I. From a USD 1.5 Billion Crypto Theft to a Federal Lawsuit Against North KoreaHow a Single Hack Escalated into a National Security Matter
On February 21, 2025, Bybit was attacked while carrying out a routine transfer from an Ethereum cold wallet. More than 400,000 ETH and related staking assets were transferred out, worth approximately USD 1.5 billion at the time, making this one of the largest crypto theft incidents in the industry to date.
The attackers did not directly compromise the private keys of Bybit's cold wallet. Instead, they gained access to a Safe{Wallet} developer's device, altered the transaction interface and generated a disguised malicious transaction. What the signers saw was an ordinary transfer, but the logic of the transaction they actually signed had been tampered with.
After the theft, the attackers quickly split the assets across a large number of wallet addresses and moved them across multiple blockchains through token swaps, cross-chain bridges, mixing tools and trading platforms. Although the fund trail is recorded on the public ledger, as the assets were repeatedly split, converted and moved across chains, the identity of those controlling them and their subsequent flows became increasingly difficult to identify.
Five days later, the U.S. Federal Bureau of Investigation (FBI) formally attributed the attack to North Korea and referred to the relevant North Korean cyber actors as "TraderTraitor." The FBI also published a set of associated addresses and called on exchanges, cross-chain bridges, blockchain analytics firms, DeFi service providers and other virtual asset service providers to block the relevant transactions.
At this point, the incident was no longer merely a major security breach suffered by one exchange; it was brought within the U.S. enforcement framework targeting state-sponsored cyberattacks, virtual asset theft and sanctions evasion by North Korea.
From Industry Collaboration to Federal Litigation
After the attack, Bybit dealt with user withdrawals and liquidity issues while working with blockchain analytics firms, exchanges, custodians and law enforcement agencies in multiple countries to continue tracing the stolen assets. As of the time it announced the litigation, approximately USD 48.4 million had been recovered, and a further approximately USD 30.5 million had been frozen at more than 28 exchanges and custodial institutions.
However, on-chain tracing and voluntary industry collaboration alone could not resolve certain key questions: who has the authority to require platforms to freeze assets? How long can a freeze last? Who controls the anonymous wallets? After the assets have been exchanged and transferred multiple times, does Bybit still hold an enforceable claim for their return?
On June 18, 2026, Bybit filed a civil action under seal in the U.S. District Court for the District of Columbia, naming the Democratic People's Republic of Korea, the Reconnaissance General Bureau of North Korea, the Lazarus Group and several individuals and entities whose identities have not yet been ascertained as defendants. The case is captioned Bybit Technology Limited v. Democratic People's Republic of Korea et al., Case No. 1:26-cv-02173.
Bybit did not immediately make the litigation public; instead, while the case remained under seal, it first sought emergency relief. The court subsequently issued a temporary restraining order and, on July 30, 2026, partially granted a preliminary injunction prohibiting the relevant anonymous defendants from transferring, selling or otherwise disposing of the identified digital assets at issue. It was not until August 6 that portions of the case file were unsealed; on August 7, Bybit formally announced publicly that it had sued North Korea and the Lazarus Group.
Suing North Korea: What Is the Real Issue to Be Resolved?
Judging from the news headlines, this appears to be a rather dramatic lawsuit: a crypto asset exchange neither registered nor operating in the United States has come to a U.S. federal court to sue a sovereign state that is almost certain never to appear in court or satisfy a U.S. judgment.
But if attention is shifted from "whether North Korea will pay" to "how the stolen assets can be recovered," the strategic logic of this lawsuit begins to emerge: Bybit invoked the RICO Act, filed the case in the U.S. District Court for the District of Columbia, named the unknown controllers of the funds as anonymous John Doe defendants, and adopted a procedural arrangement of first filing under seal and applying for asset preservation before making the case public. These actions indicate that what Bybit is truly seeking may be not merely a monetary judgment against North Korea, but a legal engineering scheme designed around the recovery of digital assets.
Therefore, what is truly worth discussing in this case is not whether North Korea will appear in court or pay compensation, but how, when the attackers cannot be apprehended, are difficult to serve, and their assets are dispersed across blockchains worldwide, Bybit can design a lawsuit that gives the court a chance to control the assets the attackers left behind even if it cannot control the attackers themselves.
II. Why Choose RICO: Elevating a Single Attack into a Litigation Narrative of a Criminal Network
To understand Bybit's first litigation strategy, one question must first be answered: why did it choose to invoke the U.S. Racketeer Influenced and Corrupt Organizations Act, namely the RICO Act?
Limitations of Ordinary Theft or Tort Litigation
If Bybit had filed suit solely on grounds of theft, fraud, or unauthorized access to computers, the case would more easily be focused on the single attack that occurred on February 21, 2025, and its direct participants.
The problem is that the direct attackers may be located in North Korea, their identities are unknown, and they have almost no assets that can be directly enforced in the United States. Even if Bybit obtains a favorable judgment, it may not be able to recover much of the funds.
However, state-sponsored virtual asset theft is usually a complete industrial chain: from target selection, malware development, and wallet control, to asset splitting, cross-chain swaps, mixing, over-the-counter trading, and fiat currency exit, different stages may be carried out by different entities. In this chain, those who truly have a chance of being found, who have accounts that can be frozen, and who have assets that can be enforced are often the participants in the subsequent fund transfer and money laundering networks.
Therefore, Bybit needs a legal framework that can penetrate a single attack and cover the entire criminal chain. RICO offers exactly this possibility.
RICO focuses not on a single attack, but on the criminal organization behind it
RICO is the abbreviation of the Racketeer Influenced and Corrupt Organizations Act, commonly translated as the Anti-Racketeering and Bribery Organizations Act or the Anti-Organized Crime Act. This law was enacted in 1970 and was initially used primarily to combat the American Mafia. At the time, law enforcement agencies could often only catch low-level members who directly carried out murders, arson, or extortion, but found it difficult to reach the core figures behind the scenes who set the rules, allocated benefits, and directed the organization without personally committing crimes.
RICO addresses precisely this problem. It no longer asks only whether a particular person committed a particular crime, but further asks: Is there an organization that operates continuously? Do different participants divide labor and cooperate around a common purpose? Is a series of seemingly independent crimes in fact part of this organization's long-term operations? In other words, an ordinary tort lawsuit focuses on a single tree that has been cut down, whereas RICO seeks to prove that behind it there is a team that has been organized and cutting down the entire forest over the long term.
In this case, the legal narrative Bybit seeks to establish is that this was not an isolated hacker attack, but part of North Korea's continuous conduct of cyber intrusions, virtual asset theft, and money laundering through the Reconnaissance General Bureau, the Lazarus Group, and related facilitators. The focus of the case thus expands from who carried out this attack to who participated in operating or assisting in maintaining this criminal system.
What core elements must RICO prove?
To turn this narrative into a valid RICO claim, Bybit cannot merely prove that assets were stolen; it must also build an evidentiary chain around several core elements.
First, it must prove the existence of an enterprise within the meaning of RICO. An enterprise here is not necessarily a legally registered company; it may also be a group of individuals or entities that continuously collaborate for a common purpose. Bybit must prove that North Korea, the Reconnaissance General Bureau, the Lazarus Group, and related facilitators are not isolated from one another, but form an organizational network built around the theft and disposal of virtual assets.
Second, it must prove the existence of a pattern of racketeering activity. RICO targets not a single incidental violation, but a series of interrelated and continuous criminal acts. Therefore, Bybit cannot merely prove this attack; it must also explain its connection to other cyber thefts and to the subsequent continuous fraudulent, money-laundering, and fund-transfer activities.
Third, the relevant conduct must constitute a predicate offense listed in RICO, such as wire fraud, money laundering, and specified computer crimes.
Finally, it must also prove that the relevant defendant participated in the operation, management, or conspiracy of the criminal enterprise. On-chain records can clearly show where assets flowed from and to, but the fact that a certain wallet once received stolen assets only indicates the flow of funds; it cannot by itself prove that the person controlling the wallet knew the source of the assets, still less can it automatically prove that such person shared a common criminal purpose with the Lazarus Group. RICO requires the court to further determine who is behind the address, what that person knew, and what role that person played in the overall criminal network.
The recovery advantages and applicable risks brought by RICO
The first strategic value of RICO is that it expands liability from the direct attackers to the entire facilitation network.
For stolen assets to ultimately realize value, they usually still need to pass through intermediary wallets, cross-chain and exchange services, over-the-counter trading channels, exchanges, custodians, and fiat off-ramps. These entities may not have participated in the initial attack, but if they knew the source of the funds and continued to assist in transferring, concealing, or cashing out the assets, they may be brought within the scope of liability of the RICO enterprise or RICO conspiracy.
Therefore, the real target of RICO deterrence is not North Korea, which would never submit to a U.S. court in the first place, but rather the facilitators located outside North Korea who still rely on bank accounts, business licenses and the mainstream financial system.
The second strategic value of RICO is to increase potential liability.
The civil RICO regime allows a prevailing plaintiff, in principle, to seek treble damages and reasonable attorney's fees. Based on direct losses of approximately USD 1.5 billion, the theoretical damages could reach approximately USD 4.5 billion.
Of course, a theoretical damages amount does not equal an amount that is actually enforceable. However, treble damages would significantly change the risk calculus of peripheral participants—for intermediaries who assist in transferring funds, the legal consequences they face may no longer be limited to returning their fees or disgorging the funds they handled, but may instead involve being alleged to have participated in a criminal network and bearing damages and litigation defense costs far exceeding their own profits.
The third strategic value of RICO is to provide a legal framework for subsequently expanding the scope of defendants.
At the time of filing, Bybit may only be able to identify, through on-chain analysis, the wallet addresses that received or transferred the stolen assets. As the litigation proceeds, if the entities behind certain addresses are confirmed, or if the evidence shows that certain entities repeatedly participated in splitting, exchanging or laundering the funds, Bybit may attempt to add named defendants and further assert their participation in a RICO enterprise or conspiracy.
In other words, RICO is not only used to pursue already-identified attackers, but also provides Bybit with room to continuously trace the flow of funds and expand the network of liability.
However, RICO is both the most aggressive weapon in Bybit's litigation strategy and the most challenging legal claim.
Bybit is not a U.S. company, North Korea and Lazarus are also outside the United States, and the main attack and property losses have obvious foreign elements. The U.S. Supreme Court has made clear that a foreign plaintiff bringing a civil RICO action must prove that it suffered a "domestic injury." In Yegiazaryan v. Smagin in 2023, the Supreme Court further explained that the place where the injury occurred cannot be determined mechanically based solely on the plaintiff's residence, but should be assessed comprehensively in light of the rights involved in the injury, the target of the defendant's conduct and other specific circumstances. In this case, the mere fact that some network communications passed through U.S. servers, or that some stolen assets later entered U.S. trading platforms, does not automatically mean that Bybit suffered property injury within the United States. Bybit must answer a very critical question: why can digital asset losses suffered by a foreign exchange outside the United States be characterized as domestic injury within the United States?
In addition, the predicate offenses on which RICO relies, such as wire fraud, money laundering and computer crimes, must each also satisfy the requirements of U.S. law regarding extraterritorial application. Bybit cannot merely prove that North Korea has long engaged in hacking attacks; it must also establish a sufficiently specific connection between the relevant conduct and computers, communications, platforms, assets or injuries within the United States.
Bybit must also prove the relatedness and continuity between this attack and other crimes, and distinguish direct participants, knowing facilitators and third parties that unintentionally received the assets at issue. Otherwise, a complex on-chain fund path may not necessarily be redefined by law as a RICO criminal enterprise.
What does Bybit really want to accomplish through RICO?
Bybit invokes RICO not merely to seek a higher damages award, but to attempt to recast seemingly independent transactions as different stages of the same criminal enterprise—attackers can conceal their identities, wallets can be continually replaced, and assets can be transferred across chains, but so long as the entire process still requires a group of people to collaborate continuously, the law can attempt to reconnect these dispersed addresses, accounts, and service providers into a single "enterprise."
However, RICO primarily addresses the issue of the scope of liability under substantive law. Before that, there is another equally fundamental procedural issue: why can a foreign exchange bring a case involving an overseas digital asset theft to the door of a U.S. federal court, and why did it choose Washington, D.C.?
III. Why Choose Washington: The Jurisdictional Basis of Federal Courts and the Obstacle of Sovereign Immunity
Why do U.S. courts have the authority to hear the case? And why choose Washington? Here, two concepts must first be distinguished: jurisdiction and venue. Jurisdiction answers the question of "whether a U.S. court has the authority to hear this dispute"; venue answers the question of "even if a U.S. court has the authority to hear it, which particular federal district court should accept the case." Together, the two determine whether Bybit can transform an overseas digital asset theft into an asset recovery action in which U.S. courts can intervene.
Federal-law causes of action bring the case into U.S. federal court
On its face, the case's connection to the United States is not close. Bybit is not a U.S. company; North Korea, the Reconnaissance General Bureau, and Lazarus are all located outside the United States; and the hacking attack, wallet control, and principal property losses all have obvious foreign elements. The District of Columbia is neither the place where the attack occurred nor Bybit's place of incorporation or principal place of business.
But Bybit does not submit an overseas dispute to a U.S. court solely on the basis of ordinary theft or property tort. Its claims under RICO and the Computer Fraud and Abuse Act (CFAA), among others, are directly grounded in U.S. federal law. Generally speaking, so long as a plaintiff asserts a genuine and non-frivolous federal-law claim, a U.S. federal court may in principle accept the case on the basis of "federal question jurisdiction"; related state-law claims based on the same set of facts may also be heard by the federal court together with those claims.
Thus, RICO and the CFAA serve a dual function in this case: substantively, they constitute the legal basis on which Bybit pursues liability against the relevant entities; procedurally, they make the case a U.S. federal-law dispute, providing the subject-matter jurisdictional basis for entry into U.S. federal court.
However, obtaining this procedural entry point does not mean that the federal-law claims asserted by Bybit will necessarily succeed. Because the plaintiff, the principal defendants, the attack conduct, and the property losses all have obvious foreign elements, the court must further determine whether RICO and the CFAA can apply to the relevant conduct, whether Bybit can prove the domestic U.S. injury required by RICO, and whether the relevant claims have the connection to the United States required by law.
Federal question jurisdiction also only answers whether a court may in principle hear "this type of dispute"; it does not automatically resolve whether the court may hear claims against each individual defendant. With respect to North Korea and its state organs, the court must also examine foreign sovereign immunity; with respect to Lazarus members and anonymous wallet controllers, personal jurisdiction and other procedural conditions must be assessed separately.
The foreign state defendants constitute Washington's venue connection
Bybit's choice of the U.S. District Court for the District of Columbia, located in Washington, D.C., is first related to the special status of the defendants.
The defendants in this case include North Korea, a foreign state, and the Reconnaissance General Bureau, which Bybit describes as a state organ of North Korea. Subject to the jurisdictional conditions set out in the U.S. Foreign Sovereign Immunities Act (FSIA), and in accordance with the rules governing venue, certain actions brought against a foreign state or a political subdivision of a foreign state may be heard in the U.S. District Court for the District of Columbia. This provides Bybit with a relatively direct statutory basis for venue in Washington.
In addition, this court has long handled cases involving foreign sovereignty, national security, international sanctions and foreign state assets, and has accumulated substantial experience with issues such as FSIA jurisdiction, service of process, default proceedings and enforcement of judgments.
Moreover, the U.S. Department of State, the Department of the Treasury, the Department of Justice, FBI headquarters and the Office of Foreign Assets Control (OFAC) are all located in Washington, D.C. The U.S. government had previously brought North Korea within its sanctions regime, listed the Reconnaissance General Bureau and the Lazarus Group within the scope of relevant sanctions, and has on multiple occasions taken criminal prosecution and asset recovery measures against North Korea-related hacking activities. The FBI has also expressly and publicly attributed the Bybit theft to North Korea, published wallet addresses associated with the attack, and called on the industry to block the relevant transactions.
These administrative attributions, sanctions decisions and enforcement actions cannot replace the evidence Bybit must present in civil litigation, but they can enable the court to understand this case against a relatively mature national security and sanctions background, rather than treating it as an isolated ordinary property dispute between a foreign exchange and a group of unidentified hackers.
Therefore, Washington, D.C. is not the place closest to the facts of the attack, but it may be the judicial forum best suited to handling foreign sovereignty, federal enforcement and cross-border recovery issues in a concentrated manner.
Choosing Washington does not bypass foreign sovereign immunity
Under the FSIA, foreign states are in principle entitled to sovereign immunity. U.S. courts may exercise jurisdiction over them only where the case falls within an expressly provided statutory exception. The fact that North Korea is subject to comprehensive sanctions and is designated by the United States as a state sponsor of terrorism does not mean that it loses sovereign immunity in U.S. courts.
The FSIA does provide a "state-sponsored terrorism exception," but that exception typically applies to torture, extrajudicial killing, hostage taking, aircraft sabotage, and personal injury or death caused by material support for such acts. What Bybit suffered is loss of digital assets and property, which is not the most typical situation covered by that exception.
The commercial activity exception likewise presents obstacles. In determining whether an act constitutes commercial activity, the focus is not on whether it involves assets of economic value, but on whether the foreign state acted as an ordinary market participant when carrying out the act. Hacking organized by a state intelligence agency is generally closer to sovereign, military or intelligence activity than to commercial activity carried out by an ordinary market participant. The fact that the stolen subject matter was ETH of enormous value does not automatically convert the hacking into commercial activity.
The non-commercial tort exception generally requires a strong U.S. territorial nexus with respect to the tortious conduct and the injury. If the hacking, wallet control and direct property loss occurred primarily outside the United States, Bybit will need to overcome the territorial limitations contained in that exception.
Therefore, the U.S. government's sanctions against North Korea and the FBI's attribution of the attack to North Korea can strengthen Bybit's factual narrative, but they cannot automatically overcome foreign sovereign immunity. Bybit must still establish that the case falls within a specific FSIA exception, which is likely to be the main legal obstacle it faces in seeking to hold North Korea directly responsible, and which also means that this case cannot rest all hope of recovery on North Korea as the nominal defendant.
The court's ability to exercise control over different defendants and assets is not the same
The defendants in this case are not an indivisible whole. The court may reach different jurisdictional determinations with respect to different defendants, different legal claims and different requests for relief.
With respect to North Korea and the Reconnaissance General Bureau, which may be found to be a foreign state organ, the core issue is the FSIA and its exceptions to sovereign immunity. If the applicability of a statutory exception cannot be established, proceedings against these state entities may be subject to limitation.
As for Lazarus members, participants in the money-laundering network and other non-state entities, the issue shifts primarily to personal jurisdiction. Bybit needs to establish that these entities have sufficient legal connections with the United States, for example whether they used computers, communications facilities, trading platforms or financial services located in the United States, whether they carried out the relevant conduct in or directed at the United States, and whether U.S. federal law provides a corresponding basis for service and jurisdiction.
As for the anonymous John Doe defendants, Bybit must first gradually ascertain their identity, location and connections with the United States through on-chain analysis, account information and discovery. A wallet address may serve as a starting point for investigation, but it cannot by itself answer whether the court has jurisdiction over the person controlling the address behind it.
On the other hand, whether the court can exercise jurisdiction over a defendant and the actual effect of a court order on the movement of assets are two questions at different levels.
If the assets remain in non-custodial wallets controlled by the attackers, the court may prohibit the relevant defendants from disposing of the assets, but it may not necessarily be able, as a technical matter, to directly prevent them from continuing to transfer the assets. If the assets enter centralized trading platforms or custodial institutions, those institutions may have the ability to restrict withdrawals from the accounts; if the assets are converted into stablecoins with freeze functions, the issuer may also be able to restrict transfers or redemptions from the relevant addresses where the conditions are met.
These platforms, custodial institutions or issuers do not automatically assume an obligation to return the assets merely because they are technically capable of freezing them. The court must still consider their location, legal status, procedural position in the case and whether the relevant orders can take effect against them. However, every centralized node that can identify, restrict or dispose of assets may become an important connection point for Bybit to establish investigation, preservation and enforcement capabilities.
This is precisely the key to Bybit's jurisdictional strategy: precisely because the court's control over persons and its influence over the movement of assets are not fully synchronized, even if the court finds it difficult to directly control the attackers located in North Korea, it may still follow the flow of funds to find the real-world nodes they touch, such as platforms, accounts and service institutions, and thereby impose a certain degree of constraint on the assets involved.
However, for a court order to bind the relevant entities and lay the foundation for subsequent default proceedings and enforcement of judgment, Bybit still needs to resolve the issues of notice and service in accordance with law. North Korea will not voluntarily sign for a summons, Lazarus has no publicly known office address, and the true names of the anonymous wallet controllers cannot even be determined. Thus, after jurisdiction, this case immediately faces a question with more Web3 characteristics: when a defendant is identified only by an on-chain address, with no name, nationality or real-world contact information, how should the court ascertain identity and complete service?
