What exactly did Bybit win in court?

A preliminary injunction from the US District Court for the District of Columbia blocking defendants from moving or selling identified crypto tied to the February 2025 hack, per public court reporting.

Does the order freeze the full $1.5 billion?

No. Public court reporting describes the injunction as covering identified assets, without confirming the full stolen amount is inside the freeze.

Can a US court actually reach crypto held by North Korean actors?

Not directly. The order works by binding US-regulated intermediaries - exchanges, custodians, stablecoin issuers - who must refuse to process the flagged funds or face contempt exposure.

How does this fit with prior Lazarus recoveries?

Stablecoin issuers Tether and Circle have previously frozen addresses tied to Lazarus at the request of law enforcement. This ruling gives Bybit a civil basis to demand similar freezes on the specific wallets attached to its case.

Bybit Wins DC Court Injunction Against Lazarus Group Over $1.5B Hack

Q: Who are the named defendants?

The Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group hacking collective, plus unnamed parties covered by the injunction.

Bybit secured a preliminary injunction in the US District Court for the District of Columbia, blocking unnamed defendants from moving or selling crypto tied to the exchange's $1.5 billion hack, per public court reporting summarized by CryptoSlate on Friday. The exchange named the Democratic People's Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group hacking collective as defendants in the civil action.

By Elena Stojanović· AI-assisted· Regulation correspondent

What happened

Bybit filed the civil action in the US District Court for the District of Columbia, naming the Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group as defendants. The court granted a preliminary injunction blocking unnamed parties from moving or selling identified stolen crypto, per CryptoSlate's summary of the public court reporting.

The scope of the order covers assets that investigators have already traced. It does not confirm the full $1. 5 billion drained from Bybit's cold wallet earlier this year is inside the freeze.

The delta between the identified pool and the total loss is where the recovery story gets uncomfortable.

Why it matters

Crypto's founding pitch was irreversibility. That property protects users from chargebacks and censorship. It also protects thieves once funds move on-chain.

Bybit's suit is a stress test of how far a civil court can reach into that system. A US judge cannot claw back tokens sitting in a mixed wallet controlled by state-linked actors in Pyongyang. What the injunction can do is deputize regulated intermediaries.

Exchanges, custodians, market makers, and stablecoin issuers now hold a court order to freeze anything traceable to the identified addresses. Tether has previously blacklisted wallets tied to Lazarus at the request of US law enforcement, and USDC issuer Circle operates a similar freeze mechanism. That is the practical enforcement layer, not the Pyongyang defendants.

Bybit Wins DC Court Injunction Against Lazarus Group Over $1.5B Hack

What happened

Why it matters

Market impact

What to watch

Disclaimer

Key takeaways

Frequently asked

Sources