Bybit Hack (2025)

As of October 2026: Frozen and traceable percentages are Bybit's own estimates, last reviewed here for April 20, 2025, and they change as funds move. The sources reviewed in October 2026 report no arrests for the theft. Bybit's August 2026 lawsuit against North Korea is known from a CoinDesk report; the court filing was not reviewed. This page does not state a count of FBI-listed or other attacker addresses, because published counts vary.

Also known as: Bybit theft · Bybit US$1.5 billion heist · Bybit exchange hack.

What happened?

On Friday, February 21, 2025, the exchange Bybit started a routine transfer from one of its Ethereum cold wallets to a warm wallet. At about 14:13 UTC the wallet’s contract logic was altered and its funds were sent to addresses controlled by attackers. Bybit reported the loss as 401,347 ETH, 90,375 stETH, 15,000 cmETH and 8,000 mETH, about US$1.46 billion, from a single cold wallet. It said its other cold wallets were unaffected.

The wallet was a multisignature wallet, meaning several people had to approve each transfer. The attackers beat that control without breaking the cryptography. According to Sygnia’s review, they first compromised a developer’s Mac at Safe{Wallet}, the company whose web interface Bybit’s signers used, then used the developer’s cloud access to alter code that the interface served. The altered code was set to act only on Bybit’s wallet and one other address. The signers saw an ordinary-looking approval screen, and the real transaction handed control of the wallet to the attackers.

Which techniques did it use?

Once the funds were out, speed was the method. Elliptic reported that within minutes some of the stolen tokens were swapped for ether on decentralized exchanges, and that within two hours the funds were spread over about 50 wallets holding roughly 10,000 ETH each, which were then emptied over nine days. Bybit said the theft first fanned out across 39 addresses.

The main route, by Bybit’s March 4 count, was a cross-chain swap: 361,255 ETH, 72% of the total, went through the THORChain protocol, and 83% of the total had become bitcoin spread over 6,954 wallets. Another 16% (79,655 ETH) went dark through eXch, a swap service that advertised that users need not be identified, and 8% went through an OKX web3 proxy. By April 20 Bybit reported that 944 BTC, about 6.34%, had gone to the Wasabi mixer, with smaller amounts reaching CryptoMixer, Tornado Cash and Railgun, before more swaps and, eventually, over-the-counter or peer-to-peer cash-out. This is chain-hopping and mixing layered on top of each other; the layering page explains why.

How was it found?

The ledger did what a public ledger does. An independent on-chain analyst, claiming a bounty from Arkham Intelligence, linked the cluster to earlier North Korean activity within hours, and Elliptic attributed the theft to North Korea before the FBI did. Chainalysis said it based its attribution on consistent tactics and on funds consolidating with other known North Korean hacks.

On February 26 the FBI formally attributed the theft to North Korea, which it calls TraderTraitor, and published a list of Ethereum addresses it said were operated by or closely tied to the actors. It asked RPC node operators, exchanges, bridges, analytics firms, DeFi services and other virtual asset service providers to block transactions with or derived from addresses used to launder the funds. The public call matters: it turns a private investigation into a shared blocklist. For the method see blockchain analytics.

What was the outcome?

• Freezes. Bybit’s timeline says that by February 23 US$42.89 million was frozen with help from partners including Tether, THORChain, ChangeNOW, FixedFloat, Avalanche, CoinEx, Bitget and Circle, and that mETH Protocol recovered 15,000 cmETH worth nearly US$43 million. Tether’s CEO announced a freeze of US$181,000 in USDT. Chainalysis said it helped freeze more than US$40 million.
• The first reckoning. On March 4, Bybit said 77% of the stolen value was still traceable, 20% had gone dark and 3% was frozen, and that 11 bounty hunters had been paid US$2,178,797 in USDT.
• The second. On April 20, Bybit’s figures were 68.57% traceable, 27.59% dark and 3.84% frozen, and it said 70 of 5,443 bounty reports in the previous 60 days were valid.
• A service shut down. On April 30, 2025 German authorities seized the eXch servers and about EUR 34 million in crypto. The BKA’s release describes eXch as a service that took in bitcoin of criminal origin, but it does not mention Bybit, so the link between the two is Bybit’s tracing, not a German finding.
• Bybit stayed solvent. It said it replaced the missing ETH within roughly two days through bridge loans, deposits and over-the-counter purchases, and kept withdrawals running.
• Civil action. CoinDesk reported that Bybit sued North Korea, its intelligence bureau and the Lazarus Group in a federal court in the District of Columbia on August 7, 2026 and won an injunction freezing certain assets. The sources reviewed report no criminal arrests.

What were the warning signs?

• Test transactions and linked wallets. Per Bybit’s timeline, an on-chain analyst’s proof cited test transactions and connected wallets that tied the attack to earlier North Korean cases.
• A hidden change to what signers saw. The warning sign was not on the blockchain. It was a mismatch between what the screen showed and what the wallet was about to execute.
• Funds splitting into dozens, then thousands, of wallets within hours. That pattern, plus rapid swaps into ether and bitcoin, is a recognizable sign of a planned laundering run.
• Deposits from FBI-listed addresses. Exchanges that screened for the published list could refuse or freeze matching deposits.
• Services that refuse to block. Elliptic reported that eXch declined to block the activity, which made it a natural next target.

What changed afterwards?

Bybit became the reference case for how fast a state-backed crew can move stolen crypto, and for how limited tracing alone is. Investigators named the actor within days and mapped most of the movement, yet only a few percent was frozen. The lesson for exchanges is operational: signers should verify what a transaction actually does, and platforms should be able to act on a published address list quickly.

The case also produced unusually open reporting. Bybit’s regular reporting of traceable, dark and frozen funds, and its bounty platform, gave the industry a public scoreboard. For the broader picture of how North Korea steals and launders, see the Lazarus Group case, the bridge hacks case and the older Bitfinex hack, and for the legal framing see sanctions evasion.

First published October 4, 2026 · Last updated October 4, 2026 · Legal statuses current as of October 2026