Key takeaways:
- Bybit filed a U.S. civil suit accusing North Korea of stealing about $1.5 billion in cryptocurrency
- The exchange obtained a temporary restraining order freezing wallets and accounts linked to the theft
- The lawsuit seeks monetary relief and the return of the frozen assets, not criminal penalties
Bybit has filed a civil complaint in U.S. federal court alleging North Korea stole roughly $1.5 billion in cryptocurrency and moved the funds into wallets and accounts controlled by state-linked cyber actors, obtaining a court order to freeze the assets while the case proceeds.
The exchange identified a set of wallet addresses and custodial accounts in its filing that it says trace back to the same actors, describing a pattern of transactions consistent with past laundering techniques tied to North Korean cyber groups.
Bybit said it used blockchain analysis and transaction tracing to follow the flow of funds and link specific holdings to the defendants named in the complaint.
The court’s temporary restraining order bars transfers from the listed wallets and requires custodians to notify the court before taking any action that would move or dissipate the assets. The order will remain in effect pending further hearings and discovery.
What Bybit is seeking
Bybit framed the lawsuit as an effort to recover stolen value for affected users and halt further movement of the funds.
“Pursue all available legal avenues to return misappropriated assets to their lawful owners,” the exchange said in its filing, adding that it has notified law enforcement and is cooperating with investigators.
The complaint requests monetary relief, the return of the frozen assets and related tracing and repatriation measures.
It does not seek criminal penalties, since criminal enforcement in cases like this typically proceeds through separate government channels rather than private civil litigation.
A pattern of legal action against state-linked theft
In addition, legal practitioners say private civil suits have become an increasingly common tool for exchanges and victims to identify and freeze crypto assets alleged to be stolen, often running in parallel with criminal investigations and sanctions enforcement.
Recoveries in such cases typically hinge on locating private keys or persuading custodial services to surrender funds under court authority, a process that can take months or longer.
U.S. authorities have previously accused North Korea of deploying state-sponsored cyber groups to steal cryptocurrency to help finance government programs, and have imposed sanctions on individuals and entities linked to those operations.
The Bybit case will now move into discovery, where the court and the parties will gather more information about how the funds moved and whether the asset freeze should be extended, modified or converted into a final judgment ordering their return.