CryptoSlate
Bybit filed suit against North Korea's Reconnaissance General Bureau and Lazarus Group in the US District Court for the District of Columbia and won a preliminary injunction blocking unnamed defendants from moving or selling stolen crypto tied to the February 2025 hack. The order arrived roughly 532 days after thieves pulled off the largest crypto theft on record. Industry coordination had already frozen $42.9 million in the days after the attack, and the mETH Protocol separately recovered about 15,000 cmETH worth nearly $43 million, putting early combined recoveries at roughly $85.9 million, or about 5.9% of the $1.46 billion stolen.
Why it matters
The injunction proves stolen crypto can still be stopped, just not on a predictable schedule. Chainalysis documents a consistent laundering pattern in which DPRK-linked groups move funds through exchanges, bridges, mixers, and laundering services over roughly 45 days, far faster than any court can move. Elliptic, citing a six-month review from zeroShadow, said more than $1 billion had already cleared the laundering pipeline well before Bybit filed suit, meaning whatever value the injunction protects now probably represents a small residue that never fully escaped the pipeline. The case also sets a template for victims of state-backed crypto theft: courts can reach crypto that lands at a chokepoint with a compliance team, but the window between hack and judgment is the difference between restitution and a write-off.
Market impact
The practical takeaway for the industry is that recovery math now runs on location, not ideology. Native ETH or BTC in self-custody is nearly impossible to freeze directly, while stablecoins sit at the other extreme because issuers can blocklist addresses by chain and contract. Centralized exchanges, bridges, swap services and DAO-controlled wallets fall somewhere in between, with OTC brokers operating across borders the hardest targets of all. A second fight is also brewing: holders of older terrorism judgments against North Korea already served a restraining notice on roughly 30,766 ETH (~$71 million) frozen after the unrelated Kelp exploit on Arbitrum, and the assets followed an Arbitrum DAO vote to an Aave-controlled wallet. Once DPRK-linked crypto lands somewhere reachable, other creditors line up to claim it. Chainalysis says North Korean hackers stole more than $2 billion in crypto in 2025 alone, a 51% jump year over year even as attack counts fell, with cumulative DPRK-linked theft now at $6.75 billion.
Frequently asked questions
-
How much of the $1.46B Bybit hack has actually been recovered?
Industry coordination froze $42.9 million in the days after the February 2025 attack, and mETH Protocol separately recovered about $43 million in cmETH, putting combined early recoveries at roughly $85.9 million, or about 5.9% of the stolen total.
-
Why did it take 532 days to get a court injunction?
Suing a state actor involves multi-year investigations, jurisdictional questions, and the multi-stage process of filing against the Reconnaissance General Bureau and Lazarus Group. Chainalysis data shows DPRK-linked groups launder funds through exchanges, bridges, mixers, and laundering services in about 45 days, far…
-
What kind of crypto is hardest to freeze after a theft?
Native ETH or BTC sitting in self-custody is the hardest target because no central party directly controls those balances. Stablecoins sit at the other end since issuers can blocklist addresses; centralized exchanges can freeze withdrawals or comply with warrants.
-
Could other creditors claim crypto tied to the Bybit hack?
Yes, the pattern is already established. Holders of older terrorism judgments against North Korea served a restraining notice on about 30,766 ETH (~$71 million) frozen after the Kelp exploit on Arbitrum, and the assets followed an Arbitrum DAO vote to an Aave-controlled wallet.
-
How much crypto has North Korea stolen in total?
Chainalysis says North Korean hackers stole more than $2 billion in crypto in 2025 alone, a 51% jump year over year even as attack counts fell. Cumulative DPRK-linked crypto theft has reached at least $6.75 billion.
CoinDesk
Crypto News
TheBlock
Crypto Rank News
WuBlockchain
CoinTelegraph
Lookonchain