---
title: Federal Judge Freezes North Korea-Linked Crypto Wallets in the $1.5 Billion Bybit Theft
description: A US federal judge has frozen crypto wallets tied to the $1.5 billion Bybit theft. Notice reached the anonymous holders as NFTs airdropped into their wallets.
author: Darie Nani (Editor-in-Chief)
updated: 2026-08-08T21:19:42.188Z
canonical: https://www.sovereignmagazine.com/article/bybit-north-korea-court-injunction-nft-notice
image: https://cdn.nanimediahouse.com/bybit-north-korea-court-freeze-122106.webp
categories: Blockchain
content_type: News
region: Global
publication: Sovereign Magazine
schema_type: Article
---

A federal judge in Washington has barred the holders of a set of cryptocurrency wallets from moving any funds traceable to the theft of $1.5 billion from the exchange Bybit, in a lawsuit that names the North Korean government among its defendants.

Bybit filed the case, Bybit Technology Limited v. Democratic People's Republic of Korea, in the US District Court for the District of Columbia on June 18, 2026, and it was sealed the same day. Judge John D. Bates unsealed [the docket](https://www.courtlistener.com/docket/73727990/bybit-technology-limited-v-democratic-peoples-republic-of-korea/) by minute order on August 6. The individual wallet addresses at the center of the case remain under seal.

## The Complaint Names a Government, an Intelligence Bureau and Twenty Strangers

The defendants are the Democratic People's Republic of Korea, its Reconnaissance General Bureau, the Lazarus Group, and twenty unidentified people listed as John Does. The docket lists the cause of action under the federal racketeering statute, and Bybit has demanded a jury. The FBI [attributed the theft to North Korea](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack) in a public service announcement on February 26, 2025, five days after the funds were taken.

Bates found that Bybit is likely to succeed on at least two of its claims, under the Computer Fraud and Abuse Act and for conversion. Quoting his own earlier order, he wrote that the Doe defendants “engaged in a coordinated and unauthorized intrusion into Bybit's cold-wallet authorization system, including through computers used to transact international business, deploying malicious code to fraudulently extract $1.5 billion without permission.”

## Notice Arrived as Tokens Airdropped Into the Wallets Themselves

Bates granted the first restraining order on June 19 without telling the other side, which federal rules allow when a defendant cannot be identified in time and the money may vanish. A preliminary injunction cannot be granted that way. Notice has to be, in the Supreme Court's 1950 formulation in Mullane v. Central Hanover Bank and Trust Co., “reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.”

Bybit hired FTI Consulting Technology to send an NFT to every wallet named in the case, a method set out in a declaration by Jeremy Sheridan on the docket. The tokens went out by July 20. Each carried text saying a restraining order applied to the holder's account and that they had until July 24 to object, and pointed to a website carrying the complaint and both restraining orders.

Bates found that this gave the Doe defendants notice and a reasonable opportunity to be heard. In a footnote he drew a line under how far it goes: NFTs “may indeed be an adequate method of alternative service in addition to being sufficient for notice, but Bybit has not yet sought authorization from the Court for this method of alternative service.” Formal service still has to be perfected before any final judgment.

## One Holder Wrote Back, and His Wallet Came Out of the Freeze

Joseph F. Corrigan, an Australian citizen living in Southeast Asia, filed on his own behalf to oppose the injunction as it applied to his wallet at the exchange Nexo. He said he is the rightful owner of the money in it and that Bybit had not shown any entitlement to freeze it.

Bybit disputed his account but told the court the sum at stake, $39,000, is modest, and that knowing his identity it can name him as a defendant later if it still believes it has the better claim. It said it “does not object to excluding” his wallet. Bates granted the injunction in part and denied it in part, carving the Corrigan wallet out and leaving the rest of the freeze in place.

The order bars the Doe defendants and anyone acting with them from transferring, hiding or disposing of assets traceable to the February 21, 2025 theft, including proceeds that have been converted or mixed with other funds, and requires them to preserve what the listed wallets hold. It runs until the court says otherwise.

## Tether Holds Most of the Money and Does Not Consider Itself Bound by the Order

Of the $37 million at issue in the case, $27 million is held at Tether, which does not consider itself bound by the restraining order. Tether told Bybit it had already frozen the vast majority of those funds voluntarily, working with the FBI. More than $6 million has been frozen under the court's own order, and Bybit told the judge that many of the exchanges holding it have said they will let it go once the order lapses.

Bates wrote that the public interest favored an injunction because the theft “undermined the integrity of crypto markets and was carried out at the direction of a sanctioned government to fund nuclear and ballistic weapons programs.” He concluded that the risk of the money moving stays significant if any freeze comes off, whether because the order expires or because Tether decides on its own to release it.

Those figures cover this case alone. Announcing the suit on August 8, Bybit said that across its whole recovery effort since February 2025 it has recovered about $48.4 million and frozen more than $30.5 million at over 28 exchanges and custodians. The company said German authorities dismantled the exchange eXch, and that German and Swiss authorities later disrupted Cryptomixer.io. Ben Zhou, its co-founder and chief executive, said the attack “wasn't just an attack on Bybit. It was an attack on trust in our industry.”

## FAQ

**Q: Does an NFT sent to a wallet count as being legally served?**
Not on its own. Bates found the tokens gave the account holders adequate notice of the case under the Mullane standard, but noted that Bybit has not asked the court to approve NFTs as a method of formal service, which is still required before a final judgment can be entered.

**Q: What is a preliminary injunction?**
It is a court order that holds a situation in place while a case is fought out. Unlike a temporary restraining order, it cannot be issued without notice to the other side, which is why the question of how to reach anonymous wallet holders mattered here.

**Q: How much of the stolen $1.5 billion has been recovered?**
The two sets of figures cover different things. Bybit says that since the hack it has recovered about $48.4 million and frozen more than $30.5 million across more than 28 exchanges and custodians. Within this lawsuit, $37 million is at issue and more than $6 million has been frozen under the court's order.

**Q: What happens next in the case?**
The injunction runs until the court orders otherwise. Service on the Doe defendants still has to be perfected before any final judgment, and the racketeering, computer fraud and conversion claims have yet to be litigated.