The Bybit Hack Explained: How $1.46 Billion Was Stolen and What Changed

On 21 February 2025, attackers drained about 401,000 ETH, worth roughly $1.46 billion, from a Bybit Ethereum cold wallet during a routine transfer to a warm wallet. The FBI later attributed the theft to North Korea’s TraderTraitor actors, the group widely known as Lazarus, in a public alert dated 26 February 2025. No customer deposits were lost: Bybit stayed solvent, processed every withdrawal within about 12 hours, and has since frozen or recovered only a small share of the funds.

What happened in the Bybit hack?

On 21 February 2025, hackers stole roughly $1.46 billion in Ethereum and related tokens from a Bybit cold wallet, the largest theft ever recorded from a crypto exchange. The signers approved a transaction that looked normal, but the Safe{Wallet} signing interface had been tampered with to redirect the funds. Bybit, a Dubai-based exchange that does not serve US residents, covered the loss from its own reserves.

Bybit was moving funds between its Ethereum cold wallet and a warm wallet as part of normal operations. The manipulated transaction changed the wallet’s smart-contract logic instead of just moving coins, handing the attackers full control. Our guide to how crypto exchanges work explains custody and withdrawal risk, and our Ethereum explainer covers the wallet and smart-contract basics behind the attack.

How much was stolen, exactly?

Bybit’s official timeline totals the loss at about $1.46 billion across four assets: 401,347 ETH, 90,375 stETH, 15,000 cmETH and 8,000 mETH. The FBI described the same theft as approximately $1.5 billion in virtual assets. The two figures differ only because asset prices moved between the moment of theft and later valuations.

These are the figures Bybit published in its official timeline, converted at the prices of the time. The FBI rounds the total to about $1.5 billion in its alert, and investigators describe the drain as more than 400,000 ETH in total.

How did the Bybit hack happen?

The hack was a supply-chain attack on Safe{Wallet}, the multisig platform Bybit used, not on Bybit itself. Investigators found a Safe developer’s laptop was compromised in early February 2025, its cloud credentials were stolen, and malicious JavaScript was added to the web page signers loaded. The code activated only for Bybit’s wallet, so signers saw a normal transaction while the real one replaced the wallet’s logic.

The forensic reports from Sygnia and Mandiant describe the chain of events. On 4 February 2025, a Safe developer’s macOS workstation was compromised through social engineering; a Docker project named “MC-Based-Stock-Invest-Simulator-main” in the machine’s downloads folder contacted the domain getstockprice[.]com. The attacker then used stolen AWS session tokens to enter Safe{Wallet}’s cloud environment, working during the developer’s normal hours and using ExpressVPN addresses and a Kali Linux user-agent to avoid notice.

On 19 February 2025, malicious JavaScript was injected into the storage bucket serving app.safe.global, set to trigger only when a transaction source matched Bybit’s contract address. On 21 February, during the cold-to-warm transfer, the script changed the operation into a delegatecall to a pre-deployed contract at 0xbdd0…9516, which replaced the wallet’s implementation and added sweepETH and sweepERC20 functions that drained the funds without further approvals. The code was removed about two minutes later, at 14:15 UTC. Sygnia concluded the malicious code came from Safe{Wallet}’s own AWS infrastructure, and that Safe’s smart contracts and Bybit’s systems had no vulnerability. See our wallet guide for how multisig and cold wallets are meant to work.

Who was behind the Bybit hack?

The FBI attributed the theft to North Korean state-sponsored actors it tracks as TraderTraitor, the group commonly called Lazarus, in a 26 February 2025 public alert. Blockchain analysts had already matched the laundering pattern to North Korea before that confirmation. The proceeds are assessed to fund the North Korean state, including its weapons programmes.

The FBI alert, number I-022625-PSA, listed 51 Ethereum addresses holding or tied to the stolen assets and asked RPC node operators, exchanges, bridges, analytics firms and DeFi services to block transactions from them. Elliptic had attributed the theft to North Korea based on laundering patterns days earlier. Wilson Center research notes North Korea-linked thefts of $660.5 million across 20 incidents in 2023 and $1.34 billion across 47 incidents in 2024, with one senior official estimating that cybercrime funds about half of the country’s foreign-currency earnings.

Laundering was unusually fast. Elliptic found the funds were moved into about 50 wallets holding roughly 10,000 ETH each within two hours, swapped through decentralised exchanges, then pushed through mixers such as Tornado Cash and Cryptomixer and the Wasabi Wallet, with the anonymous exchange eXch moving tens of millions of dollars despite Bybit’s requests to block it. The last of the original 50 wallets was emptied by 3 March 2025.

What was the Bybit hack timeline?

The incident ran from a developer compromise in early February 2025 to the FBI’s public attribution on 26 February 2025, with the theft itself on 21 February. Bybit restored withdrawals within about 12 hours and closed its Ethereum gap within 72 hours. The key dates below come from Bybit’s official timeline and the investigators’ reports.

How did Bybit respond, and did users get their money back?

Bybit said client assets were backed 1:1 and processed all withdrawal requests within about 12 hours, absorbing the loss from its own reserves rather than customer deposits. As of its June 2026 US court filing, only about $75.5 million, roughly 5% of the stolen amount, had been frozen or recovered, while about 90% of the funds had gone dark.

Within days, partners including Tether, THORChain, ChangeNOW, FixedFloat, Avalanche, CoinEx, Bitget and Circle helped freeze about $42.89 million, and the mETH Protocol separately recovered 15,000 cmETH worth nearly $43 million, according to Bybit’s timeline. Bybit launched a recovery bounty offering 10% of the stolen funds, then the LazarusBounty platform to coordinate tracing. On 18 June 2026, Bybit filed a civil RICO lawsuit in the US District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, the Lazarus Group and about 20 unnamed defendants, seeking return of the assets plus roughly $1.5 billion in compensation and punitive damages. The response is a reminder of why it matters which exchange holds your funds: an exchange must be able to cover losses from reserves. Before depositing with any platform, including a major exchange like HTX (formerly Huobi), check how it custodies funds and whether it publishes reserves; see our exchange hub and the HTX review.

What should users do now?

The Bybit hack is a reminder that custody is a user decision. The practical steps are to keep only trading money on exchanges, move long-term holdings to a hardware wallet you control, verify every transaction on the device screen before approving, and favour exchanges that publish audited proof of reserves. Crypto assets are volatile and this is not financial advice.

The specific trick used against Bybit was interface spoofing: the signers saw a legitimate address on screen while the underlying transaction was changed. To defend against the same tactic:

1. Confirm the destination address on the hardware wallet’s own screen, not the computer screen.
2. Check the recipient and contract match the address you intended, character by character.
3. Treat any unsolicited message asking you to “fix” a wallet or “synchronise” a balance as phishing.
4. Download wallet software only from the official vendor domain, never from a link in a message.
5. Ask whether your exchange publishes proof of reserves, as Bybit’s auditors reported after the hack.

What changed after the Bybit hack?

Safe{Wallet} rebuilt and reconfigured its infrastructure, rotated all credentials, and restored its wallet on Ethereum in phases, while committing to better transaction verifiability. Bybit tightened its signing process and reserve reporting. The theft also kept exchange custody under regulatory scrutiny, though the immediate fixes were operational rather than legal.

Safe’s 28 February 2025 statement said external researchers found no vulnerability in its smart contracts or source code, and that the attack reached Bybit through a compromised developer machine. Bybit’s auditor Hacken reported that reserves exceeded liabilities and that Bybit fully closed the Ethereum gap within 72 hours. Bybit’s chief executive said any proposal to roll back the Ethereum chain to reverse the theft should be a community decision, and no rollback happened. On the policy side, the hack fed a wider US debate over how exchanges should be supervised, described by CSIS as a test of whether stronger rules raise confidence or slow adoption. The core lesson for users did not come from regulators: it came from the fact that a single compromised developer machine moved a cold wallet’s funds.