What happened
Bybit filed the civil action in the US District Court for the District of Columbia, naming the Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group as defendants. The court granted a preliminary injunction blocking unnamed parties from moving or selling identified stolen crypto, per CryptoSlate's summary of the public court reporting.
The scope of the order covers assets that investigators have already traced. It does not confirm the full $1. 5 billion drained from Bybit's cold wallet earlier this year is inside the freeze.
The delta between the identified pool and the total loss is where the recovery story gets uncomfortable.
Why it matters
Crypto's founding pitch was irreversibility. That property protects users from chargebacks and censorship. It also protects thieves once funds move on-chain.
Bybit's suit is a stress test of how far a civil court can reach into that system. A US judge cannot claw back tokens sitting in a mixed wallet controlled by state-linked actors in Pyongyang. What the injunction can do is deputize regulated intermediaries.
Exchanges, custodians, market makers, and stablecoin issuers now hold a court order to freeze anything traceable to the identified addresses. Tether has previously blacklisted wallets tied to Lazarus at the request of US law enforcement, and USDC issuer Circle operates a similar freeze mechanism. That is the practical enforcement layer, not the Pyongyang defendants.