What Happened in the Bybit Hack?

In the Bybit hack of February 21, 2025, attackers stole about 400,000 ETH and staked ETH, worth around $1.5 billion, the largest crypto theft on record. The FBI attributed it to North Korea. The attackers compromised the multisig wallet provider Safe and tricked Bybit’s signers into approving a transaction that looked routine.

What was taken

Everything came from a single Ethereum cold wallet, a multisig controlled by several Bybit signers through the Safe{Wallet} platform. Bybit’s other wallets were not affected.

Timeline

• About two days before: malicious code is planted in Safe{Wallet}’s web interface, after a Safe developer’s machine is compromised.
• February 21, around 12:30 UTC: during a scheduled transfer from Bybit’s ETH multisig cold wallet to its hot wallet, signers approve what appears to be a normal transaction. It actually replaces the wallet’s contract logic.
• Minutes later: the attacker drains about 400,000 ETH and staked ETH to their own addresses.
• February 22: Bybit says deposits and withdrawals are working normally and that it remains solvent.
• February 26: the FBI attributes the theft to North Korea.
• By February 24: Bybit reports that its ETH reserves have been restored through loans, purchases and deposits.

The attack, step by step

1. A developer’s computer is compromised. Attackers gained access to the machine of a Safe{Wallet} developer and, through it, to the cloud storage that served Safe’s web application.
2. Malicious code is planted, and aimed narrowly. About two days before the theft, they modified the JavaScript served from that storage. The code activated only when Bybit’s signers used the interface for Bybit’s cold wallet, so every other Safe user saw nothing unusual.
3. The signers see a routine transfer. During a scheduled move from cold to hot wallet, the interface displayed the expected transfer. The data actually sent for signing was different: it replaced the wallet’s contract logic with code controlled by the attackers.
4. The required signatures are collected. Each signer approved, believing the transaction matched what they saw. Bybit’s chief executive later said he had checked that the address was Safe’s official site.
5. The wallet is emptied and the evidence removed. With control of the wallet’s logic, the attackers moved its contents out. Two minutes later, the malicious code was replaced with clean files.

How the attack worked

The signers used Safe’s web interface, which had been altered to show them a harmless-looking transfer while sending different transaction data to be signed. Every required signature was given, so the multisig did exactly what it was designed to do. See what a multisig wallet is.

Figure: The attack targeted what signers saw, not the keys themselves.

Blind signing: the gap the attack used

Multisig signers usually approve transactions on hardware wallets, but those devices often show only raw data or a hash for complex contract calls, not a plain description of what will happen. When the screen cannot explain the transaction, signers rely on the web interface instead, which is exactly what the attackers had altered. This practice, approving data you cannot read, is known as blind signing. Verifying the transaction on a second, independent tool, or using devices that decode contract calls clearly, would have shown that the transaction did something very different from a transfer.

Why multisig did not stop it

Multisig protects against one stolen key, not against several signers being shown the same false information. The weak point was the interface between people and the wallet.

The first days: a run, and a rescue

News of the theft triggered a wave of withdrawals as customers moved funds off the exchange. Bybit kept processing them, said it remained solvent and arranged emergency liquidity, including a bridge loan covering about 80% of the stolen ether and 40,000 ETH borrowed from the exchange Bitget, which was later repaid. Within a few days it reported that its ether reserves had been restored, and it continued operating without significant downtime. That outcome separated Bybit sharply from Mt. Gox and FTX, which collapsed into bankruptcy.

Laundering in ten days

The attackers moved fast. Within about two hours, the stolen funds were split across dozens of addresses, and staked tokens were swapped for plain ether. Over roughly ten days they converted most of it: about 83% of the stolen ether was swapped into bitcoin and spread across 6,954 wallets, largely through THORChain, a cross-chain swap protocol that handled about 72% of the flow. About 79,655 ETH passed through eXch, an exchange that does not require identity checks. By early March, Bybit’s chief executive said about 77% of the funds remained traceable, 20% had “gone dark” and only about 3% had been frozen.

The bounty and the attribution

Bybit launched a recovery program offering up to 10% of any funds frozen with the help of outside researchers, a pool worth about $140 million at the time. On February 26, the FBI attributed the attack to North Korea’s Lazarus Group. Blockchain analysts had already linked the wallets involved to earlier attacks on other exchanges, including Phemex, BingX and Poloniex.

What happened to customers

Bybit covered the loss from its own reserves and borrowed ETH, and continued operating. Customers’ balances were not reduced, but the stolen funds were laundered across many addresses and largely not recovered.

How it compares with earlier thefts

At about $1.5 billion, the Bybit theft was more than twice the size of the previous largest crypto hacks: roughly $611 million taken from Poly Network in 2021 and about $620 million from the Ronin bridge in 2022, the latter also attributed to Lazarus. See what happened in the Ronin bridge hack. What set Bybit apart was not only the size but the method: no smart-contract bug and no stolen private key, just a trusted interface that showed signers something false.

Lessons for individual holders

The same weakness affects personal wallets. Anyone approving a transaction on a website is trusting that the site shows what will actually be signed. A few habits reduce that risk:

• Read the transaction on your hardware wallet’s screen, not just in the browser, and do not approve what you cannot understand.
• Be suspicious of any unexpected approval request, especially one that grants permissions rather than sending a set amount.
• Use a separate wallet for interacting with new apps, keeping long-term holdings in one that rarely signs anything.
• Send a small test first when moving large amounts to a new address.

See what a wallet drainer is for the same idea used against individuals.

What changed

• Verify on independent devices: signers check transaction data on hardware wallets or separate tools, not only the web interface.
• Supply-chain security for wallet software and providers gained attention.
• Scrutiny of exchange reserves increased. See what proof of reserves is.

For earlier failures, read what happened to Mt. Gox and what happened when FTX collapsed. For the basics, see what crypto custody is.

This article is educational content and does not constitute financial, investment, legal or tax advice. Digital assets are volatile and you may lose the amount you invest.

Sources

• Lazarus hacked Bybit via breached Safe{Wallet} developer machine (code modified two days before; masked signing interface; 12:30 UTC) — BleepingComputer, February 2025
• FBI confirms Lazarus hackers were behind $1.5B Bybit heist — BleepingComputer, February 27, 2025
• SlowMist: Hacker techniques behind Bybit’s theft (contract replaced; operations normal February 22) — DeFiHackLabs
• Bybit’s $1.5B Hack (reserves restored by February 24) — 21Shares, February 2025
• Bybit offers $140M bounty in wake of $1.4B ETH hack (401,347 ETH; 90,376 stETH; 15,000 cmETH; 8,000 mETH; bridge loan covering 80%) — Benzinga, February 2025
• Bybit hack forensics show North Korean hackers exploited SafeWallet developer (malicious JavaScript in AWS; code removed two minutes after; 40,000 ETH borrowed from Bitget; links to Phemex, BingX, Poloniex) — Yahoo News, February 2025
• Bybit CEO says 20% of $1.4 billion theft has gone dark (83% converted to bitcoin across 6,954 wallets; 72% via THORChain; 79,655 ETH through eXch; 77% traceable, 3% frozen) — The Block, March 2025
• Bybit declares war on Lazarus with bounty program (up to 10% bounty; about $140 million) — The Register, February 2025
• A deep dive into the Bybit hack (funds split across 50 wallets within two hours) — HackerNoon, February 2025