Bybit, a Dubai-based crypto exchange, is suing North Korea, its Reconnaissance General Bureau, the Lazarus Group, and unnamed wallet holders in Washington. The claims arise from the February 2025 theft of about $1.5B in Ether, which Bybit blames on North Korea. The court has frozen traceable funds in identified wallets, and the State Department is to serve the state defendants through diplomatic channels.
Latest development Aug 25, 2026
On August 25, 2026, the court clerk sent the summons, complaint, and notice of suit, with Korean translations, to the U.S. State Department. The department is to serve North Korea, its Reconnaissance General Bureau, and the Lazarus Group through diplomatic channels. Bybit said no carrier would deliver service papers to North Korea against a signed receipt.
Why it matters
Bybit is testing whether a U.S. court can help an exchange recover state-linked crypto theft by freezing anonymous wallets and giving notice by NFT. Any judgment against North Korea itself depends on service through diplomatic channels.
Background
On February 21, 2025, about $1.5B in Ether was taken from a Bybit cold wallet during a routine transfer. According to Bybit, attackers compromised a third-party developer’s workstation, entered Amazon Web Services infrastructure, and manipulated its transaction approval process. On February 26, 2025, the FBI publicly attributed the theft to North Korea, calling the activity TraderTraitor. Bybit says it absorbed the loss so that no customer lost funds, and that only about 5% of the stolen assets has been frozen or recovered.
Bybit filed suit under seal on June 18, 2026, in the U.S. District Court for the District of Columbia. Its 10 counts include claims under the Computer Fraud and Abuse Act and the Racketeer Influenced and Corrupt Organizations Act (RICO), violations of the law of nations, conversion, and fraud. The complaint names North Korea, its Reconnaissance General Bureau, the Lazarus Group, and 20 John Doe defendants. On June 19, 2026, Judge John D. Bates granted an ex parte temporary restraining order against the John Doe holders of wallets traced to the theft. The order also allowed expedited discovery. The judge relied on Bybit’s evidence alone and later extended the order twice.
Bybit gave the anonymous wallet holders notice by sending NFTs to each wallet. On July 30, 2026, the judge granted a preliminary injunction in part, barring transfers of assets traceable to the theft in the identified wallets. He found Bybit likely to succeed on the merits and held notice by NFT adequate. He excluded a wallet holding about $39,000 claimed by an Australian objector. Most of the roughly $37M at issue sat at Tether, which said it was not bound by the court’s orders but had frozen most of the funds voluntarily.
On August 6, 2026, the court unsealed the docket, except for filings that identify individual wallets. Bybit announced the lawsuit and the asset freeze publicly the next day. On August 25, 2026, the clerk sent the summons and complaint to the State Department under 28 U.S.C. § 1608(a)(4). The department is to serve the state defendants through diplomatic channels, after Bybit said no carrier would deliver the papers to North Korea. On October 8, 2026, Bybit said it had recovered about $48.4M and frozen a further $30.5M across more than 28 exchanges and custodians.
Timeline 13 events
-
OtherBybit reports partial recovery of stolen funds
Bybit said it had recovered about $48.4M and frozen a further $30.5M across more than 28 exchanges and custodians, out of the $1.5B stolen.
Bybit Is Suing North Korea Itself Over the Biggest Crypto Heist Ever
-
OrderClerk sends service papers for North Korea to the State Department
The papers went to the State Department under 28 U.S.C. § 1608(a)(4) for delivery through diplomatic channels, after Bybit said no carrier would deliver them to North Korea.
CourtListener docketBybit notice regarding service of process, August 19, 2026
-
OtherBybit publicly discloses lawsuit and asset freeze
Bybit announced the lawsuit and the court-ordered asset freeze in a public statement, days after the case was unsealed.
Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze
-
OrderCourt unseals the case but keeps wallet addresses sealed
Judge Bates directed the clerk to unseal the docket except for filings that identify individual wallets.
-
OrderCourt authorizes blockchain-based notice on anonymous wallet holders
Alongside the preliminary injunction, Judge Bates permitted Bybit to supplement service on unidentified wallet-holder defendants by delivering notice to their on-chain addresses.
Bybit sues North Korea and Lazarus Group, secures preliminary injunction freezing stolen assets in landmark crypto asset recovery effortBybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze
-
OrderCourt grants preliminary injunction finding Bybit likely to prevail
Judge Bates partially granted a preliminary injunction freezing identified stolen assets and found Bybit likely to succeed on the merits.
Bybit Is Suing North Korea Itself Over the Biggest Crypto Heist Ever
-
JudgmentCourt grants Bybit a preliminary injunction in part
Judge Bates barred transfers of assets traceable to the theft in the identified wallets, finding notice by NFT adequate. He excluded one wallet holding about $39,000 claimed by an objector.
Preliminary injunction order, July 30, 2026Memorandum opinion, July 30, 2026
-
OrderJudge Bates grants Bybit an ex parte restraining order
The order restrained the John Doe defendants from moving assets out of identified wallets and allowed expedited discovery. The judge later extended it twice.
-
FilingBybit files sealed civil RICO complaint
Bybit filed suit under seal in the U.S. District Court for the District of Columbia, alleging civil RICO violations and naming 20 unidentified John Doe wallet holders.
-
FilingBybit sues North Korea and the Lazarus Group under seal
The ten-count complaint in Washington also names the Reconnaissance General Bureau and 20 John Doe defendants, with claims including RICO and Computer Fraud and Abuse Act violations.
-
OtherFBI attributes the Bybit theft to North Korea
The FBI said North Korea was responsible for the theft and called the activity TraderTraitor.
-
OtherAttackers steal about $1.5B in Ether from Bybit
Attackers took roughly 400,000 Ether and staked Ether tokens from Bybit.
-
OtherAttackers take about $1.5B in Ether from Bybit
About 401,000 Ether were moved from a Bybit cold wallet to attacker-controlled wallets during what looked like a routine internal transfer.
Experimental AI forecast
How it is madeWill the court enter a default judgment against North Korea, its Reconnaissance General Bureau, or the Lazarus Group by June 30, 2028?
- Default judgment against North Korea45%
- Still pending on June 30, 202837%
- State defendants dismissed15%
- Bybit drops state defendants3%
- Resolves by
- Jun 30, 2028in 20 months
- Record confidence
- Low
A default judgment against North Korea or its agents is the most likely outcome by June 30, 2028, at 45%. North Korea will almost certainly not appear. The main risks are slow diplomatic service and whether the theft claims fit a sovereign immunity exception.
How it resolves. Resolves “Default judgment against North Korea” if, by June 30, 2028, the U.S. District Court for the District of Columbia enters a default judgment or other merits judgment for Bybit on any count against North Korea, the Reconnaissance General Bureau, or the Lazarus Group. Resolves “State defendants dismissed” if, before then, the court dismisses all claims against all three, for example on sovereign immunity or jurisdiction grounds, without entering such a judgment. Resolves “Bybit drops state defendants” if Bybit voluntarily dismisses all claims against all three. Otherwise resolves “Still pending on June 30, 2028.” Judgments only against John Doe wallet holders do not count.
Reasoning
Starting point. Suits against North Korea or other non-appearing foreign states in D.D.C. served under 28 U.S.C. § 1608(a)(4): Roughly 80-90% of properly served FSIA suits against non-appearing states with a clear immunity exception end in default judgment, typically 1-3 years after filing.
Foreign states that never appear in D.D.C. usually suffer default judgments once service is complete and the court finds an immunity exception, though the process often takes one to three years. Service went to the State Department on August 25, 2026, and diplomatic service on North Korea can take many months, followed by a 60-day answer period and an evidentiary showing under 28 U.S.C. § 1608(e). The court must confirm subject-matter jurisdiction on its own before any default against the state defendants. The record does not show which exception Bybit invokes, and a hacking theft fits uneasily within the commercial activity or terrorism exceptions. That gap drives the 15% dismissal estimate. The Lazarus Group may be treated as a non-sovereign actor, which could allow a judgment against it even if the state defendants are immune. The preliminary injunction finding that Bybit is likely to succeed supports the merits but addressed the John Doe wallet holders, not the state. The leading alternative is that service delays and evidentiary proceedings leave the case pending past mid-2028.
Pace of State Department diplomatic service on North Korea · Whether an FSIA immunity exception covers a cyber theft · North Korea’s near-certain non-appearance · Possible non-sovereign treatment of the Lazarus Group · Bybit’s focus on recovering frozen wallet assets
Generated automatically by Claude Opus 5.5 on Oct 18, 2026 from this case’s record on this site, and published without editorial review. The probabilities are the model’s judgment, not measured frequencies, and they are scored publicly as cases resolve. Not legal or investment advice. How the forecasts are made