Bybit Hack: $1.4 Billion in Crypto Stolen Amid Security Breach

Cryptocurrency exchange Bybit is facing a significant crisis following a security breach that resulted in the theft of over $1.4 billion in Ethereum (ETH) and stETH.

The stolen assets were quickly distributed across various decentralized exchanges, causing a ripple effect in the market.

Confirmation from Bybit CEO

Bybit’s co-founder and CEO, Ben Zhou, confirmed the attack on X (formerly Twitter). He explained that the breach occurred when a planned transfer was manipulated, leading to the unauthorized withdrawal of funds.

“Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However, the signing message was to change the smart contract logic of our ETH cold wallet,” Zhou stated.

He further added that the attacker gained control of the ETH cold wallet, transferring all of its funds to an unidentified address.

However, he assured users that all other cold wallets remained secure and that withdrawals were functioning normally.

Market Reaction and Price Decline

Following the news of the breach, Ethereum’s price dropped nearly 3% to $2,727, while Bitcoin saw a slight dip of almost 1%, settling at $98,091.

Smaller cryptocurrencies, such as Solana, XRP, and Dogecoin, faced more substantial declines.

Security researcher ZachXBT had earlier noted “suspicious outflows” from Bybit, confirming the security incident. He later observed that the stolen ETH was split across 39 different addresses to obscure the transactions.

Bybit’s Official Statement

Bybit acknowledged the breach in a post on X, detailing how a transaction from its ETH multisig cold wallet to a warm wallet was manipulated.

“The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic. As a result, the attacker was able to gain control of the affected ETH cold wallet and transfer its holdings to an unidentified address.”

Despite the significant loss, Zhou reassured users that Bybit remains solvent.

“Bybit is solvent even if this hack loss is not recovered. All of clients’ assets are 1-to-1 backed, we can cover the loss.”

Impact on Crypto Markets

The breach has caused turmoil in the cryptocurrency market. Bitcoin, which had gained 1.4% earlier in the day, reversed its trend and fell by 2.1% to approximately $96,057.

Ethereum, the primary token stolen in the hack, saw a 7% decline, trading at around $2,650. Other major cryptocurrencies also experienced losses, as traders reacted to the event.

Alexis Sirkia, chairman of Yellow Network, commented on the market impact:

“The Bybit breach has triggered a market downturn. As with past CEX failures, panic selling and liquidity disruptions followed, exposing the ongoing risks of centralized custody.”

Shares of Coinbase, the largest U.S. crypto exchange, also declined by over 5%.

Hackers’ Strategy and Stolen Funds Movement

Research firm Arkham Intelligence reported that the stolen assets have started moving to different addresses, where they are being liquidated.

Blockchain analytics firm Elliptic classified the Bybit breach as the largest cryptocurrency theft in history, surpassing the $611 million Poly Network hack in 2021.

Bybit’s Response and Recovery Efforts

Zhou later assured users that the company had processed all withdrawal requests and resumed normal operations.

“12 hr from the worst hack in history. ALL withdraws have been processed. Our withdraw system is now fully back to normal pace, you can withdraw any amount and experience no delays. Thanks for your patience and we are sorry that this has happened. Bybit will come out with full…”

Suspected North Korean Involvement

Blockchain researchers and analysts suspect that North Korean hackers may be responsible for the attack. ZachXBT and Arkham Intelligence noted patterns similar to previous cyberattacks linked to North Korea.

A joint statement from the FBI, the U.S. Defense Department, and Japan’s National Police Agency in December 2024 had implicated North Korean hackers in a $308 million theft from a Japanese crypto firm.

This latest incident adds to growing concerns over North Korea’s involvement in large-scale cryptocurrency thefts.

Legal Actions and Future Steps

To mitigate losses, Bybit has secured 80% of the funds needed to cover the loss through bridge loans. The company is also pursuing legal action against the hackers to recover the stolen assets.

Zhou has actively reassured users and stakeholders, reinforcing Bybit’s commitment to maintaining stability despite the breach.