Bybit Suffers Historic $1.4 Billion Hack: A Blow to the Crypto Industry

By Kevin B. Simon

Cover Image Attribute: Image by Pete Linforth from Pixabay

The cryptocurrency world was rocked this week by what is being described as the largest hack in its history, with Dubai-based exchange Bybit losing over $1.4 billion in digital assets. The breach, which occurred on February 21, 2025, has sent shockwaves through the market, reigniting concerns about the security of centralized exchanges and the vulnerability of even the most prominent platforms to sophisticated cyberattacks. As the fallout continues, Bybit’s leadership has scrambled to reassure users, while analysts and security experts dissect the incident that has dwarfed all previous crypto heists.

The Hack: A Sophisticated Assault

The attack targeted one of Bybit’s offline Ethereum cold wallets, a storage method typically considered one of the safest ways to hold cryptocurrency due to its disconnection from the internet. However, hackers managed to drain approximately $1.46 billion worth of Ethereum (ETH) and related tokens, including liquid-staked Ether (stETH) and Mantle Staked ETH (mETH), in a series of rapid, suspicious transactions. Blockchain analytics firms such as Elliptic and Arkham Intelligence quickly traced the stolen funds as they were moved to various accounts and offloaded, confirming the scale of the theft.
According to initial reports, the hackers exploited a vulnerability in Bybit’s multisignature (multisig) wallet system. Posts on X and statements from security analysts suggest the attackers used a spoofed user interface to deceive Bybit’s team into authorizing a malicious smart contract alteration. This allowed the hackers to gain control of the wallet and siphon off its contents undetected until it was too late. “The attackers employed a sophisticated technique, manipulating the user interface to disguise a malicious transaction,” noted one analyst on X, highlighting the advanced tactics at play.
Bybit’s CEO, Ben Zhou, confirmed the breach in a post on X shortly after the incident, stating, “A hacker took control of one of Bybit’s offline Ethereum wallets.” Zhou’s transparency was immediate, but the revelation triggered panic among users and a broader market downturn. The price of Ethereum dropped over 3% following the news, with Bitcoin and other major cryptocurrencies also experiencing declines as investor confidence wavered.

The Fallout: A $5.5 Billion “Bank Run”

The hack’s immediate aftermath saw Bybit facing a crisis of trust. Within hours, the exchange reported “massive withdrawals” as users rushed to pull their funds, fearing potential insolvency. By February 23, total outflows had exceeded $5.5 billion, according to data from blockchain trackers and statements from Zhou during a live X Spaces session. “We’ve seen a bank run, but it’s not an issue,” Zhou insisted, emphasizing that Bybit’s reserves exceeded its liabilities and that client funds remained fully backed on a 1:1 basis.
To stabilize operations, Zhou announced that Bybit had secured a bridge loan from undisclosed partners to cover any unrecoverable losses. “Even if this hack loss is not recovered, Bybit is solvent,” he said, attempting to quell fears. The exchange also kept withdrawals open—a move praised by some in the crypto community for maintaining accessibility during a crisis. However, the sheer volume of withdrawal requests led to processing delays, further fueling uncertainty.
The market reaction was swift and severe. Derivatives data showed traders liquidating positions, with over $566 million wiped out in a single day as panic selling gripped the industry. Bitcoin, which had been hovering near $96,750, dipped below $95,000, while altcoins reversed recent gains. The Bybit hack, combined with lingering inflation fears, erased $75 billion from the broader crypto market, underscoring the fragility of investor sentiment in the face of such events.

Suspected Culprits: North Korea’s Lazarus Group

As Bybit and its partners worked to identify the perpetrators, suspicion quickly fell on the North Korean state-sponsored hacking collective known as the Lazarus Group. Blockchain data platform Arkham Intelligence linked the attack to previous exploits attributed to Lazarus, including the $620 million Ronin Bridge hack in 2022. On-chain sleuth ZachXBT, a pseudonymous analyst renowned for unraveling crypto crimes, provided early evidence connecting the stolen funds’ movements to addresses associated with the group.
“The connection to Lazarus was made via on-chain data that linked activity to previous attacks,” Arkham reported. The group, believed to operate under North Korea’s Reconnaissance General Bureau, has a well-documented history of targeting cryptocurrency platforms, having stolen billions in digital assets since 2017. Their tactics often involve advanced social engineering, malware, and exploitation of system vulnerabilities—methods consistent with the Bybit breach.
While Bybit has not officially confirmed the identity of the hackers, Zhou hinted at collaboration with law enforcement and on-chain analytics providers to track the culprits. “We’ve labeled the thief’s addresses to prevent these funds from being cashed out through other exchanges,” said Tom Robinson, chief scientist at Elliptic, indicating a coordinated effort to limit the damage. Despite these measures, the likelihood of recovering the full $1.4 billion remains slim, given the speed with which the funds were dispersed across the blockchain.

Industry Implications: A Wake-Up Call

The Bybit hack has reignited debates about the security of centralized exchanges, which remain prime targets due to the vast amounts of value they custody. “This breach highlights both systemic challenges and unique circumstances,” said Rob Behnke, co-founder of security firm Halborn. “Exchanges are complex systems that can harbor unnoticed vulnerabilities, and attackers are getting increasingly creative.” Behnke pointed to the use of a spoofed interface and smart contract manipulation as evidence of evolving tactics that outpace traditional defenses.
For Bybit, the incident is a bruising blow to its reputation. Founded in 2018, the exchange had grown into one of the industry’s largest players, managing $29 billion in assets and ranking 16th among crypto exchanges according to Forbes. However, its low scores for transparency and audit strength, as noted in recent evaluations, may now come under greater scrutiny. Zhou acknowledged the challenge ahead, stating in a livestream, “We need to understand exactly what happened—whether it’s our laptops or an issue with the Safe cold wallet system.”
The hack also underscores the persistent “Wild West” nature of the crypto industry, even as it gains mainstream traction. Just hours before the breach, the sector celebrated a legal victory when the U.S. Securities and Exchange Commission dropped a lawsuit against Coinbase—a milestone for regulatory clarity. Yet, the juxtaposition of that win with Bybit’s loss serves as a stark reminder of the risks that remain. “These guys whose whole business is crypto just lost $1.5 billion,” remarked Corey Frayer, a former SEC crypto policy expert, highlighting the irony of the industry’s dual narrative in 2025.

Moving Forward: Recovery and Resilience

In response to the crisis, Bybit has launched a recovery bounty program, offering rewards for information leading to the retrieval of the stolen funds. The exchange is also working with competitors like Binance and Bitget, which provided approximately 100,000 ETH in inflows to bolster Bybit’s reserves post-hack. Zhou praised his team’s round-the-clock efforts, noting, “We’ve been responding overnight without sleep to serve our clients.”
For the broader crypto community, the Bybit hack is a call to action. Traders have begun piling into privacy tokens like Monero (XMR) and exchange utility tokens like Bitget’s BGB, betting on a shift away from vulnerable centralized platforms. Meanwhile, security experts urge exchanges to adopt more robust measures, such as enhanced multisig protocols and real-time anomaly detection.
As the dust settles, Bybit’s ability to weather this storm will depend on its transparency, financial resilience, and capacity to restore user trust. For now, the hack stands as a sobering milestone—the biggest crypto heist in history—and a test of the industry’s maturity in the face of unrelenting threats.
IndraStra Global is now available on

Apple News, Google News, Feedly, Flipboard, and  WhatsApp Channel

COPYRIGHT: This article is published under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. https://creativecommons.org/licenses/by-nc-nd/4.0/

REPUBLISH: Republish our articles online or in print for free if you follow these guidelines. https://www.indrastra.com/p/republish-us.html