jakiro
Author: Spirit, Bitchain Vision
Event Overview
On February 21, 2025, cryptocurrency exchange Bybit disclosed that its Ethereum multiple cold wallets encountered unauthorized activities, resulting in the theft of nearly $1.5 billion in ETH and stETH assets.Preliminary analysis points to hackers using carefully planned attacks to successfully control Bybit’s ETH cold wallet and transfer funds through complex technical means such as disguising the transaction interface and replacing smart contracts.
After the incident, Bybit quickly issued a statement, initiated an investigation, and sought external financial support to deal with the user withdrawal wave.This incident is the largest single stolen incident in cryptocurrency history, has caused market fluctuations and attention to the security of centralized exchanges.
Event Timeline (HKT, UTC+8)
The following timeline is based on public information and is based on Hong Kong time (HKT, UTC+8):
February 19, 2025 15:15 HKT (UTC 07:15):The malicious contract is deployed (contract address: `0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516`).Analysis by the Slow Fog Team shows that the malicious contract is the pre-deployment link of this attack.
February 21, 2025 14:13 HKT (UTC 06:13):The hacker used three Owner signatures to initiate a transaction (transaction hash: `0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882`), replacing the Safe implementation contract with Bybit multi-signed cold wallet with the above malicious contract.This is considered a critical step in the attack and paves the way for subsequent fund theft.
February 21, 2025 23:30 HKT Around:Bybit Ethereum hot wallet abnormally transferred funds, and about $1.5 billion of ETH and stETH were stolen.X (formerly Twitter) user @OrdzWorld was the first to monitor the abnormal transfer of Bybit cold wallet to warm wallet.
February 21, 2025 23:48 HKT:Bybit CEO Ben Zhou posted on social media, acknowledging that an unauthorized ETH cold wallet transfer occurred, and initially judged it as “blocking UI spoof attacks”, and emphasized that other cold wallets are safe and withdrawals are normal.
February 21, 2025 23:51 HKT:Bybit official account @Bybit\_Official issued an official statement on the X platform, confirming that the unauthorized activity of ETH multi-signature cold wallet was detected, and said that the attacker manipulated the transaction through a complex attack disguised the signature interface.Bybit has declared an investigation started and stressed the security of user funds.
February 22, 2025 00:11 HKT:Bybit CEO Ben Zhou once again posted a message emphasizing that Bybit is solvency and the user assets are guaranteed 1:1.
February 22, 2025 01:00 HKT:Slow Mist Team @SlowMist\_Team disclosed more technical details on the X platform, pointing out that the malicious contract was deployed as early as February 19, and the attackers used the backdoor functions `sweepETH` and `sweepERC20` and `DELEGATECALL` logic to implement theft.
February 22, 2025 01:07 HKT:X user @web3golder reports Bybit is facing a wave of user withdrawals, and some stolen assets have been exchanged for ETH on decentralized exchanges (DEX), aggravating market concerns.
February 22, 2025 01:24 HKT:BitMart founder Sheldon posted on the X platform that BitMart has frozen the relevant addresses and will assist Bybit in recovering assets.
February 22, 2025 01:39 HKT:Security team Beosin analyzed that the handling fee for the hacker’s initial attack address comes from Binance Exchange.
February 22, 2025 05:23 HKT: On-chain detective ZachXBT (@ZachXBT) posted a document on the X platform to submit an evidence report, initially confirming that the attack was planned by the North Korean hacker group Lazarus Group.Arkham Intelligence forwarded the message.
February 22, 2025 07:27 HKT:Bybit’s official X platform has issued a statement saying that it has reported the case to the relevant departments and is working with on-chain analysis providers to identify and isolate the addresses involved and prevent hackers from selling ETH.
February 22, 2025 09:09 HKT:On-chain data analyst Ember (@EmberCN) monitored that Bitget supported 40,000 ETH loans to Bybit to alleviate withdrawal pressure.
February 22, 2025 09:14 HKT:Bitget CEO Gracy Chen posted a letter to support Bybit on the X platform, expressing his belief that Bybit’s customers’ funds are safe and there is no need to panic.
February 22, 2025 09:21 HKT:Web3 audit agency Hacken released a certificate of reserve update, saying that Bybit’s reserves still exceed liabilities and that user funds are fully supported.Bybit CEO Ben Zhou replied that Hacken’s audit proved Bybit’s ability to compensate for customer losses.
February 22, 2025 09:28 HKT:KuCoin CEO BC Wong expressed support for Bybit and said that KuCoin has assisted in monitoring the flow of funds and freezing suspicious assets.
February 22, 2025 09:30 HKT:Binance founder Zhao Changpeng (CZ) responded on social media that Binance has not yet borrowed funds from Bybit, and the transfer of related funds may be a personal behavior of giant whale.
February 22, 2025 09:35 HKT:Signing more wallet agreements Safe officially issued a statement saying that no code base leak was found and that the Safe function has been suspended for a thorough inspection.
February 22, 2025 09:38 HKT:On-chain monitoring shows that MEXC hot wallet has transferred 12,600 stETH to Bybit cold wallet, further providing liquidity support.
February 22, 2025 09:55 HKT:Bybit CEO Ben Zhou said Bybit is transferring USD 2.95 billion from cold wallets to hot wallets, as a planned strategy and not being hacked again.
Support and liquidity response from all parties
Bybit acted quickly after the incident, seeking support from multiple parties to address potential liquidity crises and user trust crises:
-
Bitget’s ETH loan: Bitget urgently lent 40,000 ETH (approximately US$105.9 million) to Bybit and directly transferred it to Bybit’s cold wallet address to alleviate users’ pressure to withdraw coins.This loan reflects the spirit of mutual assistance between exchanges in the same industry.
-
Bridge Loan: Bybit CEO Ben Zhou revealed that he has reached a bridge loan agreement with his partners for approximately 80% of the value of the stolen ETH (about $1.12 billion).The specific source of the loan has not been made public, but it may include Bitget’s loan.Bridging loans, as a short-term financing tool, are designed to quickly replenish liquidity and avoid Bybit’s need to buy ETH in the market immediately, causing further market volatility.
-
KuCoin assists in monitoring and freezing: KuCoin CEO said it has assisted Bybit to monitor the flow of stolen funds and freeze suspicious assets in an attempt to reduce losses.
-
Financial Audit and Solvency Proof: Hacken, a Web3 auditing agency that Bybit cooperates with, has released a certificate of reserve update. Bybit’s reserve fund still exceeds liabilities, and user funds can be fully supported.Bybit CEO Ben Zhou also said that Bybit is solvency and user assets are guaranteed 1:1. Even if the losses of hacker incidents cannot be recovered, Bybit can make up for user losses.
-
User Withdrawal Processing: Bybit CEO stated that the platform withdrawal function was functioning normally and emphasized that 99.994% of withdrawal requests were completed, but admitted that there could be delays in handling large amounts of withdrawal requests.
Event background andrevealIndustry Trends
Bybit Exchange Overview: Founded in 2018 and headquartered in Singapore, Bybit is a cryptocurrency exchange mainly engaged in derivatives trading. It has more than 10 million users and has a certain influence in the industry.
Cryptocurrency theft incidents occur frequently: In recent years, centralized exchanges have become high-value targets for hackers due to their concentrated funds.The amount of stolen cryptocurrencies globally reached US$2.3 billion in 2024, while Bybit’s stolen amount exceeded 60% of the industry’s stolen amount last year, highlighting the severity of the industry’s security situation.Previously, well-known projects such as Ronin Network have also suffered large-scale thefts, indicating that hacker attack technology is constantly evolving and centralized platforms are facing continuous security challenges.
Early warning and long-term planning: The security agency disclosed that the malicious contract was deployed as early as February 19, indicating that the attack was not a temporary intention, but after a long period of careful planning and careful preparation.
Analysis of the cause of events
Technical vulnerabilities and social engineering attacks:
Preliminary analysis shows that the attacker may have taken advantage of the signature process loophole of Bybit’s multi-sign cold wallet, and tricked the multi-sign Owner into signing malicious transactions by pretending to disguise the transaction interface and replacing Safe to implement contracts.
The attacker may have combined social engineering methods (refer to the attack incident in October last year), such as invading the signature’s computer or intermediate communications link, replacing normal transaction requests with malicious transactions, reducing the signer’s vigilance.
The DELEGATECALL directive is exploited in malicious contracts, which may allow malicious code to be executed in the context of a multi-sign wallet, thereby modifying the contract logic and transferring funds.
The inherent risks of centralized exchanges:
As the centralized custodian of user funds, centralized exchanges naturally have the risk of “single point of failure” and are easily targeted by hackers.Bybit CEO Ben Zhou publicly acknowledged this inherent vulnerability of CEX as early as 2020.
External environmental factors:
The overall cryptocurrency market rebounded in February 2025, and the price of ETH rose, which may have stimulated hackers’ motives for theft.
Other encryption platforms such as ZkLend have also been attacked recently, reflecting that the overall security environment of the industry may deteriorate.
Event impact
Direct image of Bybitring:
Huge capital losses: $1.5 billion in assets were stolen, accounting for a large proportion of Bybit ETH deposits (about 75%).Cause direct economic losses to the exchange.
User trust crisis and currency withdrawal wave: Large-scale theft incidents may trigger users’ trust crisis in the security of Bybit platform, resulting in users’ centralized withdrawals, and put huge pressure on platform liquidity.
Short-term fluctuations in ETH price: After the event, the ETH price fell by about 3%, reflecting the market’s negative sentiment towards the event.
Reputation damage: Although Bybit actively responded and emphasized solvency, this incident undoubtedly had a certain negative impact on Bybit’s reputation.
Impact on the cryptocurrency industry:
Intensify the CEX trust crisis: The Bybit incident further exacerbates users’ concerns about the security of centralized exchanges, which may prompt some users to transfer funds to decentralized exchanges (DEXs) or choose a safer asset custody solution.
Regulatory pressure may increase: Historically, large-scale exchange security incidents have often attracted the attention and intervention of regulators.The Bybit incident may prompt regulators across countries to strengthen security audit and compliance regulatory requirements for CEX.
Promote industry security upgrade: This incident may become an important turning point in the field of crypto security, prompting exchanges, security institutions and developer communities to jointly promote the comprehensive upgrade of technical security and governance mechanisms, and improve the overall security level of the industry.
Possible to spark discussions about the Ethereum fork: Coinbase director Conor Grogan and cryptocurrency industry figure Arthur Hayes, etc., publicly discussed whether the incident may trigger discussions on the Ethereum fork similar to those after the DAO event, although the call for the fork may be more radical, but it also reflects the severity of the incident and the potential considerations of extreme situations within the industry.
Reactions from all parties in the industry
Bybit official: Bybit CEO Ben Zhou quickly disclosed the details of the incident after the incident and communicated with users through social media, live broadcasts, etc., emphasizing the normal solvency and operation of the platform, and trying to restore user trust through transparency and active communication.Bybit’s official statement has reported the case to the relevant departments and cooperated with security agencies to conduct investigations and funding tracking.
Audit security agencies: Blockchain security companies such as SlowMist and Beosin quickly intervened after the incident, analyzed the technical details of the attack, assisted Bybit to track stolen funds, and issued security warnings to the industry.
Centralized Exchange (CEX) peers:Exchanges such as Bitget, KuCoin, MEXC and Jucoin publicly expressed their support for Bybit and provided financial and technical assistance.BitMart promised to freeze suspicious addresses, and Binance founder Zhao Changpeng also said that Binance is willing to provide help if necessary.The collective support and mutual assistance of leading industry exchanges shows a attitude of responding to industry security risks.
Community and Analysts: Cryptocurrency community and industry analysts generally expressed concern and concern about this incident.Some users affirmed Bybit’s transparent communication, but more users expressed general concerns about CEX’s security.Analysts pointed out that the incident may prompt CEX to revisit and improve the multi-signature mechanism, smart contract security audit, and internal security processes.
summary
The 1.5 billion US dollar theft incident suffered by Bybit exchange is the largest single capital loss in the history of the cryptocurrency industry, and once again sounds the alarm for the security risks of centralized exchanges.The hackers carefully planned attacks, using technical vulnerabilities and social engineering methods, broke through the exchange’s multiple security lines, causing huge economic losses and trust crises.
Although Bybit encountered emergencies of security incidents, its rapid response and relatively open and transparent handling methods have effectively alleviated market anxiety.What is even more encouraging is that the assistance from peers and the active support of security agencies fully demonstrates the solidarity spirit of the cryptocurrency community to watch out for each other.While this incident reminds us of the risks in the industry, it also allows us to see the increasingly mature and strong resilience of the crypto field.
In the future, the cryptocurrency industry may usher in a comprehensive upgrade in the security field as a result of the incident.Centralized exchanges need to continue to strengthen investment in technology security and improve the level of security protection in multiple signing wallets, smart contracts, internal risk control, etc.Regulators may also further strengthen compliance supervision of CEX to promote healthier and orderly development of the industry.For users, this incident once again reminds users that asset security has always been the primary consideration for participating in the cryptocurrency market. It is becoming increasingly important to reasonably diversify risks and choose a safer asset custody solution.
Latest progress (as of February 22, 2025 09:55 HKT)
Bybit cooperates with Web3 auditing agency Hacken to release reserve certificates to prove the platform’s solvency.
Bybit CEO: USDT will be transferred from cold wallets to hot wallets
Bybit CEO: Already received nearly 80% of stolen ETH from partners as bridge loans
Bitget provides Bybit with 40,000 ETH loans, and MEXC hot wallet transfers 12,652 stETH to Bybit to alleviate liquidity pressure.
KuCoin assists Bybit to monitor fund flows and freeze suspicious assets.
Safe officially suspends Wallet functionality for comprehensive security checks.
Binance founder Zhao Changpeng clarified that Binance has not provided loans to Bybit, and the transfer of related funds may be the personal behavior of Giant Whale.
On-chain Detective ZachXBT confirmed that Lazarus Group was the mastermind of the attack.
Bybit hacker tried to unstake cmETH and was returned by the contract.
Bybit CEO said all withdrawals have been processed and a full incident report will be released.
