Bybit Exchange $ETH Hacking Update

 As of February 21, 2025, Bybit, a major cryptocurrency exchange, has experienced a significant security breach, resulting in the theft of approximately $1.4 billion worth of Ethereum (ETH) and related tokens from one of its cold wallets.

What Happened?

The hack occurred on February 21, 2025, when Bybit’s Ethereum multisignature (multisig) cold wallet was compromised. 

According to Bybit co-founder and CEO Ben Zhou, the attacker exploited a sophisticated phishing technique involving a "masked" user interface (UI) and URL. 

This deceived the wallet signers into approving a malicious transaction that altered the smart contract logic of the ETH cold wallet. 

Once the attacker gained control, they transferred the entire contents—estimated at 401,346 ETH (valued at around $1.1 billion), along with additional staked ETH variants like 90,376 stETH, 15,000 cmETH, and 8,000 mETH (totaling approximately $1.4 billion)—to an unidentified address.

The breach was first flagged by on-chain sleuth ZachXBT, who noticed suspicious outflows from Bybit’s wallets. 

Blockchain security firm SlowMist later detailed that the attacker used a malicious contract with backdoor functions ("sweepETH" and "sweepERC20") to drain the funds, a method that involved replacing a legitimate multisig wallet contract with a fraudulent one.

Scale of the Hack

This incident is being described as the largest cryptocurrency hack in history, surpassing previous notable breaches like the Ronin Network ($625 million in 2022) and Poly Network ($611 million in 2022). 

The stolen 500,000+ ETH exceeds the holdings of Ethereum co-founder Vitalik Buterin (240,000 ETH), highlighting the magnitude of the theft.

Bybit’s Response

Solvency Assurance: Ben Zhou has repeatedly emphasized that Bybit remains solvent and can cover the $1.4 billion loss without affecting client funds. 

He stated that all client assets are backed 1:1, and the exchange has secured a bridge loan covering 80% of the lost ETH to stabilize operations.

Operational Continuity: Bybit has assured users that only the ETH cold wallet was compromised. Other cold wallets, hot wallets, and warm wallets remain secure, and withdrawals and deposits are functioning normally.

Investigation: Bybit’s security team, alongside blockchain forensic experts, is actively investigating the breach. 

The exchange is collaborating with industry partners to track the stolen funds, which have been split across 53 wallets and are being monitored in real time.

Market Impact

The hack triggered immediate volatility in the crypto market:

ETH Price Drop: Ethereum’s price fell by over 3-5% following the confirmation, dropping to around $2,680-$2,727, though it has since shown signs of stabilization.

Broader Market Reaction: Bitcoin (BTC) also dipped by about 1-2%, trading at approximately $98,091-$98,643, as panic spread. The total crypto market cap saw a 0.80%-1.35% decline, settling at around $3.18-$3.2 trillion.

Liquidations: Ethereum futures traders faced $76 million in liquidations within four hours, reflecting heightened market sensitivity.

Initial rumors speculated that Bybit might buy back ETH to cover losses, briefly boosting ETH prices. However, Zhou clarified that no such large-scale purchases are planned, shifting sentiment bearish amid concerns over potential selling pressure from the hacker.

Hacker’s Actions

The stolen ETH has been distributed across 53 wallets, with some funds (e.g., $200 million in stETH) already liquidated via decentralized exchanges (DEXs) like Curve Finance. The tracked wallets make it challenging for the hacker to offload the full amount without detection, especially under current market conditions.

Industry Response

Support Offers: Binance’s former CEO Changpeng Zhao (CZ) and TRON’s Justin Sun have publicly offered assistance to Bybit. CZ suggested pausing withdrawals as a precaution.

Bounty: Arkham Intelligence has launched a bounty offering 50,000 ARKM tokens (~$33,600) for information identifying the hacker, with findings to be shared with Bybit.

Current Status

As of 10:12 PM WAT on February 21, 2025, the situation remains fluid:

Bybit continues to operate normally, with no reported disruptions to user services.

The investigation is ongoing, with hopes of recovering some funds, though experts note similarities to past unrecovered hacks (e.g., WazirX in 2024, linked to North Korean hackers).

The crypto community is on edge, with this breach amplifying concerns about centralized exchange security, especially during a period of heightened hack activity in early 2025.

For the latest developments, monitoring official statements from Bybit and on-chain analysis from sources like ZachXBT or Arkham could provide further clarity as the situation evolves.