A hack on Bybit late Friday night led to a $1.4 billion theft. However, the exchange has now fully restored its 1:1 asset backing for customer funds and has successfully closed the “Ethereum gap” caused by the breach.
Attack Details
Hackers employed an advanced exploit to gain access to one of Bybit’s cold (offline) Ethereum wallets. They used a technique that bypassed the exchange’s multi-layered security system, allowing them to take control of the transaction-signing process.
The attack specifically targeted Bybit’s multi-signature wallet setup. The hackers deployed a fake user interface and manipulated the logic of the underlying smart contract, tricking the system into approving a transaction that appeared legitimate but actually transferred control of the wallet to the attackers.
Bybit’s Response
Bybit’s CEO, Ben Zhou, acted swiftly, immediately issuing a public statement confirming the hack. He reassured users that only one cold wallet was affected and that all other funds remained secure. Shortly after, Zhou held an emergency livestream, addressing customer concerns and confirming that Bybit had sufficient reserves to cover all losses.
Despite the scale of the attack, Bybit did not suspend withdrawals. In just 10 hours, the exchange processed over 350,000 withdrawal requests, marking a record-breaking transaction volume.
Cybersecurity experts and blockchain analysts—including ZachXBT and Arkham Intelligence—have linked the Bybit hack to Lazarus Group, a North Korean hacking collective notorious for previous high-profile crypto heists, including the $600 million Ronin network breach.
Exchange Fully Operational Again
Over the past two days, Bybit has received 446,870 ETH ($1.23 billion worth) through loans, major deposits, and Ethereum purchases, according to Lookonchain, a blockchain tracking service.
Blockchain data shows that over $400 million was acquired over-the-counter (OTC). Around $300 million came directly from exchanges. Nearly $300 million was obtained through crypto loans. The remaining funds came from wallets linked to cryptocurrency funds.
By late Sunday, a Bybit representative confirmed that all deposit and withdrawal operations “had returned to normal”. Moreover, total deposits slightly exceeded withdrawals, just as they had on Saturday—a sign that market confidence remains strong.
