In this news:
Bybit Theft (Photo illustration by Jakub Porzycki/NurPhoto via Getty Images)
NurPhoto via Getty Images
Bybit, established in 2018 by CEO Ben Zhou, has rapidly ascended to prominence in the cryptocurrency exchange landscape. Headquartered in Dubai, United Arab Emirates, Bybit offers a comprehensive suite of services, including cryptocurrency trading, passive income products, and an NFT marketplace. The platform caters to a global clientele, excluding jurisdictions such as the United States, mainland China, Singapore, and certain others.
The Unprecedented Bybit Security Breach
On February 21, 2025, Bybit experienced a significant security breach, marking one of the largest hacks in cryptocurrency history. Hackers infiltrated one of Bybit’s Ethereum (ETH) cold wallets, stealing approximately 401,347 ETH, valued at over $1.4 billion. This incident has sent shockwaves throughout the digital asset industry, underscoring persistent security vulnerabilities.
The breach occurred during a routine transfer from Bybit’s ETH multi-signature cold wallet to its warm wallet. The attackers employed a sophisticated method, manipulating the transaction by masking the signing interface. This deception displayed the correct address while altering the underlying smart contract logic, enabling unauthorized access to the wallet.
Further forensic analysis revealed that the attackers utilized advanced phishing techniques and social engineering to gain initial access to internal credentials, which were then used to bypass security protocols. Once inside the system, they exploited vulnerabilities in Bybit’s multi-signature authentication process, creating fraudulent approvals that allowed the transfer of assets without raising immediate red flags.
Emerging analysis suggests that North Korean state-sponsored hackers, specifically the Lazarus Group, may be responsible for the attack. Blockchain investigator ZachXBT and security researchers have identified patterns consistent with previous Lazarus Group operations, including similarities to the Phemex exchange hack in January 2025.
