The cryptocurrency industry faced a seismic shock on February 21, 2025, when Bybit, a p
rominent exchange with over 60 million users and daily trading volumes exceeding $36 billion, fell victim to a record-breaking hack. This incident, resulting in the loss of over $1.4 billion in Ethereum (ETH) and related tokens, marks the largest theft in the sector’s history and underscores persistent security vulnerabilities. This report delves into the details of the hack, the suspected culprits, Bybit’s response, and the broader implications for the crypto industry.
Incident Overview
The breach occurred during a routine transfer from Bybit’s ETH multi-signature cold wallet to its warm wallet, a process intended to manage daily trading balances. According to Bybit’s CEO, Ben Zhou, the attackers exploited a “masked” user interface (UI) and URL, deceiving wallet signers into approving a malicious transaction. This manipulation involved altering the smart contract logic while displaying a legitimate address, a technique known as “blind signing.”
Blind signing refers to approving a smart contract transaction without fully understanding its contents, a practice that has become prevalent due to the complexity of smart contracts and wallet limitations in displaying details. This vulnerability allowed the hackers to gain unauthorized access, draining approximately 401,347 ETH, valued at over $1.4 billion, in a series of suspicious transactions flagged by on-chain analyst ZachXBT.
Further forensic analysis revealed that the attackers likely used advanced phishing techniques and social engineering to gain initial access to internal credentials, bypassing security protocols. The stolen funds were quickly transferred to multiple addresses, with blockchain monitoring firms like Arkham Intelligence confirming outflows of around $1.4 billion.
Suspected Culprits: Lazarus Group
Emerging analysis suggests that North Korean hackers, specifically the Lazarus Group, may be responsible. This group, also known as Guardians of Peace or Whois Team, has a notorious history of targeting crypto exchanges, with previous exploits including the $600 million hack of the Ronin Network in March 2022.
Blockchain investigator ZachXBT linked the Bybit hack to the Lazarus Group through on-chain data, identifying patterns consistent with their operations, including similarities to the January 2025 Phemex hack. Arkham Intelligence supported these findings, awarding ZachXBT a $50,000 bounty for his detailed analysis of test transactions and connected wallets.
The involvement of a state-sponsored group adds a geopolitical dimension, highlighting the use of crypto hacks to fund North Korean state activities, potentially covering significant portions of their military budget.
Bybit’s Response and User Impact
In the wake of the hack, Bybit took swift action to reassure users. CEO Ben Zhou confirmed via an X post that the company is solvent and can cover the loss, with all client assets backed 1-to-1. He stated, “Bybit is solvent even if this hack loss is not recovered, all of clients assets are 1 to 1 backed, we can cover the loss,” emphasizing the exchange’s financial stability. Bybit is working with forensic experts and has reported the crime to the police, collaborating with on-chain analytics providers to track the implicated addresses and prevent the hackers from laundering the funds.
Despite the breach, Bybit claims other cold wallets remain secure, and withdrawals continue normally, though there has been a surge in withdrawal requests, potentially leading to delays. Zhou also mentioned securing bridge loans to cover 80% of the stolen ETH, encouraging users to stay calm.
Technical Details: Multi-Signature Cold Wallet and Exploitation
Bybit’s compromised wallet was a multi-signature (multi-sig) cold wallet, requiring multiple signatures to execute transactions, designed to enhance security by distributing control among several parties. A multi-sig cold wallet stores private keys offline, protecting them from online attacks, and typically requires at least two private keys to authorize a transaction. However, the hackers exploited a vulnerability in the signing process, likely through the Safe.global platform, which Bybit used for wallet management. The attack involved a “masked” UI, displaying a legitimate address from Safe while altering the transaction details, a form of blind signing that tricked signers into approving malicious code.
This exploitation highlights the risks of blind signing, where users approve transactions without fully understanding their contents, a practice that has been linked to previous hacks like the WazirX attack in July 2024. The incident suggests a potential vulnerability in Safe.global’s UI, though no specific exploit has been publicly disclosed, indicating it may have been a zero-day attack.
Impact on the Cryptocurrency Industry
The Bybit hack, valued at over $1.4 billion, surpasses all crypto hacks in 2024, which totaled around $2.2 billion according to Chainalysis, representing more than 60% of last year’s stolen funds. This scale has significant implications for the industry, reinforcing the perception of crypto as a target for cybercriminals and state actors, potentially eroding user trust in centralized exchanges.
The market reacted with heightened volatility, with Ethereum prices initially dropping by about 4% before rebounding due to speculation that Bybit might buy back ETH to compensate users. This incident may drive increased adoption of decentralized finance (DeFi) solutions and self-custody wallets, where users retain control over their private keys, reducing reliance on centralized platforms.
Security and Regulatory Implications
The hack underscores the need for exchanges to invest in advanced security measures, including more secure multi-sig implementations, enhanced cold wallet management, and real-time monitoring for suspicious activities. It also highlights the importance of transitioning from blind signing to clear signing, where transaction details are fully visible to users, to mitigate risks.
From a regulatory perspective, the involvement of the Lazarus Group may prompt increased cooperation between crypto firms and government agencies, potentially leading to stricter oversight and international efforts to combat state-sponsored cyber threats. This could result in new regulations requiring exchanges to maintain higher security standards and report breaches promptly.
Conclusion
The Bybit hack is a pivotal moment for the cryptocurrency industry, serving as a wake-up call to prioritize security and rebuild user trust. As exchanges adapt their protocols and the community responds, the incident will likely shape the future of crypto security, emphasizing the need for robust defenses against increasingly sophisticated attacks. The coming months will be crucial in determining how the industry addresses these challenges and restores confidence among users.
Dean Decho
Dean is a passionate advocate for the financial freedom and independence offered by Bitcoin and the cryptocurrency space. He's built this crypto learning platform to help others in the industry learn, grow and be part of it.
