Bybit Sues North Korea, Lazarus: Will It Pay Off?

Bybit is suing North Korea directly over February 2025's $1.5 billion hack, and this week a US federal court handed the exchange something no hacked crypto platform has gotten before: a judge who thinks the case can actually win. The suit itself isn't new — Bybit filed it under seal back on June 18 in a Washington, D.C. district court, naming North Korea, its Reconnaissance General Bureau, the Lazarus Group, and 20 unnamed "John Doe" defendants. What surfaced widely this week, via a PR Newswire release Saturday and a wave of syndication that began Friday, is a July 30 order in which the judge partially granted a preliminary injunction and found Bybit "likely to succeed on the merits." That's a nine-day-old ruling getting its first mass audience, not a fresh verdict — but the substance is real, and it's a legal first worth taking seriously.

Suing a sovereign state is normally a non-starter. The Foreign Sovereign Immunities Act blocks most lawsuits against foreign governments in US courts. Bybit's legal team routed around that wall using two of the law's narrow exceptions: the commercial-activity exception and the expropriation exception, arguing that once the stolen ether moved through exchanges with a US nexus, North Korea's theft became a traceable commercial act rather than a shielded sovereign one. Bybit paired that theory with civil RICO, Computer Fraud and Abuse Act, and Alien Tort Statute claims. A judge bought it far enough to grant expedited discovery in June, renew a temporary restraining order in mid-July, and then rule in late July that the sovereign-immunity workaround is likely to hold up. No US court has accepted this specific combination against a state-sponsored crypto hack before. That's the actual news: not that Bybit is angry at North Korea, but that a judge just certified a template other hacked platforms can now copy.

Here's where the story gets less triumphant. North Korea is not going to show up in a D.C. courtroom, hire a lawyer, or pay a judgment. The claim against the state itself is headed toward a default judgment — a paper win that produces zero dollars. The part of the case that can actually move money is different: the expedited discovery Bybit won against the John Doe defendants, the unnamed intermediaries and exchanges that touched the stolen funds. That mechanism lets Bybit subpoena compliant exchanges and custodians holding traceable ether, freeze it, and claw it back. It's the only lever in this whole case with a real payout attached, and it's the one doing the actual work.

The pace of that work is the uncomfortable number. As of this week, Bybit has recovered roughly $48.4 million and frozen another $30.5 million across more than 28 exchanges and custodians — about $79 million total, or roughly 5% of the $1.5 billion stolen. Over the past 51 days, that total grew by only about $3.4 million, which works out to a run rate near $66,700 a day. At that pace, recovering even a modest fraction of what's missing would take years, and the trend is working against Bybit: CEO Ben Zhou has previously said that within weeks of the hack, the traceable share of the stolen funds fell to about 68.6% as the untraceable, "gone dark" share climbed to 27.6% (with another 3.8% frozen), as Lazarus moved assets through mixers and OTC desks faster than investigators could follow. Laundering-disruption actions since the hack, including Germany's 2025 shutdown of the exchange eXch and a November 2025 Swiss-German takedown of Cryptomixer.io, have closed some of those channels, but the funds keep dispersing faster than the legal process traces them.

Bybit benefits regardless of how much cash actually comes back, because the ruling is a public accountability signal to users and regulators: the exchange sued the people who robbed it and got a court to take the claim seriously. Other hacked platforms benefit too, since this case is now a usable roadmap — file under seal, invoke the commercial-activity and expropriation exceptions, seek expedited discovery against the John Does, and let a judge decide if it's plausible. Prosecutors watching this may borrow the same route. On the losing side sits nobody who wasn't already losing: North Korea faces zero enforceable consequence beyond reputational noise, since it holds no US assets a court can seize. The real loser is anyone expecting a headline recovery number soon — the math doesn't support one.

The realistic base case is incremental, not dramatic. Expect the DPRK and RGB claims to grind toward an uncontested default judgment while the discovery subpoenas keep working through cooperative exchanges, adding low single-digit millions every few weeks rather than a step change. The bull case is that expedited discovery uncovers a concentrated pool of funds still sitting at a handful of compliant venues, and that other victims filing copycat suits pressures more exchanges into faster compliance. The bear case, and the one the data currently supports, is that North Korea never appears, the traceable share of funds keeps shrinking, and this ends as a symbolic judgment against a state that pays nothing — with the $1.5 billion mostly gone for good. Either way, the precedent outlives the payout: this is now the case every future crypto hack victim's lawyers will cite first.