Precedent: the crypto exchange that demands 1.5 billion dollars from North Korea

The suit, filed in federal court in the District of Columbia in Washington, marks the first time in history that a private commercial entity in the crypto industry has directly sued a sovereign state for a cyber attack and theft of digital assets. In the legal world, the step is already being defined as an international precedent, which may change the rules of the game in the fight against state-sponsored cyber terrorism.

Only 5% of the amount was returned

According to Bibit, in February 2025, Lazarus, identified by American intelligence agencies as a group of hackers operating under the auspices of the North Korean government, stole approximately 500,000 Ethereum coins – with a total value of 1.5 billion dollars.

Allegedly, the hackers cheated Bibit’s internal system, when the employees who were supposed to approve the transfer of funds saw on the screen that everything was in order, and that the money was supposed to reach its destination, but in practice they approved – without knowing – the transfer of hundreds of millions of dollars to the account of the hackers.

Despite efforts to trace the funds, most of them have already disappeared. According to estimates, about 90% of the funds are no longer traceable, after the hackers used sophisticated obfuscation methods: mixing the money with other funds, transferring it between different blockchain networks and selling it through private parties – all in order to cut off the traces between the stolen money and who currently owns it. Along the way, most of the Ethereum was converted to Bitcoin.

Bibit was not satisfied with the pursuit of the stolen funds, but as mentioned filed a RICO lawsuit (a law originally designed to fight organized crime) against North Korea, RGB and Lazarus. The judge has already determined that “Bibit has demonstrated a high probability of success in the lawsuit”, and ordered the freezing of the stolen assets that were found.

However, North Korea does not recognize the authority of the American courts, and its representatives are not expected to attend the hearings, so collecting 1.5 billion dollars directly from Pyongyang, experts say, is a fantasy. However, so far Bibit has managed to return about 48.4 million dollars and freeze another 30.5 million dollars across more than 28 exchanges – about 5% of the stolen amount.

At the same time, other countries are involved in the affair. German authorities recently shut down eXch, a crypto exchange that was reportedly used to launder stolen funds from various sources, including apparently some of the money stolen from Bibit. In addition, a joint action by the German and Swiss authorities stopped the services of Cryptomixer.io, a platform designed to obscure the source of the stolen money.

Robbers directed by the regime

Bibbitt’s lawsuit, it seems, is only the tip of the iceberg. According to a report published by the blockchain analysis company TRM Labs last month, hackers identified with North Korea stole about $600 million in crypto between January and April 2026 alone – and they are responsible for about 76% of all crypto value stolen in the world during that period. Such a rate, according to experts, cannot result from the piratical activity of individual hackers, but from a coordinated and directed system by the intelligence arms of the dictatorial regime.

The month of April stood out in particular: within two weeks, the two crypto platforms Drift Protocol and Kelp DAO took hits of hundreds of millions of dollars each. In both cases, the attackers chose not to focus on technical code breaches, but directly damaged the authentication infrastructure and digital signature systems – similar to the method of operation that also characterized the Bibit hack. The similarity in the attack method reinforces the assessment that this is the same attack infrastructure that is centrally managed by the Lazarus group and whoever operates it.