Bybit Hack Explained: How North Korea Stole $1.5 Billion From Bybit

Updated October 30, 2026.

The Bybit hack of February 21, 2025 was, when it happened, the largest crypto theft on record. Attackers took about 401,000 ETH plus roughly 113,000 staked-ETH tokens from one of Bybit's Ethereum cold wallets, worth about $1.5 billion. Five days later, the FBI named the culprit: North Korea's TraderTraitor group.

The interesting part is how. No private key was cracked, and investigators found no break-in at Bybit. Instead, attackers broke into a developer's laptop at Safe{Wallet}, the multisig wallet service Bybit used, and planted code in Safe's web app that only switched on for Bybit. When Bybit's signers approved what looked like a routine transfer, they were really handing over the wallet.

Below: the timeline, how the attack worked, how Bybit stayed solvent, where the money went, and how it compares with the Binance hack of October 2026, which followed a similar playbook at roughly four times the size.

Bybit hack: the short version

• When: Friday, February 21, 2025. The malicious transaction executed at 14:13:35 UTC, per Verichains.
• How much: About 401,347 ETH plus roughly 113,000 staked-ETH tokens (stETH, mETH, cmETH). Elliptic says about $1.46 billion; the FBI and Chainalysis say about $1.5 billion.
• How: Attackers compromised a Safe{Wallet} developer's Mac, got into Safe's cloud, and planted JavaScript that targeted only Bybit's cold wallet. The signers saw a normal transfer but signed away control of the wallet.
• Who: On February 26, 2025, the FBI attributed it to TraderTraitor, a North Korean unit usually grouped under the Lazarus umbrella.
• Customers: Bybit said client assets stayed backed 1:1. It never halted withdrawals and processed more than 350,000 withdrawal requests within about 12 hours.
• Recovery: By April 21, 2025, only 3.84% of the stolen funds had been frozen and 27.59% had "gone dark," Bybit's CEO said.
• The lesson: Multisig and hardware wallets don't help if the screen showing you the transaction is lying.

Bybit hack timeline: from a fake stock app to a $1.5B theft

The attack took weeks to set up and minutes to execute. Press play to walk through it.

How did the Bybit hack happen?

First, two plain-English terms. A cold wallet is a wallet kept behind extra controls for long-term storage. A multisig (multi-signature) wallet needs several people to approve a transaction before money moves. Bybit's Ethereum cold wallet was a Safe multisig, and its signers used Safe's web app, Safe{Wallet}, to propose and approve transfers, signing on hardware wallets.

The attackers went around all of that by compromising the thing every signer trusted: the web page showing them what they were signing.

Step 1: A developer laptop at Safe

According to Safe's March 2025 findings, reported by The Hacker News, attackers compromised the Mac of a Safe developer, "Developer1," on February 4, 2025. The developer had been socially engineered into running a Docker project dressed up as a stock-investing simulator. Safe said this was one of very few staff with higher-level access.

Step 2: Into Safe's cloud

The attackers tried to register their own multi-factor authentication (MFA) device and failed. So they hijacked the developer's active AWS session tokens from the infected laptop, timing their activity to the developer's schedule. A session token is the "already logged in" pass you get after signing in; stealing one skips the password and MFA.

Step 3: A booby-trapped web page only Bybit would see

Sygnia, the incident-response firm Bybit hired, found malicious JavaScript served from Safe{Wallet}'s AWS S3 bucket, the cloud storage behind Safe's website. It was changed on February 19, two days before the theft. Sygnia and Verichains both found it stayed dormant unless Bybit's cold wallet (or one other address) was involved, so every other Safe user saw a normal app.

Step 4: The signers approved a "routine transfer"

On February 21, Bybit started a planned transfer from its ETH multisig cold wallet to a hot wallet. The interface showed exactly that. Behind the scenes, NCC Group says, the tampered code changed the destination, the data and the type of operation. Sygnia found the malicious script cached on all the machines used to start and sign the transaction.

Step 5: The wallet changes hands, then the clean-up

The signed transaction used delegatecall, a feature that lets a wallet run another contract's code as if it were its own. The attacker's contract overwrote the setting that tells Bybit's wallet which code to run, so the attacker effectively owned it. Verichains says a 90 USDT test transfer came first, then about 401,347 ETH was drained; the staked-ETH tokens went too.

About two minutes later, clean versions of Safe's JavaScript were uploaded, Sygnia found. Safe says the attackers also removed their malware and cleared their command history.

Why the hardware wallets didn't catch it

Blind signing means approving a transaction your device can't show in readable form, so you see a hash or raw data instead of "send X to Y." NCC Group says Bybit's signers blind-signed without carefully checking the contents. A hardware wallet protects the key, but it signs whatever it's given. If the web page builds the wrong transaction, the device signs the wrong transaction.

Safe or Bybit: whose fault was it?

Sygnia found no compromise of Bybit's own infrastructure. Safe said its smart contracts and its frontend and services code were not compromised, and an external review found no vulnerabilities there; the weak point was one developer machine and its cloud access. Safe rebuilt its infrastructure, rotated all credentials, temporarily removed its native Ledger integration (the signing method used in the theft), and added extra checks on transaction hashes, data and signatures.

Who hacked Bybit? The FBI names TraderTraitor (Lazarus)

On-chain investigator ZachXBT spotted stolen funds going to an address previously used in the Phemex, BingX and Poloniex hacks. TRM Labs said "with high confidence" that North Korea was responsible, based on address overlaps with past North Korean thefts, and Elliptic agreed.

On February 26, 2025, the FBI made it official: North Korea did it, and the FBI calls the activity TraderTraitor. Its public service announcement listed 51 Ethereum addresses tied to the stolen funds and asked exchanges, bridges and others to block transactions linked to them. Safe's report named the same group, which is also tracked as Jade Sleet, PUKCHONG and UNC4899.

TraderTraitor had done this before. In December 2024, the FBI and Japanese police attributed the May 2024 theft of 4,502.9 BTC (about $308 million) from Japan's DMM Bitcoin to the same group. That attack also began with a compromised employee at a wallet-software supplier and worked by manipulating a legitimate transaction request.

Bybit defined North Korea's year. Chainalysis said it was about 69% of all crypto stolen in the first half of 2025, and later counted at least $2.02 billion stolen by North Korea-linked hackers in 2025 (through early December), a record, out of more than $3.4 billion stolen worldwide.

How Bybit stayed solvent after the hack

A $1.5 billion hole can sink an exchange, usually through a bank run. Bybit, then the world's second-largest crypto exchange by trading volume according to Khaleej Times, avoided one by staying open and paying out.

• It had the reserves. Bybit's incident notice said it had more than $20 billion in assets under management and that client assets remained backed 1:1.
• Withdrawals never stopped. More than 350,000 withdrawal requests were processed within 12 hours, and CEO Ben Zhou posted on February 22 that all withdrawals had been cleared.
• Bridge loans came first. A bridge loan is a short-term loan to cover a gap. On the day of the hack, Zhou said Bybit had already secured almost 80% of the stolen ETH that way. Bitget lent 40,000 ETH and MEXC lent 12,653 stETH, per Lookonchain data reported by crypto.news.
• Then it bought back. About $1.23 billion in ETH arrived through loans, large deposits and purchases, including 157,660 ETH (about $437.8 million) likely bought over the counter. On February 24, Zhou said Bybit had "fully closed the ETH gap" and promised an audited proof-of-reserves report.

Bybit said client activity was back to pre-hack levels within 24 hours.

The Bybit Lazarus bounty: a "war against Lazarus"

On February 22, Bybit launched a recovery bounty and invited the industry to join its "war against Lazarus." The terms: 10% of anything recovered, split 5% to whoever reports a traceable transfer and 5% to the exchange or mixer that freezes it, according to The Register. On a roughly $1.4 billion haul, that's up to $140 million.

The bounty site, lazarusbounty.com, also published the hackers' laundering activity so anyone could follow along. By April 21, Zhou said 70 of 5,443 reports from the previous 60 days were valid, and $2.3 million had been paid to 12 bounty hunters.

Bybit hack recovery: how fast the money moved, and what was frozen

The laundering started within minutes. Elliptic's tracing shows the shape of it:

• Minutes: Staked tokens such as stETH and cmETH were swapped for plain ETH on decentralised exchanges. Token issuers can freeze their own tokens; nobody can freeze ETH.
• Two hours: The funds were spread across 50 wallets holding about 10,000 ETH each.
• Nine days: Those wallets were emptied one by one, the last on March 3, 2025.

By March 4, Zhou said 72% of the funds had passed through THORChain, a cross-chain swap protocol, and 83% of the stolen ETH had become bitcoin spread across 6,954 wallets. About 79,655 ETH (16%) went through eXch, a no-ID exchange that, Elliptic says, refused Bybit's requests to block the activity. By April 21, about $960.3 million worth of ETH had become 10,003 BTC across 35,772 wallets. Funds passed through mixers including Wasabi, CryptoMixer, Tornado Cash and Railgun, and the trail ended at over-the-counter and peer-to-peer cash-out services.

What was frozen or recovered

• 15,000 cmETH (about $43 million), recovered by mETH Protocol on February 22. Its 8-hour withdrawal delay gave the team time to pause the contract.
• 181,000 USDT, frozen by Tether.
• $42.89 million in a day. That was Bybit's first-day tally of funds frozen with help from exchanges and networks. By early March, eleven parties, including Mantle, ParaSwap and ZachXBT, had helped freeze funds.
• 3.84% in total. By April 21, Zhou put it at 68.57% still traceable, 27.59% gone dark and 3.84% frozen.

There was fallout. eXch said it would shut down on May 1, 2025, and Chainflip briefly halted to ship an upgrade blocking the hackers. THORChain declined to add similar blocks, and some members left over it.

Bybit hack vs Binance hack 2026: the lessons

Twenty months later, Binance lost about $6.3 billion on October 29, 2026. TRM Labs attributes that theft with high confidence to the same TraderTraitor unit, though Binance hasn't named anyone. Our Binance hack explainer has the full story, but the shape is familiar:

• The way in: At Bybit, a developer's laptop at its wallet provider. At Binance, a DevOps engineer's laptop, according to the company.
• The trick: No private key leaked in either case. Bybit's signers approved a tampered transaction; Binance's own systems signed the attacker's withdrawal requests.
• The speed: Bybit lost one cold wallet through one malicious transaction. Binance's hot wallets were drained across ten blockchains in about 20 minutes.
• The freeze: Bybit's loot was ETH and staked ETH, and only 3.84% was frozen. At Binance, about $2.7–3 billion was frozen, mostly stablecoins their issuers could blacklist.

What both hacks teach:

• Your security is your supplier's security. Bybit's own systems were clean; its wallet provider's weren't. DMM Bitcoin's loss also came through a supplier.
• Never sign what you can't read. NCC Group recommends clear signing (approvals the device shows in readable form) and decoding transaction data first. a16z puts it bluntly: refuse to sign anything you can't fully inspect.
• Verify somewhere the attacker can't reach. a16z suggests a locally verified, static copy of the signing interface on a separate device. NCC adds script pinning and automated policy checks before signatures go out.
• Limit what a vault can do. NCC suggests wallet contracts that only allow the operations you need, not arbitrary delegatecalls.
• Delays save money. mETH Protocol's 8-hour withdrawal delay is why $43 million came back.

Is Bybit safe after the hack? What it means for you

Bybit absorbed the loss itself: it said client funds were unaffected and backed 1:1, kept withdrawals open and replaced the stolen ETH within days. Still, no exchange is risk-free, as Binance showed in 2026.

• Keep only what you're actively trading on an exchange. Long-term holdings belong in a wallet you control.
• Turn on withdrawal address allowlists and app-based 2FA.
• Ignore "Bybit hack refund" offers. Bybit covered the loss itself, so any site or DM promising a refund for a fee, a login or your seed phrase is a scam.
• If you sign transactions yourself, read them on the device. If it can't show you what you're approving, don't sign.

Bybit hack FAQ

When was Bybit hacked?

Bybit was hacked on Friday, February 21, 2025. The malicious transaction executed at 14:13:35 UTC, according to Verichains, during a planned transfer from an ETH cold wallet to a hot wallet. The FBI publicly attributed the theft to North Korea five days later, on February 26, 2025.

How much was stolen in the Bybit hack?

About 401,347 ETH plus roughly 113,000 staked-ETH tokens such as stETH, mETH and cmETH. Elliptic valued it at about $1.46 billion; the FBI, Chainalysis and Bybit's own notice say about $1.5 billion. Bybit's CEO counts it as roughly 500,000 ETH in total.

How did the Bybit hack happen?

Hackers compromised a Safe{Wallet} developer's laptop, used stolen session tokens to reach Safe's AWS account, and planted JavaScript in Safe's web app that only targeted Bybit. Bybit's signers approved what looked like a routine transfer but actually handed control of the cold wallet to the attacker.

Who hacked Bybit?

The FBI says North Korea, specifically the cluster it calls TraderTraitor, also tracked as Jade Sleet, PUKCHONG and UNC4899 and usually grouped under Lazarus. Blockchain analysts and Safe's investigation with Google's Mandiant reached the same conclusion.

Did Bybit users lose money in the hack?

Not according to Bybit. It said client assets stayed backed 1:1 and covered the hole with bridge loans, deposits and ETH purchases, closing the gap by February 24, 2025. Withdrawals stayed open, with more than 350,000 requests processed within 12 hours. Treat any "Bybit hack refund" offer as a scam.

How much of the Bybit hack was recovered?

Very little. By April 21, 2025, Bybit's CEO said 3.84% of the stolen funds had been frozen, 68.57% was still traceable and 27.59% had gone dark. The biggest single recovery was about $43 million in cmETH, saved because mETH Protocol's 8-hour withdrawal delay gave it time to pause the contract.

What is the Bybit Lazarus bounty?

A recovery bounty Bybit launched on February 22, 2025, at lazarusbounty.com. It pays 10% of recovered funds, split between the person who reports a traceable transfer and the exchange or mixer that freezes it, worth up to $140 million. By April 21, 2025, $2.3 million had gone to 12 bounty hunters.

Was the Bybit hack the biggest crypto hack ever?

It was when it happened. Elliptic called it by far the largest crypto heist of all time, and Chainalysis found it made up about 69% of all crypto stolen in the first half of 2025. The Binance hack of October 29, 2026, estimated at about $6.3 billion, has since overtaken it.

Questions about a hack or a scam? Ask Cleus, the uncensored AI with live web search.

Sources

• FBI public service announcement on the Bybit hack (Feb 26, 2025)
• Bybit: Incident update on the ETH cold wallet
• Verichains: Technical analysis of the Bybit exploit
• BleepingComputer: Sygnia, Verichains and Safe findings
• The Block: Sygnia's interim report
• The Hacker News: Safe and Mandiant findings
• Rekt: Not So Safe
• NCC Group: Technical analysis of the Bybit hack
• a16z: Lessons from the Bybit hack
• TRM Labs: North Korea and the record hack
• Elliptic: The largest crypto heist in history
• The Record: Hackers drain Bybit
• The Block: Bridge loans for 80% of the ETH
• Cointelegraph: All withdrawals processed
• Khaleej Times: Operations back to normal within 24 hours
• Decrypt: Bybit closes its Ethereum deficit with $1.23 billion in purchases and loans
• crypto.news: Bybit closes the ETH gap
• The Register: Bybit's Lazarus bounty
• The Block: mETH recovery and Tether freeze
• The Block: March 4 tracing update
• The Block: April 21 tracing update
• BleepingComputer: TraderTraitor and DMM Bitcoin
• The Record: Chainalysis first-half 2025
• Chainalysis: Stolen funds in 2025
• Cleus: Binance hack 2026 explained