Bybit Hacked: Hackers steal $1.5 billion from Bybit – largest crypto exchange hack to date

Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing…

— Bybit (@Bybit_Official) February 21, 2025

The attacker was able to take control of the cold wallet and move its holdings to an unknown address.

“Bybit is solvent even if this loss is not recovered. All client assets are fully backed. We can cover the loss,” Zhou stated, adding that the exchange holds over $20 billion in assets.

Tracing the Stolen Funds

Blockchain forensic teams are working to track down the stolen funds. Research firm Arkham Intelligence reported that the stolen Ethereum is already being moved to new addresses and sold off.

ZachXBT, a well-known blockchain investigator, traced the theft to North Korean state-sponsored hackers. The attack bears similarities to previous breaches at WazirX and Radiant Capital, where attackers tricked users into signing fraudulent transactions.

Breaking Down the Exploit

The hackers used several techniques to pull off the attack, including:

• Address Manipulation: The “to” address appeared normal in the UI but redirected funds to a malicious wallet in the background.
• Delegate Call Exploit: The transaction contained an operation type that allowed an external contract to execute code with full control.
• Storage Slot Manipulation: The hackers altered a key storage slot in the contract, swapping Bybit’s legitimate security settings with their own malicious version.

Could This Have Been Prevented?

Security experts say the attack could have been avoided with stricter verification processes:

• Proper Hardware Wallet Checks: Transactions should be reviewed directly on a hardware wallet, not just in the UI.
• Avoiding Blind Signing: Many wallets don’t display full transaction details, leading users to approve transactions without knowing exactly what they’re signing.
• Using Blockchain Explorers: While Etherscan didn’t flag the contract changes, BlockScout correctly identified the exploit.

The Bigger Picture

This attack is a reminder of the security challenges facing the crypto industry. More than $2.2 billion has been stolen from crypto platforms this year alone, according to Chainalysis.

Bybit is now working with forensic experts to recover the stolen funds, but for now, the hackers remain unidentified. Until security improves, users should take extra precautions before signing transactions.

Founded in March 2018, Bybit offers a professional crypto exchange platform where crypto traders can find an ultra-fast matching engine, excellent customer service, and multilingual community support. Currently, Bybit is the world’s third most visited cryptocurrency exchange with more than 5 million registered users.