Bybit secured a preliminary injunction in U.S. District Court for the District of Columbia freezing assets stolen in a $1.5 billion hack, according to a company announcement. The exchange sued North Korea and the Lazarus Group, the state-sponsored hacking outfit attributed to the attack.
The injunction order blocks movement of identified cryptocurrency held by defendants, a mechanism that requires a plaintiff to show likelihood of success on the merits and irreparable harm absent the freeze. Bybit claims the theft occurred in 2024 and traced the stolen funds across blockchain wallets and custodial accounts. The preliminary injunction is the first step in a civil asset recovery suit; it does not determine liability but prevents defendants from liquidating or moving the assets while litigation proceeds.
Bybit operates one of the world's largest cryptocurrency derivatives exchanges by trading volume. The $1.5 billion figure represents one of the largest single losses attributed to a state-backed actor in crypto history. The U.S. Treasury has previously sanctioned Lazarus Group and individuals tied to it over attacks on Sony Pictures, the Colonial Pipeline ransomware incident, and other intrusions. North Korea has denied involvement in cyber attacks, though U.S. intelligence agencies have long attributed major crypto thefts to the country's hacking operations.
Serving a foreign sovereign state and a shadowy hacking collective presents jurisdictional and enforcement challenges. Bybit would need to identify specific assets within U.S. jurisdiction or assets held at U.S.-regulated custodians to enforce the freeze effectively. The company named both North Korea as a state actor and Lazarus Group members as defendants, expanding potential liability theories.
Civil suits against foreign governments typically face sovereign immunity barriers; however, the Foreign Sovereign Immunities Act carves out exceptions for commercial activity and certain tortious acts. Bybit appears to be arguing the hack falls under one of these exceptions. Even with a court order, recovering frozen assets depends on the location of the funds and the willingness of custodians to comply with U.S. court authority.
The preliminary injunction is one of the few enforcement tools available to crypto companies against state-sponsored theft, since criminal prosecution requires either the defendant's voluntary appearance or extradition. Prior recovery efforts by exchanges and institutions have relied on law enforcement investigations, seizures of laundered proceeds, and international coordination through INTERPOL or financial intelligence units. Bybit did not disclose the identities of specific wallets or custodians holding the frozen assets in its announcement.
Whether Bybit can convert the frozen assets into actual recovery depends on the defendant's ability or willingness to appear in court and the extent to which stolen cryptocurrency is held at institutions subject to U.S. judicial authority. If the assets remain in decentralized wallets or move to unregulated venues, the order may freeze nothing.
