Cryptocurrency detective ZachXBT reported suspicious outflows exceeding $1.46 billion from Bybit accounts. Shortly thereafter, Bybit CEO Ben Zhou confirmed suspicions of a hack.
Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change…
— Ben Zhou (@benbybit) February 21, 2025
In a special livestream, Zhou noted that the exchange continues to process withdrawal requests, although due to increased activity, processing may take longer than usual.
He also mentioned that Bybit is discussing an ETH loan with partners. The platform remains solvent, and the funds are needed to cover Ethereum liquidity during the crisis period.
Binance founder Changpeng Zhao offered Bybit’s head assistance in addressing the incident’s aftermath and recommended suspending withdrawals as a precautionary measure.
He emphasized that only one wallet was affected, other funds are secure, and withdrawals remain available.
According to the exchange’s official statement, the incident occurred during the transfer of ETH from a cold multisig storage to a warm wallet.
Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing…
— Bybit (@Bybit_Official) February 21, 2025
The attackers altered the transaction signing interface so that all participants saw the correct address. Meanwhile, the smart contract logic was changed, allowing hackers to gain control over the ETH wallet and transfer all funds to an unidentified wallet.
The team is investigating the attack with experts and partners. Users have been assured of the safety of their funds. Platform operations have not been suspended.
According to ZachXBT, the unknown perpetrators have already exchanged part of the stolen mETH and stETH tokens for ETH through decentralized exchanges. 10,000 ETH were divided among 36 wallets. The investigator urged crypto platform operators to block suspicious addresses from the provided list.
The founder of DeFi Llama, known as 0xngmi, noted that the hackers’ methods in this attack are similar to the incident with the Indian exchange WazirX, which suffered approximately $235 million in losses from a hack in July 2024. At that time, the perpetrators also manipulated transaction data.
As reported by Chainalysis, losses from crypto fraud in 2024 amounted to at least $9.9 billion.