Bybit, one of the world’s leading cryptocurrency exchanges, experienced a devastating security breach on February 21, 2025, resulting in the theft of approximately $1.4 billion in digital assets. This incident now stands as the largest crypto exchange hack ever recorded.
How the Attack Unfolded
The breach involved the unauthorized transfer of 401,347 Ether (ETH) and various staked Ether tokens from Bybit’s cold wallet—a storage method typically considered safer than online hot wallets. The stolen funds were first moved into a primary wallet before being dispersed across multiple unidentified addresses, making them difficult to track.
Security Experts Identify the Attackers
Blockchain analytics firm Arkham Intelligence swiftly responded by offering a bounty of 50,000 ARKM tokens (valued at approximately $31,600) for any information leading to the attackers.
Later that day, renowned on-chain security expert ZachXBT provided definitive proof linking the attack to Lazarus Group, a North Korean state-sponsored hacking organization. His findings were based on test transactions, connected wallets used before the exploit, and forensic blockchain analysis.
Bybit’s Response and Next Steps
Bybit’s co-founder and CEO, Ben Zhou, reassured users that the exchange remains fully solvent despite the massive loss. He confirmed:
- All customer assets remain backed 1:1.
- Withdrawals are processing as usual, with no interruptions.
- Bybit is securing a bridge loan from partners to cover any unrecovered funds.
The scale of this hack has shaken the cryptocurrency community, reigniting concerns over exchange security and the growing threat of state-sponsored cyberattacks. Experts are calling for enhanced security measures and increased collaboration across the industry to fortify digital assets against sophisticated hacking groups like Lazarus.
