Bybit Crypto Exchange Hack Confirmed, $1.5 Billion On The Move
BREAKING: A staggering $1.5 billion in Ethereum is being transferred from Bybit, one of the world’s leading crypto exchanges, to an unknown wallet. The news, first highlighted by crypto researcher ZachXBT, is raising urgent questions about the security of Bybit’s hot wallet and the safety of users’ funds. Its suggested that Bybit’s hot wallet may have been compromised, possibly to a hack or otherwise security issue, with the funds now being actively sold on decentralized exchanges like Paraswap.
The situation escalated quickly as transaction details are pointing to a multi-signature wallet worth $1.5 billion in ETH being withdrawn to a new address. There are other reports of 401,346 ETH—valued at over $1.1 billion at the time—moving from Bybit to an unidentified destination. This highly unusual trading activity, including the conversion of liquid staking derivatives like stETH and mETH into native ETH, is raising red flags about whether this was a deliberate hack or an internal error. ZachXBT wrote about it “My sources confirm it's a security incident.”
For Ethereum investors and Bybit users, the stakes couldn’t be higher. With no official statement from Bybit as of 10:43 AM EST on February 21, 2025, the uncertainty is palpable. The crypto market has seen its share of hacks and breaches, but Bybit has historically maintained a strong security record. Yet, the scale of this transfer—potentially the largest unauthorized movement of funds in recent memory—has reignited fears about the vulnerabilities of even the most reputable exchanges.
ByBit Cofounder and CEO Confirms Hack
Ben Zhou the cofounder and CEO of Bybit exchange has confirmed there was a sophisticated hack on Bybit's Ethereum multisig cold wallet, where attackers manipulated the signing interface to trick signers into approving a change in the wallet's smart contract logic, allowing the theft of all ETH in that wallet.
Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change…
— Ben Zhou (@benbybit) February 21, 2025
This article was updated to reflect Bybit’s confirmation of the hack.