Bybit Just Sued North Korea Under a Law Written for the Mafia
You cannot serve a subpoena on Kim Jong Un. Bybit is betting that doesn't matter.
On August 7, the exchange announced it had filed a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group in the U.S. District Court for the District of Columbia, seeking the return of roughly $1.5 billion stolen in the February 2025 hack — still the largest crypto theft on record. The suit was filed under seal on June 18 and unsealed this week, alongside something far more interesting than the headline: a preliminary injunction freezing stolen assets held by a roster of unnamed "John Doe" defendants. Crypto asset recovery just moved from the blockchain forensics lab into a federal courtroom.
Most coverage has treated this as theater. A crypto exchange suing a nuclear-armed state that will never show up to court, never pay a judgment, never acknowledge the filing exists. That reading gets the story backwards.
The suit is aimed at the launderers, not the regime
Bybit is suing under the Racketeer Influenced and Corrupt Organizations Act, the 1970 statute Congress wrote to dismantle the Mafia. RICO was designed for exactly one thing: reaching an entire criminal enterprise through its network, rather than prosecuting each member for each act. You don't have to catch the boss. You map the organization, and everyone who knowingly participates in the pattern becomes liable for the whole.
That architecture fits North Korea's laundering operation almost perfectly. The regime's hackers don't cash out $1.5 billion themselves. The money moves through a supply chain — peel chains, cross-chain bridges, mixers, over-the-counter brokers in third countries, and eventually exchanges with weak controls. Each link takes a fee. Each link, under RICO, is a potential defendant.
Which is why the John Does are the real story. A judgment against Pyongyang is a trophy. An injunction that freezes assets in the hands of anyone downstream — and a discovery process that can compel exchanges, analytics firms, and infrastructure providers to name names — is a weapon.
The math explains the desperation
Bybit has recovered $48.4 million of the stolen funds so far. That is about 3% of what was taken. More than 90% of the remainder is now considered untraceable — washed through enough hops that even the best chain analytics lose the thread.
And the problem is compounding. Chainalysis found North Korean hackers stole about $2.02 billion in crypto in 2025 alone, a 51% jump over the previous year. The FBI attributed the Bybit theft specifically to TraderTraitor, the cluster of DPRK actors the industry calls Lazarus, within weeks of the hack. Attribution was never the hard part. Recovery was. Sanctions haven't stopped the thefts. Indictments of individual hackers who will never leave North Korea haven't stopped the thefts. So Bybit is trying the one tool nobody has seriously used at this scale: civil litigation with treble damages attached.
Skeptics are right that North Korea will never write a check. Concede that fully. But a default judgment does something subtler and more permanent than collection. It converts stolen coins into judicially recognized stolen property, with a paper trail any future claimant can cite.
A judgment makes the coins radioactive forever
Think about what happens to a specific tranche of ETH that a U.S. federal court has formally tied to the Lazarus enterprise. Any exchange that touches it now handles property subject to a court order. Any OTC desk that brokers it is arguably joining the racketeering pattern the judgment describes. The coins don't just carry taint scores from analytics firms — private opinions, contestable, quietly ignored when volume beckons. They carry a legal status.
That changes the economics of laundering. North Korea's model works because the discount on stolen crypto is modest; enough intermediaries will take clean-looking coins at 80 or 90 cents on the dollar. Push the legal risk high enough and the discount deepens until the theft itself yields less. You don't have to make stealing impossible. You have to make fencing miserable.
There's precedent for the strategy working in slow motion. Victims of terrorism have won multibillion-dollar default judgments against Iran and North Korea for decades, then spent years intercepting assets as they surfaced — frozen central bank funds, seized ships, blocked wire transfers. Recovery rates are low. They are not zero. And crypto, for all its borderlessness, surfaces value in ways ships never did: every coin must eventually pass through an on-ramp somebody regulates.
The uncomfortable lesson for everyone else
The Bybit hack was not a smart-contract exploit. Attackers compromised the interface around a routine transfer from an offline wallet, and signers approved a transaction that wasn't what it appeared to be. The most expensive theft in crypto history ran through humans and screens, not code.
That should reframe how projects think about their own treasuries. Teams still hold launch allocations, vesting reserves, and liquidity in setups that depend on a handful of people not being fooled on the wrong afternoon. Locking those assets with a third-party service like Team Finance, where release schedules are enforced by contract rather than by whoever is holding the keys during a phishing attempt, removes exactly the discretionary transfer surface that Lazarus has learned to attack. It won't stop a state-sponsored crew from targeting an exchange's hot infrastructure. It does mean a project's four-year vesting schedule can't be drained in one forged approval.
The industry's security spending has chased audits and bug bounties for years while the actual losses migrated to social engineering. North Korea noticed before most CISOs did.
Courts are becoming crypto infrastructure
Step back and a pattern emerges. In the past eighteen months, crypto disputes have produced asset freezes across dozens of jurisdictions, court-appointed receivers for collapsed protocols, and now a RICO action against a sovereign state. The industry that promised to route around institutions keeps discovering that its worst problems — theft, fraud, recovery — get solved by the oldest institution there is.
Purists will call that a betrayal of the premise. It's closer to a maturation. Property rights have never been self-enforcing; the blockchain records ownership, but only courts can make ownership mean something against a thief. Bybit's suit is an admission that finality of settlement and finality of justice are different things, and that a serious financial system needs both.
The suit also quietly raises the bar for every exchange that hasn't been hacked yet. Once civil recovery becomes a demonstrated playbook — sealed filing, John Doe injunction, discovery against the laundering chain — failing to run that playbook after a breach starts to look like negligence. Customers of the next victim will ask why their exchange didn't sue.
Bybit's case will grind on for years, mostly in silence, occasionally surfacing when a frozen wallet makes news. The regime in Pyongyang will keep hacking; $2 billion a year funds too much of its weapons program to abandon. But somewhere in the middle of that laundering supply chain sit people with names, bank accounts, and travel plans — brokers in Dubai, mixer operators with U.S. exposure, exchange executives who looked away. They are the ones who should read this filing carefully.
The first crypto lawsuit against a nation-state won't be the last. The more interesting question is who gets named when the John Does run out.