# Bybit Ethereum cold wallet hack: Bybit loses about $1.46B in ETH from a cold wallet; FBI blames North Korea's Lazarus Group
Source page: https://vaultx.llc/hacks/bybit-hack-february-2025 · VaultX incident report by Sentinel · first published 2026-10-30, updated 2026-10-30
- Date: 2025-02-21
- Reported loss: $1.46B (Bybit's own timeline reportedly gives $1.46B (401,347 ETH plus 90,375 stETH and other liquid-staked variants). The FBI and later reports round it to about $1.5B. Early reports said $1.4B. The dollar value depends on the ETH price used.)
- Attribution: The FBI said North Korea was responsible, identifying the actors as TraderTraitor, more commonly known as Lazarus Group, for the theft of 'approximately $1.5 billion' in virtual assets. Blockchain researchers had pointed to Lazarus days earlier.
- Chains: Ethereum, Bitcoin (after laundering), multiple other blockchains (per FBI)
- Status: contained
- Severity: 93/100
- Response score: 85/100 (Bybit communicated quickly, kept withdrawals open, replenished reserves within days, offered bounties and later sued. Little of the money has been recovered, and the research contains no independent audit of its claims.)
On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets was compromised in a 'sophisticated attack', in what was reported as the largest crypto theft on record. According to Bybit and investigators, the attacker masked the signing interface and altered contract logic, so signers approved a transfer that sent funds to attacker-controlled addresses. The FBI attributed the theft to North Korea's Lazarus Group / TraderTraitor. Bybit stayed solvent, kept withdrawals open and replenished its reserves, but only a small share of the stolen funds has been frozen or recovered.

**What happened**
On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets had been compromised in a 'sophisticated attack'. Its timeline puts the loss at about $1.46B in a single wallet incident, made up of 401,347 ETH plus 90,375 stETH and other liquid-staked ETH variants (reported by Bybit).
The funds were reportedly split across 39 addresses, according to Bybit. The FBI reportedly listed 51 Ethereum addresses tied to the theft or laundering. ZachXBT reportedly published a larger set of linked wallets, with one report citing 920+ addresses. Per the FBI, the assets were later spread across thousands of addresses on multiple blockchains.
Researchers publicly accused Lazarus on Feb. 24, 2025. Forensic reporting on the Safe{Wallet} developer-machine compromise and FBI confirmation of Lazarus/TraderTraitor followed on Feb. 26–27, 2025.

**How it worked**
According to Bybit, this was not a simple theft of keys from its cold wallet. The attacker altered smart contract logic and masked the signing interface, so what looked like a legitimate transfer was signed and then redirected funds from the ETH cold wallet to attacker-controlled addresses.
Investigators later reported (BleepingComputer, The Block) that the breach involved a Safe{Wallet} developer machine or related Safe wallet infrastructure. The attacker reportedly used this access to manipulate what signers saw and approved. This is a supply-chain / signing-interface compromise: the signers' devices and keys were not necessarily broken, but the interface they trusted was tampered with.

**Where the money went**
After the theft, the assets were reportedly split into distribution wallets and fanned out into dozens of new addresses. The FBI said Lazarus converted some of the assets to bitcoin and obscured the rest by spreading them across thousands of addresses on multiple blockchains. Bybit offered bounties to exchanges, bridges and mixers that helped freeze funds. Bybit said it froze almost $43M shortly after the hack. A later report says $48.4M was recovered and $30.5M was frozen at more than 28 exchanges and custodians. These figures are reported, vary by date and source, and are a small fraction of the roughly $1.46B stolen. The research does not give a complete list of the mixer, bridge and exchange routes.

**The response**
Bybit said client assets were fully backed 1:1, withdrawals stayed open and the exchange remained solvent. It says it processed 99.994% of more than 350,000 withdrawal requests within 10 hours. It said it would cover the loss with corporate reserves and insurance/emergency funds, and reported fully replenishing reserves by Feb. 24, 2025, which did not recover the stolen crypto itself. It launched a Recovery Bounty Program with a 10% reward for recovered funds and worked with blockchain analytics firms, exchanges, custodians and international law enforcement. Bybit later sued North Korea and Lazarus Group and secured a preliminary injunction freezing stolen assets. The research found no clearly named regulator or police announcement as direct as Bybit's own statements, apart from the FBI attribution.

**Impact**
Crypto markets fell on Feb. 22, 2025 after the disclosure (New York Times). Bybit's own postmortem says Bitcoin fell over 20% in a broad sell-off, though this is Bybit's retrospective framing and not independent market data. Users rushed to withdraw, with more than 350,000 withdrawal requests, but Bybit says it met nearly all of them. According to Bybit, users' assets were not lost because the exchange covered the shortfall.

**Timeline**
- 2025-02-21 Bybit detects the incident; a cold-wallet transfer is redirected to attacker addresses. Bybit says the Ethereum cold wallet was compromised.
- 2025-02-21 Bybit says it processed 99.994% of more than 350,000 withdrawal requests within 10 hours and resumed normal operations within about 12 hours (Bybit's timeline).
- 2025-02-22 Major cryptocurrencies fall after the disclosure, according to the New York Times.
- 2025-02-24 Researchers and blockchain investigators publicly point to North Korea / Lazarus. Bybit says it fully replenished reserves (CNBC).
- 2025-02-26 Reporting says Lazarus apparently compromised a Safe{Wallet} developer machine ahead of the hack.
- 2025-02-27 The FBI publicly confirms Lazarus / TraderTraitor was behind the theft of about $1.5B.
- 2026-08 A reported update says Bybit had recovered $48.4M, with another $30.5M frozen at more than 28 exchanges and custodians (reported by Gate.com; exact date not given in the research).

**How to protect yourself**
- Users: custodial exchanges carry risk even when a company is large. Look for proof-of-reserves and public incident communication, and do not keep more on an exchange than you need.
- Builders: signers must verify what they sign independently of the signing interface (for example, on a separate device that decodes the transaction). Treat third-party wallet software and developer machines as part of the attack surface.
- Builders: protect against supply-chain compromise with isolated build and deployment environments, access controls on developer machines, and independent transaction simulation before signing.
- Everyone: a 'legitimate-looking' transaction in a UI can be falsified, so cold storage is not safe if the approval workflow is compromised.

**Still unknown**
- The precise live total of recovered and frozen funds. The $48.4M recovered and $30.5M frozen figures come from a single secondary report and vary by source and date.
- The full laundering path across mixers, bridges and exchanges, which the research summaries do not enumerate.
- The attacker wallet addresses. The research gives counts (39, 51, 920+) but no exact addresses, so none are listed here.
- The outcome of Bybit's lawsuit and injunction against North Korea and Lazarus Group.
- Whether independent sources confirm Bybit's claims about reserve replenishment and the 20% Bitcoin drop.

**Sources**
- Bybit security incident timeline https://www.bybit.com/en/learn/this-week-in-bybit/bybit-security-incident-timeline
- TechCrunch: Bybit says it was hacked and lost around $1.4B https://techcrunch.com/2025/02/21/crypto-exchange-bybit-says-it-was-hacked-and-lost-around-1-4-billion/
- TechCrunch: Researchers accuse North Korea of Bybit heist https://techcrunch.com/2025/02/24/researchers-accuse-north-korea-of-1-4-billion-bybit-crypto-heist/
- TechTarget: FBI says Lazarus Group behind $1.5B Bybit heist https://www.techtarget.com/cybersecurity/news/366619872/FBI-Lazarus-Group-behind-15-billion-Bybit-heist
- BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine https://www.bleepingcomputer.com/news/security/lazarus-hacked-bybit-via-breached-safe-wallet-developer-machine/
- BleepingComputer: FBI confirms Lazarus behind $1.5B Bybit heist https://www.bleepingcomputer.com/news/security/fbi-confirms-lazarus-hackers-were-behind-15b-bybit-crypto-heist/
- The Block: Lazarus appears to compromise Safe developer machine https://www.theblock.co/news/regulation/2025-02-26-lazarus-appears-to-compromise-safe-developer-machine-in-lead-up-to-1-5-billion-bybit-hack-report-343530
- The Block: Bybit hackers and the FBI's Lazarus confirmation https://www.theblock.co/news/regulation/2025-02-27-bybit-hackers-half-the-stolen-eth-bitcoin-fbi-confirms-lazarus-343855
- Gate.com: Bybit recovers $48.4M, $30.5M frozen https://www.gate.com/news/detail/bybit-recovers-484m-from-15b-north-korea-hack-305m-frozen-23372652
- CNBC: Bybit replenished reserves https://www.cnbc.com/2025/02/24/bybit-replenished-reserves-after-record-breaking-1point5-billion-hack.html
- Bybit press release: lawsuit and preliminary injunction https://www.bybit.com/en/press/post/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-bb55bb16f1710f487aa

---
VaultX: free crypto news and intelligence, https://vaultx.llc