InvertopediaThe encyclopedia of how things fail
Submit a failure
EntrySources
ReadSuggest an edit

Bybit hack

From Invertopedia, the encyclopedia of how things fail

Entry 094. An analysis built from the public record, not an insider account. Spot an error? Tell us.

Bybit is a crypto exchange with more than 60 million users[1]. On February 21, 2025, its signers approved a transaction from its ETH cold wallet that handed control of the wallet to hackers[3], who took 401,346 ETH worth about $1.4 billion at the time[4], a haul the FBI later put at about $1.5 billion and pinned on North Korea[2]. Investigators found no sign of compromise at Bybit's own systems[3]: the attackers had broken into a developer laptop at Safe Wallet, the multisig wallet service Bybit used, and planted code on its website that targeted Bybit's signers and activated only under set conditions[3][5].

Contents
  1. 1The bet
  2. 2What happened
  3. 3The kill shot
  4. 4Red flags ignored
  5. 5The cost
  6. 6The inversion
  7. 7What survived
  8. 8References

The bet

Bybit kept its ether in a cold, multi-signature wallet[9], the kind of wallet that in theory is not connected to the internet[4]. A multisig needs several people to approve each transaction, each signing it off with a hardware wallet[9]. The bet was that no single stolen key or hacked machine could move the money.

The signers approved transfers through app.safe.global, the Safe Wallet web app[3]. That made a page served from Safe's cloud account part of Bybit's vault, whether or not anyone thought of it that way[3].

What happened

2018Bybit is founded. It grows to more than 60 million users and about $20 billion in assets.[1]
Feb 4, 2025A Safe Wallet developer's workstation is compromised after it runs a malicious Docker project.[5][10]
Feb 5–17, 2025The attackers hijack the developer's active AWS session tokens to get around multi-factor authentication, then spend twelve days inside Safe's AWS environment.[5][10]
Feb 19, 2025Malicious JavaScript aimed at Bybit's Ethereum multisig cold wallet is placed in Safe Wallet's AWS S3 bucket.[3]
Feb 21, 2025Bybit's signers approve a transaction from the cold wallet. The rigged page swaps in a delegatecall to the attacker's contract, and over 400,000 ETH and stETH leave the wallet.[3][10]
Feb 21, 2025Two minutes after the theft, clean versions of the JavaScript files are uploaded to Safe's S3 bucket, removing the malicious code.[3]
Feb 21, 2025In a livestream, CEO Ben Zhou says Bybit has seen "massive withdrawals" and is seeking a bridge loan.[9]
Feb 24, 2025Bybit says it has refilled its reserves with nearly 447,000 ether from emergency loans and large deposits, confirmed by a proof of reserves audit from Hacken.[7]
Feb 26, 2025The FBI says North Korea is responsible and lists addresses it says the North Korean actors are using to launder the stolen assets. Safe confirms the attack came through a compromised developer machine.[2][3]
Mar 4, 2025The hackers have moved all the stolen ether and converted most of it to Bitcoin. A tracking firm says it is tracking about 90 percent of it, held in roughly 4,400 addresses.[11]

The kill shot

Bybit's signers checked what the Safe web page showed them, and the web page was the thing that had been hacked. Their hardware wallets signed a transaction that gave away control of the wallet, and none of them could see it.

Bybit's own post-mortem said the transaction "was manipulated by a sophisticated attack that altered the smart contract logic and masked the signing interface"[3]. The injected code was built to activate only when certain conditions were met[3]. For Bybit, it turned a normal call into a delegatecall to the attacker's contract, which gave the attacker control of the cold wallet[3][10].

Sygnia's forensic investigation found no evidence that Bybit's own systems were compromised[3]. The weak point was a developer laptop whose cloud session could change the page every signer relied on[5]. Safe's own lesson was blunt: "The act of signing the transaction itself currently is the last line of defense, and it can only be effective if the user can understand what they are signing"[5].

Red flags ignored

  • Someone else's page as the vault door. The signers approved transfers on app.safe.global, which was served from Safe's AWS S3 bucket.[3]
  • Signing what nobody could read. The page masked what the transaction really did, and the signers approved it anyway.[3]
  • One laptop, keys to the cloud. Hijacked AWS session tokens from a single developer's laptop got past multi-factor authentication.[5]
  • Nobody watching the intruder. The attackers were inside Safe's AWS environment for about two weeks before the theft.[5][10]
  • A big share of assets in one move. Zhou said the stolen funds were about one-twentieth of the assets Bybit managed, all taken in a single transfer.[9]

The cost

About $1.4 billion to $1.5 billion in ether[2][4][3], more than double the previous record, the roughly $620 million Ronin Network theft of 2022[1]. For scale, about $2.2 billion of crypto was stolen in all of 2024[4]. Ether fell about 4 percent on the day of the theft[1].

Bybit stayed open by borrowing and taking in nearly 447,000 ether[7], and offered bounties of up to $140 million, 10 percent of the stolen funds, for help freezing them[12][13]. By February 27, 12 bounty hunters had been paid about $4.2 million[12] and more than $40 million had been frozen[13], while TRM Labs said about $400 million had already been laundered[12]. Bybit did not get the stolen money back[8].

The inversion

Never sign a transaction you can only see through a web page you do not control. Decode and check it on a separate device, simulate what it will do, and treat any change to who controls the wallet as a hard stop.

What survived

Bybit. It refilled its reserves and kept withdrawals open[7], and by January 2026 Fortune called it the world's second-largest crypto exchange by trading volume[8]. Zhou said it had tightened its security since the hack, including using hardware security modules[8].

The FBI asked exchanges, bridges and other services to block transactions tied to the thieves' addresses[2].

References

  1. ^ “Cryptocurrency theft of £1.1bn could be biggest ever, says Bybit”. BBC News, February 22, 2025. Bybit's base in Dubai, founding year, 60 million users, $20 billion in assets, the 4 percent ether drop, and the previous $620 million Ronin record.
  2. ^ “North Korea Responsible for $1.5 Billion Bybit Hack”. FBI Internet Crime Complaint Center (IC3), February 26, 2025. The FBI's attribution to North Korea's TraderTraitor, the about $1.5 billion figure and date, the stolen-address list and the request to block those transactions.
  3. ^ “Lazarus hacked Bybit via breached Safe Wallet developer machine”. BleepingComputer, February 26, 2025. The Sygnia, Verichains and Safe findings: JavaScript injected into app.safe.global from Safe's AWS S3 bucket two days before the theft, the conditional payload, the clean files uploaded two minutes later, no compromise at Bybit or flaw in Safe's contracts, Safe's rebuild; and Bybit's post-mortem quote with over 400,000 ETH and stETH worth more than $1.5 billion.
  4. ^ “Crypto exchange Bybit says it was hacked and lost around $1.4B”. TechCrunch, February 21, 2025. 401,346 ETH worth about $1.4 billion, the cold wallet definition, and the $2.2 billion stolen in all of 2024.
  5. ^ “What Caused Bybit's $1.4 Billion Ethereum Hack? New Details Revealed”. Decrypt, March 6, 2025. Safe and Mandiant's findings: the developer workstation hacked on February 4 through a malicious Docker project, hijacked AWS session tokens bypassing MFA, and Safe's last-line-of-defense quote.
  6. ^ “North Korea behind $1.5bn hack of crypto exchange ByBit, says FBI”. The Guardian, February 27, 2025. The FBI attribution and North Korea's Lazarus Group.
  7. ^ “Bybit replenished reserves after record-breaking $1.5 billion hack”. CNBC, February 24, 2025. Reserves refilled in under 72 hours with nearly 447,000 ether from loans and deposits, the Hacken audit, and withdrawals kept open.
  8. ^ “TradFi firms are increasingly warming to cryptocurrencies, says Bybit CEO Ben Zhou”. Fortune, January 22, 2026. Funds not recovered but reserves restored, Bybit as the second-largest exchange by volume, and the move to hardware security modules.
  9. ^ “Bybit Seeing 'Massive Withdrawals' After $1.4 Billion Ethereum Theft: CEO”. Decrypt, February 21, 2025. Zhou's livestream: massive withdrawals, no suspension, the bridge loan, the multisig description and the stolen funds as about 1/20 of assets.
  10. ^ “Not So Safe”. Rekt, March 2025. The Mandiant timeline as summarized by Rekt: the February 4 compromise, AWS access from February 5, twelve days of reconnaissance, and the call swapped for a delegatecall.
  11. ^ “Hackers launder most of Bybit's stolen crypto worth $1.4B”. TechCrunch, March 4, 2025. All stolen ether moved and most converted to Bitcoin; Chainalysis tracking about 90 percent across about 4,400 addresses.
  12. ^ “FBI urges crypto community to avoid laundering funds from Bybit hack”. The Record (Recorded Future News), February 27, 2025. Bounties of up to $140 million, 12 hunters paid about $4.2 million, and TRM Labs' estimate of $400 million laundered.
  13. ^ “FBI officially fingers North Korea for $1.5B Bybit crypto-burglary”. The Register, February 27, 2025. The 10 percent bounty and more than $40 million frozen.
Categories: Crypto · Exchange · Hacked in 2025 · Cause of death: supply-chain hack · From the public record