation continues.