Bybit Ethereum cold wallet hack: Bybit loses about $1.46B in ETH from a cold wallet; FBI blames North Korea's Lazarus Group
On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets was compromised in a 'sophisticated attack', in what was reported as the largest crypto theft on record. According to Bybit and investigators, the attacker masked the signing interface and altered contract logic, so signers approved a transfer that sent funds to attacker-controlled addresses. The FBI attributed the theft to North Korea's Lazarus Group / TraderTraitor. Bybit stayed solvent, kept withdrawals open and replenished its reserves, but only a small share of the stolen funds has been frozen or recovered.
What happened
On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets had been compromised in a 'sophisticated attack'. Its timeline puts the loss at about $1.46B in a single wallet incident, made up of 401,347 ETH plus 90,375 stETH and other liquid-staked ETH variants (reported by Bybit).
The funds were reportedly split across 39 addresses, according to Bybit. The FBI reportedly listed 51 Ethereum addresses tied to the theft or laundering. ZachXBT reportedly published a larger set of linked wallets, with one report citing 920+ addresses. Per the FBI, the assets were later spread across thousands of addresses on multiple blockchains.
Researchers publicly accused Lazarus on Feb. 24, 2025. Forensic reporting on the Safe{Wallet} developer-machine compromise and FBI confirmation of Lazarus/TraderTraitor followed on Feb. 26–27, 2025.
How it worked
According to Bybit, this was not a simple theft of keys from its cold wallet. The attacker altered smart contract logic and masked the signing interface, so what looked like a legitimate transfer was signed and then redirected funds from the ETH cold wallet to attacker-controlled addresses.
Investigators later reported (BleepingComputer, The Block) that the breach involved a Safe{Wallet} developer machine or related Safe wallet infrastructure. The attacker reportedly used this access to manipulate what signers saw and approved. This is a supply-chain / signing-interface compromise: the signers' devices and keys were not necessarily broken, but the interface they trusted was tampered with.
Timeline
- 2025-02-21Bybit detects the incident; a cold-wallet transfer is redirected to attacker addresses. Bybit says the Ethereum cold wallet was compromised.
- 2025-02-21Bybit says it processed 99.994% of more than 350,000 withdrawal requests within 10 hours and resumed normal operations within about 12 hours (Bybit's timeline).
- 2025-02-22Major cryptocurrencies fall after the disclosure, according to the New York Times.
- 2025-02-24Researchers and blockchain investigators publicly point to North Korea / Lazarus. Bybit says it fully replenished reserves (CNBC).
- 2025-02-26Reporting says Lazarus apparently compromised a Safe{Wallet} developer machine ahead of the hack.
- 2025-02-27The FBI publicly confirms Lazarus / TraderTraitor was behind the theft of about $1.5B.
- 2026-08A reported update says Bybit had recovered $48.4M, with another $30.5M frozen at more than 28 exchanges and custodians (reported by Gate.com; exact date not given in the research).
Where the money went
After the theft, the assets were reportedly split into distribution wallets and fanned out into dozens of new addresses. The FBI said Lazarus converted some of the assets to bitcoin and obscured the rest by spreading them across thousands of addresses on multiple blockchains. Bybit offered bounties to exchanges, bridges and mixers that helped freeze funds. Bybit said it froze almost $43M shortly after the hack. A later report says $48.4M was recovered and $30.5M was frozen at more than 28 exchanges and custodians. These figures are reported, vary by date and source, and are a small fraction of the roughly $1.46B stolen. The research does not give a complete list of the mixer, bridge and exchange routes.
The response
Bybit said client assets were fully backed 1:1, withdrawals stayed open and the exchange remained solvent. It says it processed 99.994% of more than 350,000 withdrawal requests within 10 hours. It said it would cover the loss with corporate reserves and insurance/emergency funds, and reported fully replenishing reserves by Feb. 24, 2025, which did not recover the stolen crypto itself. It launched a Recovery Bounty Program with a 10% reward for recovered funds and worked with blockchain analytics firms, exchanges, custodians and international law enforcement. Bybit later sued North Korea and Lazarus Group and secured a preliminary injunction freezing stolen assets. The research found no clearly named regulator or police announcement as direct as Bybit's own statements, apart from the FBI attribution.
Market and user impact
Crypto markets fell on Feb. 22, 2025 after the disclosure (New York Times). Bybit's own postmortem says Bitcoin fell over 20% in a broad sell-off, though this is Bybit's retrospective framing and not independent market data. Users rushed to withdraw, with more than 350,000 withdrawal requests, but Bybit says it met nearly all of them. According to Bybit, users' assets were not lost because the exchange covered the shortfall.
What people say
65% negative · 15% positive · the rest neutral · themes: record-size theft, North Korea state-backed hacking, supply-chain / signing-interface weakness, praise for Bybit's withdrawal handling and solvency messaging, low recovery rate
How to protect yourself
- Users: custodial exchanges carry risk even when a company is large. Look for proof-of-reserves and public incident communication, and do not keep more on an exchange than you need.
- Builders: signers must verify what they sign independently of the signing interface (for example, on a separate device that decodes the transaction). Treat third-party wallet software and developer machines as part of the attack surface.
- Builders: protect against supply-chain compromise with isolated build and deployment environments, access controls on developer machines, and independent transaction simulation before signing.
- Everyone: a 'legitimate-looking' transaction in a UI can be falsified, so cold storage is not safe if the approval workflow is compromised.
Still unknown
- The precise live total of recovered and frozen funds. The $48.4M recovered and $30.5M frozen figures come from a single secondary report and vary by source and date.
- The full laundering path across mixers, bridges and exchanges, which the research summaries do not enumerate.
- The attacker wallet addresses. The research gives counts (39, 51, 920+) but no exact addresses, so none are listed here.
- The outcome of Bybit's lawsuit and injunction against North Korea and Lazarus Group.
- Whether independent sources confirm Bybit's claims about reserve replenishment and the 20% Bitcoin drop.
Sources
- Bybit security incident timeline
- TechCrunch: Bybit says it was hacked and lost around $1.4B
- TechCrunch: Researchers accuse North Korea of Bybit heist
- TechTarget: FBI says Lazarus Group behind $1.5B Bybit heist
- BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine
- BleepingComputer: FBI confirms Lazarus behind $1.5B Bybit heist
- The Block: Lazarus appears to compromise Safe developer machine
- The Block: Bybit hackers and the FBI's Lazarus confirmation
- Gate.com: Bybit recovers $48.4M, $30.5M frozen
- CNBC: Bybit replenished reserves
- Bybit press release: lawsuit and preliminary injunction
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
VaultX