This $1.5 billion hack is exposing just how ‘irreversible’ stolen crypto really is

Bybit sued North Korea, its Reconnaissance General Bureau, and Lazarus Group in the US District Court for the District of Columbia. The exchange won a preliminary injunction blocking unnamed defendants from moving or selling stolen crypto.

Public court reporting describes the order as covering those identified assets, without confirming the full $1.5 billion stolen in February 2025 or disclosing the dollar value the injunction protects.

This injunction landed roughly 532 days after the hack—about 17 months after North Korean hackers pulled off the largest crypto theft on record. Chainalysis tracked a consistent laundering pattern by DPRK-linked groups after a major theft, moving stolen funds through exchanges, bridges, mixers, and laundering services over roughly 45 days.

Coordinated action by industry partners froze $42.9 million in the first days after the theft, and mETH Protocol recovered another 15,000 cmETH, worth nearly $43 million. Combined, that early save came to about $85.9 million, roughly 5.9% of the $1.46 billion stolen.

Elliptic, citing a six-month review from zeroShadow, said more than $1 billion of the stolen funds had already moved through the laundering pipeline well before this new court order existed.

Whatever value the injunction protects now probably represents a small residue that never fully escaped that pipeline.

Why a blockchain never has to reverse anything

Stolen crypto becomes stoppable the moment it lands somewhere a court order can reach: an exchange, a stablecoin issuer, a custodian, or any other operator capable of freezing what passes through it.

That is why the FBI asked exchanges, bridges and RPC operators to block Lazarus-linked transactions within days of the hack. It is also why Bybit's own stolen stETH and cmETH were swapped into native ETH almost immediately.

Elliptic says token issuers can often freeze wallets holding their own tokens, but no central party directly controls ETH or Bitcoin balances. Converting stolen liquid-staking tokens into native ETH removes one of the easiest tools available to victims for freezing assets.

Native ETH or Bitcoin sitting in self-custody is nearly impossible to freeze directly, while stablecoins sit at the other end, since issuers can blocklist addresses depending on the chain and contract design.

Centralized exchanges sit close behind, able to block withdrawals or comply with a warrant. Bridges, swap services and DAO-controlled recovery wallets fall somewhere in between, and OTC brokers operating across borders remain the hardest targets of all.

A Lazarus-linked theft from the crypto platform Rain drew a similar response. The FBI froze roughly 2,204 SOL at the exchange WhiteBIT and served a seizure warrant. WhiteBIT transferred the funds to the US government, and a federal court later granted default judgment forfeiting the crypto outright.

A second fight brewing over who gets frozen funds

Holders of old terrorism judgments against North Korea served a restraining notice on roughly 30,766 ETH, worth about $71 million, that had been frozen when an unrelated exploit hit the Kelp protocol on Arbitrum.

Arbitrum's governance records show a DAO vote that later moved ETH to an Aave-controlled wallet, with the restraining notice accompanying the assets to their new location.

No public record shows that competing creditors have claimed the assets Bybit is now pursuing, though the Kelp episode establishes a real pattern. Once DPRK-linked crypto sits frozen somewhere reachable, other parties holding judgments against North Korea can try to get in line for it too.

The US Treasury Department designated Lazarus Group, Bluenoroff and Andariel in 2019 as entities controlled by North Korea through their ties to the Reconnaissance General Bureau. Treasury says the country's cyber operations generate revenue that can fund weapons and ballistic missile programs.

Chainalysis says North Korean hackers stole over $2 billion in crypto in 2025 alone, a 51% jump from the year before, even as the number of known attacks fell sharply.

Cumulative DPRK crypto theft has reached at least $6.75 billion, and the pattern points toward fewer, larger hits and away from a broad spray of small ones.

What happens to the crypto from here

The bull case is that more of the stolen $1.46 billion will turn up at reachable chokepoints than anyone currently expects.

Investigators trace additional funds held by exchanges, stablecoin issuers, bridges, or custodians willing to cooperate, and Bybit's injunction becomes a template other victims use to chase down DPRK-linked funds long into a hack's aftermath.

Recovery climbs meaningfully above the roughly $85.9 million secured so far, and courts prove that persistence still beats time even against a state-backed hacking operation.

The bear case is that the injunction covers only a small residual balance already trapped by ordinary compliance systems before Bybit filed suit.

Most of the $1.46 billion stays gone, laundered through the 45-day window Chainalysis describes long before any court could act.

The lawsuit proves that legal reach exists, but it also proves that a 17-month head start is nearly fatal to recovery, whatever it says about accountability.

Bybit's lawsuit is proving that the assets sitting at the end of one blockchain transaction can still be stopped, just not for free and never on a predictable schedule.