Bybit Suffers Major $1.5 Billion Security Breach

TLDR

• Bybit lost $1.5 billion in Ethereum due to a hack.
• Lazarus Group exploited a vulnerability in Bybit’s wallets.
• At least $160 million was laundered within 48 hours.

Bybit, a cryptocurrency exchange based in Dubai, suffered a significant security breach in February 2025. A reported $1.5 billion in Ethereum was lost, marking one of the largest hacks in the cryptocurrency industry’s history.

The attack was attributed to the North Korean state-sponsored hacker group, Lazarus Group, also known as TraderTraitor. The incident led to a strong industry focus on recovery efforts, rather than a full recovery, by January 2026.

Details of the Attack and Entity Involvement

The hackers exploited a vulnerability during a routine transfer between Bybit’s cold and hot wallets. A supply chain vulnerability involving malicious JavaScript injected into the Gnosis Safe wallet user interface was the attack vector used. This tricked Bybit’s CEO, Ben Zhou, and other signers into approving the unauthorized transaction.

In response, Bybit invited blockchain analytics firms to aid in tracing the stolen assets. The exchange has also introduced a bounty program, offering 10% of recovered funds to ethical hackers who assist in the recovery process.

Active Measures for Asset Recovery

Bybit enlisted the help of Chainalysis to trace the stolen assets, with TRM Labs playing a critical role by tagging related addresses as “Hacked.” The stolen funds, primarily Ethereum, were rapidly converted to Bitcoin and other cryptocurrencies, complicating recovery efforts.

According to on-chain data, at least $160 million of the stolen assets were laundered within 48 hours of the attack. TRM created a dedicated tracker, “Bybit Exploiter Feb 2025,” for real-time monitoring of the assets.

History and Context of Similar Incidents

The Lazarus Group, known for its high-profile cyber heists, stole $1.34 billion over 47 incidents in 2024 alone. This figure was nearly double that of 2023. The group’s activities have continuously posed significant threats to the cryptocurrency industry.

Previous major hacks, such as those involving Mt. Gox, Bitfinex, and FTX, have raised concerns about the security of cryptocurrency exchanges. However, none have reached the scale of the Bybit breach.

Official Responses and Industry Reactions

The FBI released a Public Service Announcement from IC3 on internet crime awareness, confirming the attack’s attribution to North Korea’s TraderTraitor. The FBI warned about the laundering of stolen assets across different blockchain networks.

In the wake of the breach, Bybit has called upon the crypto community to support recovery efforts. Organizations such as Chainalysis and TRM Labs are actively tracking the movement of the stolen assets.