{"id":76540,"date":"2026-08-08T17:33:02","date_gmt":"2026-08-08T17:33:02","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/bybit-unleashes-rico-lawsuit-on-north-korea-over-1-5b-hack\/"},"modified":"2026-08-08T17:33:02","modified_gmt":"2026-08-08T17:33:02","slug":"bybit-unleashes-rico-lawsuit-on-north-korea-over-1-5b-hack","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/bybit-unleashes-rico-lawsuit-on-north-korea-over-1-5b-hack\/","title":{"rendered":"Bybit Unleashes RICO Lawsuit on North Korea Over $1.5B Hack"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Bybit sued North Korea and Lazarus Group over a $1.5 billion hack from Feb. 21, 2025.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">A U.S. court froze stolen assets on July 30 after Bybit filed suit on June 18, 2026.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Bybit has recovered $48.4 million so far, with over 90% of funds still untraceable.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p>The company filed the civil lawsuit under seal on June 18, 2026, in the U.S. District Court for the District of Columbia. <a href=\"https:\/\/www.courtlistener.com\/docket\/73727990\/bybit-technology-limited-v-democratic-peoples-republic-of-korea\/\" target=\"_blank\" rel=\"noopener noreferrer\">It became public this week<\/a>. The suit names the Democratic People\u2019s Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group, the state\u2019s notorious hacking unit, as defendants.<\/p>\n<h2>Hackers Exploit a Routine Transfer<\/h2>\n<p>The case centers on the theft of more than 400,000 Ethereum tokens on Feb. 21, 2025. Hackers struck during what looked like a routine transfer from one of Bybit\u2019s cold, or offline, storage wallets. Investigators later determined attackers had compromised a developer\u2019s computer at Safe{Wallet}, <a href=\"https:\/\/www.bitcoin.com\/get-started\/wallet-security\/wallets-custody\/shared-multisig-bitcoin-wallet\/\" target=\"_blank\" rel=\"noopener noreferrer\">a type of multi-signature protocol<\/a> Bybit used to manage its wallets, and inserted malicious code that activated only when Bybit\u2019s specific wallet address appeared.<\/p>\n<p>After the approval of what looked like a normal internal transfer, the hidden code altered the underlying transaction instead. That let attackers install a backdoor and drain the wallet in minutes.<\/p>\n<h2>Bybit Scrambles to Protect Customers<\/h2>\n<p>Bybit responded by <a href=\"https:\/\/news.bitcoin.com\/bybit-restores-77-of-assets-under-management-strengthens-security-after-hacking-incident\/\">covering more than $4 billion<\/a> in customer withdrawal requests without freezing accounts, a move that helped preserve trust in the exchange during the crisis. The company also paid out $2.3 million through a bounty program that rewarded investigators for tracking the stolen funds.<\/p>\n<p>Tracing that money has proven difficult. Attackers converted much of the ethereum into bitcoin and spread it across thousands of wallets using mixers, cross-chain bridges and unregulated trading platforms. By the time Bybit filed suit, the company said roughly 90% of the stolen assets had become untraceable.<\/p>\n<h2>North Korea\u2019s Hacking Spree Grows<\/h2>\n<p>The theft was not an isolated case. Chainalysis, a blockchain analytics firm, found <a href=\"https:\/\/www.chainalysis.com\/blog\/crypto-hacking-stolen-funds-2026\/\" target=\"_blank\" rel=\"noopener noreferrer\">North Korean hackers stole about $2.02 billion in cryptocurrency<\/a> in 2025 alone, a 51% jump from the year before. Researchers estimate the regime has stolen $6.75 billion in digital assets over time, funds U.S. officials say help finance its weapons programs.<\/p>\n<p><a href=\"https:\/\/news.bitcoin.com\/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit\/\">Lazarus Group has targeted crypto platforms<\/a> for years, including a $620 million theft from the Ronin bridge in 2022 and a $100 million hack of Harmony that same year. Bybit\u2019s lawsuit argues these incidents form a pattern of organized racketeering, invoking the Racketeer Influenced and Corrupt Organizations Act, or RICO, along with the Computer Fraud and Abuse Act and the Alien Tort Statute.<\/p>\n<h2>Court Moves Fast to Freeze Funds<\/h2>\n<p>Bybit is seeking the return of its stolen funds, roughly $1.5 billion in damages, and additional punitive damages. The court has already moved on part of that request.<\/p>\n<figure id=\"attachment_837928\" aria-describedby=\"caption-attachment-837928\" style=\"width:1600px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-837928\" class=\"wp-caption-text\">Bybit\u2019s press release on the subject.<\/figcaption><\/figure>\n<p>On June 19, a judge issued a temporary restraining order blocking the transfer of certain traceable assets. On July 30, the court partially granted a preliminary injunction freezing assets held by unidentified defendants tied to the stolen funds.<\/p>\n<h2>Recovery Efforts Yield Early Results<\/h2>\n<p>So far, <a href=\"https:\/\/x.com\/benbybit\/status\/2085969090225815768?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">Bybit has recovered about $48.4 million<\/a> and frozen another $30.5 million across more than 28 exchanges and custodians. The company said its cooperation with investigators also helped German authorities shut down the exchange eXch and a joint German-Swiss operation take down the crypto mixer Cryptomixer.io.<\/p>\n<p>Zhou described the hack as \u201can attack on trust in our industry\u201d and said Bybit remains committed to pursuing the case alongside law enforcement.<\/p>\n<h2>What Comes Next<\/h2>\n<p>Legal experts will be watching how the court handles claims against a sovereign government, since collecting a judgment directly <a href=\"https:\/\/news.bitcoin.com\/g7-calls-for-global-push-to-stop-north-koreas-crypto-theft-network\/\">from the country of North Korea<\/a> remains unlikely. The more immediate impact may come from the asset freezes and continued discovery, which could pressure intermediaries holding stolen funds to surrender them. Readers should watch for further court rulings in the case, additional asset recoveries, and any parallel action from U.S. criminal investigators as the litigation continues.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/crypto-news\/bybit-unleashes-rico-lawsuit-on-north-korea-over-1-5b-hack\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Bybit sued North Korea and Lazarus Group over a $1.5 billion hack from Feb. 21, 2025. A U.S. court froze stolen assets on July 30 after Bybit filed suit on June 18, 2026. Bybit has recovered $48.4 million so far, with over 90% of funds still [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":76541,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/76540"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=76540"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/76540\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/76541"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=76540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=76540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=76540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}