KoinlyticsBybit has sued the Democratic People's Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group in the US District Court for the District of Columbia over the February 2025 attack that drained $1.5 billion in digital assets. The court granted a preliminary injunction freezing identified stolen assets, finding that Bybit had demonstrated a likelihood of success on the merits.
The announcement came on August 8. The injunction prohibits the transfer or dissipation of identified assets connected to the case while litigation continues.
The Numbers So Far
- Roughly $48.4 million in stolen assets recovered
- More than $30.5 million frozen across over 28 exchanges and custodians
- Total stolen in the February 2025 incident: approximately $1.5 billion
That is a recovery and freeze rate of roughly 5% against the original theft, eighteen months after the fact. The figure is low in absolute terms and high relative to what North Korean attributed thefts have historically returned, which is close to nothing.
The Legal Architecture
The interesting part is not the claim against North Korea, which is largely symbolic given that a sovereign state does not appear to answer a civil summons. It is the John Doe defendants.
Bybit named unidentified individuals and entities currently holding or moving the stolen funds. That structure lets the court reach the actual custodians of the assets without knowing who they are, which is exactly the situation blockchain forensics produces: you can identify an address and its transaction history with certainty while knowing nothing about the person controlling it.
An injunction against a John Doe address is enforceable in practice because it binds the regulated intermediaries. Any exchange or custodian receiving those funds now has notice of a federal court order, which converts a discretionary compliance decision into a legal exposure. That is the mechanism doing the work here.
Why This Is Genuinely New
Stolen crypto recovery has historically depended on the goodwill of centralised venues and on attackers making mistakes. Both are unreliable. A civil judgment creates a different lever:
- It gives exchanges legal cover for freezing, rather than requiring them to accept the liability of freezing a customer's assets on a private request
- It applies to future movement, so funds that surface years later are already covered
- It establishes a precedent other victims can cite, which matters more than this specific recovery
The theft was permissionless. The laundering is not. Every point where stolen crypto touches a regulated venue is a point where a court order has teeth, and that is the entire strategy.
The Limits
None of this recovers funds that have already been laundered through mixers, converted to Monero, or moved through jurisdictions that do not recognise US court orders. North Korean operations have become notably more sophisticated at exactly this since 2022, and the 5% recovery figure reflects that.
It also does not address the entry point. The February 2025 attack succeeded through a compromise of the signing process rather than a break in the exchange's cold storage cryptography, which is the same category of failure that has produced most of 2026's large incidents: the Coldcard entropy flaw, the BTCPay credential theft, the bridge exploits that took $35 million in six hours. The pattern is credentials and processes, not mathematics.
What to Watch
- Whether the injunction produces additional freezes now that venues have a court order to point to
- Whether other exchanges with outstanding North Korean attributed losses file similar suits
- How courts treat John Doe crypto defendants going forward, which determines whether this becomes a template
- Any default judgment against the DPRK entities, which would be symbolically significant and practically limited
- Whether the recovery figure moves materially above $48.4 million
For anyone holding funds on an exchange, the practical lesson is unchanged and unglamorous. Recovery after a venue-level compromise depends on litigation, jurisdiction and years of process, and it returns a fraction. The exposure you can actually control is how much sits on any single venue at any given time, and that is a number worth knowing precisely rather than approximately.