Bybit Crypto Exchange Faces Massive $1.4 Billion Hack: Investigation Underway
The cryptocurrency market has been rocked by one of the largest security breaches in its history, with Bybit, a Singapore-based crypto exchange, confirming a massive hack affecting its Ethereum cold wallet. Initial estimates indicate that over $1.4 billion worth of Ethereum (ETH) was stolen. The attack has raised significant concerns about security vulnerabilities in centralized exchanges and has prompted an ongoing investigation to determine how the hacker executed the breach.
Bybit CEO Ben Zhou confirmed the incident, explaining that the exchange’s cold wallet for Ethereum was the only wallet impacted and that all withdrawals remain functional. The attacker reportedly exploited a multisig cold wallet authorization mechanism by using a masked transaction that appeared legitimate but ultimately granted them access to the assets. This sophisticated breach highlights the growing complexity of cyber threats in the crypto industry.
Security analysts and blockchain researchers have been tracking the movement of the stolen funds, which have already been distributed across multiple wallets. The hacker has begun laundering the assets using decentralized exchanges, making recovery efforts increasingly difficult. Bybit has assured users that their funds remain backed 1:1, but the full impact of the breach is still being assessed.
Ben will be hosting a livestream to address the latest ETH wallet incident, provide key updates, and answer your questions. Stay tuned here: https://t.co/EfdbE9eWti
— Bybit (@Bybit_Official) February 21, 2025
How the Attack Unfolded
Investigations suggest that the hacker took advantage of a vulnerability in Bybit’s cold wallet authorization process. Bybit uses a multisig system to approve transactions from its cold wallet to its warm wallet. However, in this instance, the attackers used a deceptive mechanism to manipulate the signers into unknowingly approving the transfer of funds to an unidentified address.
This fraudulent transaction was reportedly masked, meaning that the signers saw a legitimate address and URL during the authorization process. However, in reality, the signing process altered the smart contract logic of Bybit’s Ethereum cold wallet, allowing the hacker to gain control and drain the assets.
As soon as the transaction was approved, the hacker swiftly transferred the Ethereum holdings from the exchange’s cold wallet to a new address. From there, the funds were broken down and distributed across multiple wallets to obfuscate the transaction trail.
Breakdown of Stolen Funds and Movement
On-chain data shows that the hacker initially moved the stolen Ethereum to a wallet beginning with “0x476,” which received approximately:
- 400,000 ETH (~$1.1 billion)
- 90,000 stETH (staked Ethereum)
- 15,000 cmETH
- 8,000 cETH
The hacker utilized the sweep ETH function, a smart contract feature that enables the complete transfer of tokens from one wallet to another. This function is commonly used to consolidate assets but in this case, it was leveraged to rapidly empty Bybit’s cold wallet.
After the initial transfer, the funds were divided among three primary “distribution” wallets labeled 0xB4a, 0x23Ob, and 0x83Ef5. These addresses then fragmented the funds further, distributing them across dozens of newly created wallets.
Using decentralized exchanges like Uniswap, Paraswap, and KyberSwap, the hacker has already begun swapping Ethereum for other tokens, making it harder to track and recover the stolen funds.
Bybit’s Response and Security Measures
Bybit has been quick to reassure users that the exchange remains solvent despite the loss. CEO Ben Zhou stated that all of Bybit’s other hot and cold wallets remain unaffected, and customer assets remain safe. He confirmed:
- “Bybit is solvent even if this hack loss is not recovered, all of clients’ assets are 1:1 backed.”
- “All withdrawals remain normal, and users can continue their transactions as usual.”
While the exchange has not disclosed whether they plan to reimburse affected users, they are working closely with blockchain security firms and law enforcement agencies to track and recover the stolen assets.
Impact on Bybit Users and Exchange Reserves
According to BitMEX Research, nearly 75% of all Ethereum deposits held by Bybit were drained in the attack. Despite this significant loss, Bybit still holds over $20 billion in various crypto assets, including:
- $6.9 billion in Bitcoin (BTC)
- $4.1 billion in USDT (Tether)
- $1.2 billion in Ethereum (ETH)
Additionally, blockchain analysis platform Arkham has detected that Bybit transferred $560 million worth of USDT on the Tron network from a treasury wallet to a hot wallet shortly after the hack, possibly to ensure liquidity and maintain exchange operations.
How the Crypto Community is Reacting
The crypto industry has responded with widespread concern, with many questioning how such a large-scale attack could occur despite the implementation of multi-signature security measures. Some security experts argue that Bybit’s wallet infrastructure may have been vulnerable to a UI manipulation attack, where hackers create fake transaction confirmations that deceive wallet signers.
Decentralized finance (DeFi) protocols and on-chain security firms are actively monitoring hacker wallets to prevent further laundering. However, due to the nature of decentralized exchanges, once funds are swapped and mixed, they become increasingly difficult to trace.
Similar High-Profile Crypto Hacks
Bybit’s massive security breach is among the largest in the history of cryptocurrency but follows a pattern of similar attacks on centralized exchanges. Some of the most significant crypto exchange hacks include:
- Mt. Gox (2014): Approximately 850,000 BTC was stolen, valued at $460 million at the time.
- Coincheck (2018): Hackers stole $530 million in NEM tokens from the Japanese exchange.
- Poly Network (2021): The DeFi platform was exploited for $610 million, though much of the funds were later returned.
- FTX Collapse (2022): While not a hack, over $370 million was stolen from FTX wallets after the exchange’s bankruptcy.
Bybit’s breach, however, stands out due to its highly sophisticated nature, where hackers manipulated the signing process of a cold wallet—previously considered one of the safest storage methods for digital assets.
Ongoing Investigations and Security Measures Moving Forward
Authorities and cybersecurity experts are now focused on tracking the movement of the stolen funds and identifying the attackers. Some of the key areas under investigation include:
- How did the hacker gain access to Bybit’s multisig signing process?
- Was there an insider involved in manipulating the transaction authorizations?
- What vulnerabilities in Bybit’s infrastructure allowed this exploit to occur?
- Can blockchain forensic tools successfully track and freeze the stolen assets?
Meanwhile, Bybit has announced urgent security upgrades and will likely introduce stricter wallet signing procedures, potentially requiring additional verification layers for large transactions.
The Future of Centralized Exchanges and Security Risks
This incident has once again highlighted the risks of centralized exchanges (CEXs) and their vulnerability to sophisticated cyber threats. While cold wallets are generally seen as the safest way to store digital assets, this attack proves that even multisig authentication can be compromised.
As the cryptocurrency market continues to grow, exchanges must implement enhanced security measures, including:
- AI-driven fraud detection systems
- Stronger encryption for transaction confirmations
- Multi-factor authentication for wallet signers
- Improved internal monitoring to detect unusual transactions
Until these measures are widely adopted, crypto users and investors remain at risk of losing funds to increasingly complex attacks.
