Founder of crypto exchange Bybit, Ben Zhou, confirmed a hack on the exchange on Friday, February 21st.
Attackers drained ETH worth $1.5 billion from the Dubai-based exchange, leaving several users in panic. Bybit founder Zhou explained the cause of the hack in an X post. Zhou noted that the hack happened as the exchange tried to move funds from its cold wallet to an online warm wallet.
Bybit ETH Cold Wallet Compromised in Masked Attack
“Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the masked UI which showed the correct address, and the URL was from @safe. However, the signing message was to change the smart contract logic of our ETH cold wallet,” Zhou explained.
Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change…
— Ben Zhou (@benbybit) February 21, 2025
He continued, “This resulted in a hacker taking control of the specific ETH cold wallet we signed and transferred all ETH in the cold wallet to this unidentified address. Please rest assured that all other cold wallets are secure. All withdrawals are NORMAL.”
Bybit Offered a Positive Response
Zhou later clarified that “Bybit Hot wallet, Warm wallet, and all other cold wallets are fine. The only cold wallet that was hacked was ETH cold wallet.” Bybit also echoed the positive sentiments of its founder in a separate X post.
Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing…
— Bybit (@Bybit_Official) February 21, 2025
The exchange wrote, “We want to assure our users and partners that all other Bybit cold wallets remain fully secure. All client funds are safe, and our operations continue as usual without any disruption. Transparency and security remain our top priorities, and we will provide updates asap.”
Not an easy situation to deal with. Might suggest to halt all withdrawals for a bit as a standard security precaution. Will provide any assistance if needed. Good luck! 🙏
— CZ 🔶 BNB (@cz_binance) February 21, 2025
The attack on Bybit is largely seen as one of the biggest attacks on a crypto exchange. As expected, the event sparked massive reactions from the crypto community, with the likes of CZ offering a helping hand.
🚨 Elliptic Research: The Largest Theft in History – Following the Money Trail from the Bybit Hack 🚨
On Feb 21, 2025, $1.46 billion in crypto was stolen from Bybit, making it the largest crypto theft ever.
Elliptic has attributed the attack to North Korea’s Lazarus Group,… pic.twitter.com/pM6fOn6Bol
— Elliptic (@elliptic) February 24, 2025
Furthermore, most Bybit users entered panic mode, leading to a withdrawal crisis. However, Zhou clarified that Bybit had secured enough to cover the losses even if the funds were not recovered, adding that “all clients’ assets are backed 1:1.”
Ben Zhou’s Livestream on the Latest ETH Wallet Incident LIVE now. https://t.co/mBwD9ubGIl
— Bybit (@Bybit_Official) February 21, 2025
Despite the challenges, Bybit has successfully managed the situation and stabilized operations.
Is Lazarus behind this?
Several crypto users quickly identified the North Korean group Lazarus as the attacker after the hack. Recall that Lazarus is behind significant hacks on crypto exchanges, including the Ronin bridge hack.
ALERT: $1B+ OUTFLOWS FROM BYBIT
$1.4B in ETH and stETH outflows from Bybit
The funds have begun to move to new addresses where they are being sold. So far $200M stETH has been sold.
Address: 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2 pic.twitter.com/TfGm2UCjM5
— Arkham (@arkham) February 21, 2025
Blockchain intelligence firms Arkham and Elliptic traced the stolen funds to different wallets. Elliptic marked Lazarus Group as the name behind the hack. Experts believe the hack could increase scrutiny on crypto exchanges in the coming days.
Disclaimer
The information discussed by Altcoin Buzz is not financial advice. This is for educational, entertainment and informational purposes only. Any information or strategies are thoughts and opinions relevant to accepted levels of risk tolerance of the writer/reviewers, and their risk tolerance may be different from yours.
We are not responsible for any losses that you may incur as a result of any investments directly or indirectly related to the information provided. Bitcoin and other cryptocurrencies are high-risk investments, so please do your due diligence.
Copyright Altcoin Buzz Pte Ltd.