Bybit Files RICO Lawsuit Against North Korea Over $1.5 Billion Hack

Cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea in a U.S. federal court over last year’s record-breaking $1.5 billion hack. The suit, filed under seal on June 18, 2026, in the U.S. District Court for the District of Columbia, names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group as defendants. It became public this week.

The hack occurred on February 21, 2025, when attackers stole over 400,000 Ethereum tokens during a routine transfer from one of Bybit’s cold storage wallets. Investigators determined that hackers compromised a developer’s computer at Safe{Wallet}, a multi-signature protocol used by Bybit, and inserted malicious code. This code remained dormant until Bybit’s specific wallet address appeared, then altered the underlying transaction during an internal transfer, allowing attackers to drain the wallet within minutes.

In response, Bybit covered over $4 billion in customer withdrawal requests without freezing accounts, preserving trust. The company also paid $2.3 million in bounties to track stolen funds. However, tracing proved difficult as attackers converted most ether into bitcoin and distributed it across thousands of wallets using mixers, cross-chain bridges, and unregulated platforms. By the time Bybit filed suit, roughly 90% of the stolen assets had become untraceable.

The theft is not isolated. Blockchain analytics firm Chainalysis found that North Korean hackers stole approximately $2.02 billion in cryptocurrency in 2025, a 51% increase from the previous year. Researchers estimate the regime has stolen $6.75 billion in digital assets over time, funds U.S. officials say support its weapons programs. Lazarus Group has also executed other high-profile hacks, including a $620 million theft from the Ronin bridge in 2022 and a $100 million Harmony hack that same year.

Bybit’s lawsuit invokes the Racketeer Influenced and Corrupt Organizations Act (RICO), the Computer Fraud and Abuse Act, and the Alien Tort Statute, seeking the return of stolen funds, approximately $1.5 billion in damages, and additional punitive damages. On June 19, a judge issued a temporary restraining order blocking transfer of certain traceable assets. On July 30, the court partially granted a preliminary injunction freezing assets held by unidentified defendants linked to the stolen funds.

So far, Bybit has recovered about $48.4 million and frozen another $30.5 million across more than 28 exchanges and custodians. Cooperation with investigators also aided German authorities in shutting down the exchange eXch and a joint German-Swiss operation against the mixer Cryptomixer.io. Bybit CEO Zhou described the hack as “an attack on trust in our industry,” emphasizing the company’s commitment to pursuing the case alongside law enforcement.

Legal experts will watch how the court handles claims against a sovereign government, as direct collection from North Korea remains unlikely. Immediate impact may come from asset freezes and continued discovery, potentially pressuring intermediaries holding stolen funds to surrender them. Further rulings, asset recoveries, or parallel actions from U.S. criminal investigators could follow.

Source: https://news.bitcoin.com/crypto-news/bybit-unleashes-rico-lawsuit-on-north-korea-over-1-5b-hack/