Bybit sues North Korea over $1.5B crypto theft, freezes assets

Bybit filed a civil complaint in U.S. federal court alleging the Democratic People’s Republic of Korea stole roughly $1.5 billion in cryptocurrency and moved the funds into wallets and accounts controlled by state-linked cyber actors. The exchange obtained a temporary restraining order that directs named custodians and intermediaries to hold the identified assets while the litigation proceeds.

The filing identifies a set of wallet addresses and custodial accounts that Bybit says trace back to the same actors and describes a pattern of transactions consistent with past laundering techniques tied to North Korean cyber groups. Bybit used blockchain analysis and transaction tracing to follow the flow of funds and to link specific holdings to the defendants, according to the complaint.

The court’s order bars transfers from the listed wallets and requires custodians to notify the court before taking any action that would move or dissipate the assets. The order covers the wallets and accounts detailed in the case documents and will remain in effect pending further hearings and discovery.

Bybit framed the lawsuit as an effort to recover stolen value for affected users and to stop further movement of the funds. In its filing the exchange said it will “pursue all available legal avenues to return misappropriated assets to their lawful owners” and reported it has notified law enforcement and is cooperating with investigators.

The complaint requests monetary relief, the return of the frozen assets and related tracing and repatriation measures. It does not seek criminal penalties in the civil action; criminal enforcement would proceed through separate government channels.

Legal practitioners noted that private civil suits have been used increasingly by exchanges and victims to identify and freeze crypto assets alleged to be stolen, often in parallel with criminal investigations and sanctions work. Recoveries in such cases depend on locating private keys or persuading custodial services to surrender funds under court authority.

U.S. authorities have previously accused North Korea of deploying state-sponsored cyber groups to steal cryptocurrency to finance government programs and have imposed sanctions on individuals and entities connected to those operations. The Bybit case will move into discovery, where the court and the parties will seek more information about the movement of funds and whether the asset freeze should be extended, modified, or converted into a final judgment ordering return of the assets.