Bybit hack: US$1.5 billion in ETH stolen and what the biggest crypto theft in history teaches
On February 21, attackers siphoned about 401,000 ETH from a Bybit cold wallet. Four days later, what is known is that the signers saw a fake screen, that North Korea is the main suspect and that the technical cause is still under investigation.
Historical reference: February 25, 2025. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- On 02/21/2025, about 401,000 ETH, more than US$1.4 billion, left a Bybit cold wallet in a single transfer: the biggest crypto-asset theft ever recorded.
- CEO Ben Zhou said the signers saw a tampered interface, with the correct address and a URL that looked like Safe's, while the signed message changed the wallet contract's logic.
- TRM Labs, Elliptic and investigator ZachXBT point to North Korea; the FBI had not commented as of this date.
- The central lesson is about process: blindly signing a transaction that the screen does not show in full defeats even a multi-signature cold wallet.
São Paulo, February 25, 2025 — On Friday, February 21, the Dubai-based exchange Bybit lost about 401,000 ETH, more than US$1.4 billion, in a single transfer. According to Elliptic, a blockchain analytics firm, it was approximately US$1.46 billion. It is the biggest crypto-asset theft ever recorded. The exchange says client funds remain covered, but the case exposes a flaw that technology alone does not solve: the moment when people approve a transaction.
- ETH siphoned in a single transfer (The Record, 02/24)
- ~401,000
- Amount stolen, according to Elliptic (02/23)
- US$1.46 bn
- Wallets that received about 10,000 ETH each within two hours, according to Elliptic
- 50
- Client withdrawals processed by Bybit since Friday, according to the exchange (The Record, 02/24)
- US$4 bn
What happened
Bybit kept most of its ETH in a multi-signature cold wallet: an address that requires approval from several people, out of the internet's direct reach. In a routine operation, the exchange moves part of the balance to a hot wallet, the one that stays connected and funds withdrawals. The attack happened during that transfer.
Ben Zhou, Bybit's CEO, confirmed the theft on Friday itself. According to him, the signers saw the correct address on the screen and a URL that looked like Safe's, the multi-signature wallet platform Bybit uses. The exchange said the signing interface was forged: the signed message changed the cold wallet contract's logic and gave the attackers control of it. Zhou said the exchange's other wallets were not affected.
When the signing device or app shows only a string of characters, the signer cannot confirm what is being authorized. If the computer screen lies, the signatures of several people end up validating the attack instead of preventing it.
Who is behind it
Attribution is still being made by private companies and investigators, not by authorities. Investigator ZachXBT presented evidence linking the attack to the Lazarus group, associated with the North Korean government, and Arkham Intelligence published the conclusion on February 21. TRM Labs said, with “high confidence,” that North Korean hackers were responsible, based on address overlaps with earlier thefts. Elliptic also attributed the action to North Korea, citing the pattern of swapping the stolen tokens for native ETH.
Swapping within minutes has a technical reason: token issuers can freeze balances, while no one can freeze native ETH. That is what happened to the part that was slow to be swapped: the mETH protocol blocked 15,000 cmETH (about US$43.5 million) and Tether froze US$181,000 in USDT, according to ForkLog. To understand that power in the case of the digital dollar, see what USDT is and who issues it.
Where the money went
- 02/21, FridayThe cold wallet is emptied. Within minutes, tokens such as stETH and cmETH are swapped for ETH on decentralized exchanges. Within two hours, 50 wallets receive about 10,000 ETH each.
- 02/21, eveningThe CEO says the exchange is solvent even without recovering the funds. Arkham publishes ZachXBT's evidence linking the attack to the Lazarus group.
- 02/22, SaturdayBinance, Bitget and other companies deposit ETH into Bybit, which processes nearly all pending withdrawals and launches a bounty program of 10% of the amount recovered.
- 02/23, SundayBybit reports that US$42.9 million was recovered with help from partners. Elliptic publishes the attribution to North Korea.
- 02/24, MondayTRM Labs tells The Record it has “high confidence” in North Korean authorship. Bybit reports about US$4 billion in withdrawals processed since Friday.
To launder the ETH, the attackers went through decentralized exchanges, according to Elliptic, and through bridges between networks to convert it into bitcoin, according to Bybit's CEO. The sooner an address is flagged, the greater the chance of a freeze, and that is how part of the funds was held back.
What is still not known
- Exact technical cause. Bybit attributes the attack to a tampered interface tied to Safe. Safe and independent experts were still investigating how the tampering happened.
- Official attribution. Analytics firms and investigators point to North Korea; U.S. authorities have yet to comment.
- How much will be recovered. The US$42.9 million recovered as of Sunday, according to Bybit, is little against US$1.46 billion.
Practical lessons for companies and individuals
This is an exchange case, but the underlying mistake applies to any company that pays with crypto assets: the failure lay in the human verification of a transaction, not in the cryptography.
For those who use USDT in payments, the point is the same: do not trust only what appears in the browser. The list of approved destinations, confirmation through a second channel and the test transfer, described in the guide on address poisoning, apply here too.
Frequently asked questions
How much did Bybit lose in the February 2025 attack?
About 401,000 ETH was siphoned on 02/21/2025, the equivalent of more than US$1.4 billion. Elliptic estimated US$1.46 billion. It was the biggest crypto-asset theft ever recorded.
Who was responsible for the Bybit attack?
On 02/25/2025, investigators and blockchain analytics firms such as ZachXBT, TRM Labs, Arkham and Elliptic pointed to the Lazarus group, linked to North Korea. There was no official government attribution as of that date.
What is blind signing?
It is approving a transaction without being able to read, on the signing device itself, what it does. The signer sees only encoded data and depends on the computer screen, which can be tampered with. Hardware wallets that display the details reduce this risk.
Did Bybit's customers lose money?
According to Bybit, no. The CEO said the exchange is solvent even without recovering the funds, and other companies deposited ETH into the exchange to restore the balance. Bybit reported that it processed about US$4 billion in client withdrawals in the following days.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- Bybit hack: the largest in history · Elliptic, Feb 23, 2025
- North Korea's Lazarus hackers behind $1.4 billion crypto theft from Bybit, researchers say · The Record, Feb 24, 2025
- Lazarus Group behind Bybit hack, says Arkham · ForkLog, Feb 22, 2025
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
