The Bybit theft

What happened

On 21 February 2025, Bybit, one of the largest cryptocurrency exchanges, moved ether from a cold wallet to a hot wallet, as it did routinely. Three of its signers approved the transfer. Less than three minutes later, 401,347 ETH left the wallet for an address the attackers controlled.¹

The signers had used Safe{Wallet}, a widely used web app for managing wallets that need several people to approve each transaction. Attackers had changed the app’s code so that, for Bybit’s wallet alone, the page showed one transaction while the signers signed another.²

How it worked

Bybit’s cold wallet was a Safe smart contract: a small proxy that holds the funds and passes every call to a separate contract holding the logic. The address of that logic contract sits in the proxy’s first storage slot.³

The altered JavaScript changed the transaction the signers were asked to approve. Instead of a plain transfer, it sent a delegatecall to a contract the attackers had deployed. A delegatecall runs the other contract’s code against the caller’s own storage. The attackers’ contract did nothing except write a new address into that first slot. Once the signers approved it, the wallet’s logic was the attackers’ Sweeper contract, whose sweepETH and sweepERC20 functions sent everything to the attackers without needing any further approval.³

The signers confirmed on hardware wallets, which showed the transaction as raw data that couldn’t readily be checked against what the web page showed.³ Bybit’s CEO, Ben Zhou, who signed last on a Ledger, said what he saw looked like a normal transfer from Safe’s official site.⁴

The code only activated for transactions from Bybit’s wallet and one other address, so other Safe{Wallet} users saw nothing unusual.⁵ About two minutes after the theft, clean copies of the files were uploaded in their place.²

How the attackers got in

Bybit’s own systems were not breached. Sygnia, which investigated for Bybit, found no sign of compromise there.⁵

The attackers got in through Safe{Wallet}. On 4 February, one of its developers, among the few with elevated access, ran a Docker project named MC-Based-Stock-Invest-Simulator-main on their Mac. The project talked to a domain registered two days earlier, and the laptop was taken over. The same group had previously approached developers on Telegram and asked them to help debug a Docker project.⁶

Safe{Wallet}’s AWS account required multi-factor authentication and a fresh login every 12 hours. The attackers tried and failed to register their own MFA device, then used the developer’s live session tokens from the infected laptop, timing their activity to the developer’s working hours. They spent about two weeks exploring before changing the website on 19 February.⁷

Who did it

The FBI attributes the theft to North Korea, under the name TraderTraitor.⁸ Mandiant, which investigated for Safe, tracks the same group as UNC4899. It is also known as Jade Sleet and PUKCHONG, and is part of what is commonly called the Lazarus Group.⁶ Before the FBI’s statement, independent investigators had already linked the stolen funds to addresses used in earlier North Korean thefts.⁵

Where the money went

The stolen ether was split across dozens of new addresses, and staked ether tokens were swapped for plain ether on decentralised exchanges. Most of it was then converted to bitcoin through THORChain, a protocol that swaps between blockchains without accounts or identity checks. Three THORChain validators voted to block the transactions; the vote was reversed within minutes.⁹

By 20 March, Bybit said 86% of the stolen ether had become 12,836 bitcoin spread across 9,117 wallets. Of the total, 3.5% had been frozen.¹⁰ The FBI asked exchanges, bridges and other services to block transactions involving the 51 addresses it had identified.⁸

Elliptic estimated that more than $200 million passed through eXch, an exchange that did not identify its customers. German police shut eXch down on 30 April 2025 and seized about $38 million in cryptocurrency.¹¹

What Bybit did

Zhou went on a livestream the same day and said the exchange had enough to pay every customer who withdrew.¹² Bybit offered a bounty of 10% of any funds recovered,¹³ and within three days said it had replaced the missing ether with loans from other firms, deposits from large holders and purchases.¹⁴

What changed afterwards

Safe rebuilt its infrastructure, rotated every credential and added checks on transaction data before restoring the service.⁵ Its smart contracts were not at fault.⁷

Bybit had hardware wallets and several signers, and lost the funds anyway, because every signer relied on the same compromised web page to tell them what they were signing. Investigators recommended devices that display transactions in readable form, checks that compare what is signed against an independent record, and contracts that do not allow delegatecall when they don’t need it.³

What it means for you

Bybit customers did not lose their balances: the exchange absorbed the loss.¹⁴ Nothing here calls for action by individuals.

The same applies to anyone with a hardware wallet. It protects you only if you can read and check what its screen shows before you approve; if it shows data you can’t check, you are trusting the computer it’s plugged into.

Footnotes

1. Etherscan: the transaction that replaced the wallet’s logic at 14:13:35 UTC, and the transfer of 401,347 ETH at 14:16:11 UTC. ↩

2. Sygnia, investigation into the Bybit hack. ↩ ↩²

3. NCC Group, in-depth technical analysis of the Bybit hack. ↩ ↩² ↩³ ↩⁴

4. CriptoNoticias, account of Ben Zhou’s livestream (in Spanish), 21 February 2025. ↩

5. BleepingComputer, Lazarus hacked Bybit via a breached Safe{Wallet} developer machine, 26 February 2025. ↩ ↩² ↩³ ↩⁴

6. The Hacker News, Safe{Wallet} confirms North Korean TraderTraitor hackers stole $1.5 billion in Bybit heist, March 2025. ↩ ↩²

7. CryptoSlate, Safe’s internal investigation reveals developer’s laptop breach led to Bybit hack, March 2025. ↩ ↩²

8. FBI, North Korea responsible for $1.5 billion Bybit hack, public service announcement I-022625-PSA, 26 February 2025. ↩ ↩²

9. The Block, Bybit hackers move over half the stolen ETH onto Bitcoin, largely using THORChain, 27 February 2025. ↩

10. Cointelegraph, Bybit’s $1.4B hack: 89% still traceable, 20 March 2025. ↩

11. The Record, German police take down eXch, 9 May 2025. ↩

12. Bitcoin.com News, Bybit livestream tackles ETH wallet breach, 21 February 2025. ↩

13. The Block, Bybit offers 10% bounty, 22 February 2025. ↩

14. The Block, Bybit CEO says exchange has closed shortfall in ETH reserves, 24 February 2025. ↩ ↩²