Bybit hack — February 2025

Bybit lost roughly $1.4bn to $1.5bn of Ethereum on 21 February 2025 in what is, by value, the largest cryptocurrency theft recorded. The exchange was moving funds from a cold wallet to a hot wallet through Safe{Wallet}, the multisig platform used in its signing workflow, when the transfer was rerouted to addresses the attacker controlled.

The compromise was not of Bybit's own contracts. Infrastructure belonging to Safe{Wallet} was breached, and the signers were shown a transaction that differed from the one they were actually approving. Once signed, the funds were converted to Bitcoin and other assets and spread across thousands of addresses.

The FBI attributed the theft to North Korean actors it tracks as TraderTraitor, also known as Lazarus Group and APT38, in a public service announcement five days later, and published laundering addresses so that providers could block them.

Published loss figures differ: the FBI cited approximately $1.5bn, while several analyses put the figure nearer $1.4bn. The difference is a valuation question rather than a dispute about what was taken, and both figures are recorded here.

Bybit covered the loss itself. On 24 February 2025 chief executive Ben Zhou said the exchange had fully closed the ETH gap, through loans, deposits and purchases, and that an audited proof of reserves would show client assets backed 1:1 again. In August 2026 Bybit said about $48.4 million of the stolen assets had been recovered and more than $30.5 million frozen at over 28 exchanges and custodians, a combined $78.9 million that this registry counts as recovered, about 5% of the loss. It also announced a civil lawsuit against North Korea, its Reconnaissance General Bureau and the Lazarus Group in the US District Court for the District of Columbia, with a preliminary injunction freezing identified stolen assets held by unnamed parties.