Adversary Intelligence — 2026-08-09

US Court Freezes Stolen Crypto as Bybit Files Lawsuit Naming North Korea Reconnaissance General Bureau and Lazarus Group

BLUFA default judgment against Pyongyang is likely within 12 months but will do little to recover the bulk of $1.5 billion already laundered through non-cooperating exchanges.

Bybit filed a civil lawsuit under seal on June 18, 2026, in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the February 2025 theft of roughly $1.5 billion in ether, invoking RICO, the Computer Fraud and Abuse Act, and the Alien Tort Statute and seeking the funds' return along with compensatory damages of about $1.5 billion plus additional punitive damages 1234. On July 30 the court partially granted a preliminary injunction freezing assets held by unnamed John Doe defendants, finding Bybit had shown a likelihood of success on the merits 123. Bybit says it has recovered about $48.4 million and frozen another $30.5 million across more than 28 exchanges and custodians, for roughly $78.9 million of the loss recovered or frozen to date 124. Chainalysis estimates North Korean hackers stole at least $2.02 billion in cryptocurrency during 2025, a 51 percent rise over 2024 that brings the group's cumulative theft to $6.75 billion 134.

Analysis
A default judgment against North Korea, the Reconnaissance General Bureau, and the Lazarus Group is likely within the next 12 months. None of the named state defendants has appeared to contest the case, and sovereign or state-linked parties named in comparable U.S. asset-recovery suits routinely decline to appear, leaving default judgment procedurally straightforward once notice requirements are met. That assessment carries low confidence, reflecting the absence of any direct signal on DPRK's litigation posture beyond this established pattern of non-appearance. A default judgment would strengthen Bybit's legal claim to the frozen funds but would not itself compel custodian transfers, since enforcement against non-cooperating exchanges remains a separate process.

4 sources