Bybit Fully Covered $1.4 Billion Ether Gap After the Hack

Highlights:

• Bybit replaced $1.4 billion stolen Ethereum, ensuring full 1:1 client asset backing. 
• An audited Proof-of-Reserves report will confirm Bybit’s 100% reserve holdings.
• eXch denied laundering funds but faced accusations of freezing user deposits and ignoring messages.

In an X post on Feb. 24, Ben Zhou, the CEO of crypto exchange Bybit, announced that the firm has fully replaced the $1.4 billion worth of Ethereum (ETH) stolen in the hack on Feb. 21. He also revealed that all clients assets on the exchange are now fully backed 1:1.

Moreover, an audited Proof-of-Reserves (POR) report will be released soon. This report will use a Merkle tree structure to transparently show that Bybit holds 100% reserves for client assets, Zhou said.

Latest Update: Bybit has already fully closed the ETH gap, new audited POR report will be published very soon to show that Bybit is again Back to 100% 1:1 on client assets through merkle tree, Stay tuned. https://t.co/QLa1vOujM6

— Ben Zhou (@benbybit) February 24, 2025

Blockchain analytics firm Lookonchain estimated that Bybit received 446,870 Ether, worth about $1.23 billion. The funds came from loans, whale deposits, and purchases. This accounts for nearly 88% of the $1.4 billion stolen by North Korea-backed Lazarus Group on Feb. 21.

Of that, the hacked exchange bought 157,660 Ether worth around $437.8 million. It purchased the assets from Galaxy Digital, FalconX, and Wintermute through over-the-counter deals. Bybit also purchased another $304 million of Ether from centralized and decentralized platforms, Lookonchain said, citing data from Arkham Intelligence. Data from Arkham showed that Bybit’s wallet interacted with Binance and MEXC hot wallets.

Bybit Hack and Recovery Efforts

The Bybit attack marks the largest heist from any crypto exchange so far. On-chain analysts connected it to North Korea’s notorious Lazarus Group. The attack targeted Bybit’s multi-signature cold wallet system. The hacker behind the $1.4 billion breach converted 40,944 ETH ($115 million) into Bitcoin and other assets.

Bybit launched a Recovery Bounty Program to track and recover stolen funds from its recent hack. The program offers a 10% reward on recovered assets, which could total up to $140 million.

eXch Exchange’s Alleged Role and Response

On Feb. 22, on-chain investigator ZachXBT shared findings in his Telegram group. He claimed eXch laundered $35 million from the funds stolen by Lazarus Group from Bybit. He added that eXch accidentally transferred 34 ETH (worth $96,000) to another exchange’s hot wallet on the day of the Bybit hack. Moreover, Security firm SlowMist shared on X that a large amount of Ethereum was converted into other cryptocurrencies on eXch.

In a Feb. 23 statement on the Bitcointalk forum, the eXch team denied laundering money for Lazarus or North Korea. They also assured that all funds were secure and operations remained unaffected by the Bybit hack.

Meanwhile, on February 23, Bybit announced it had frozen over $42 million of the stolen assets through joint efforts. However, it is facing difficulties in gaining eXch’s cooperation.

A coordinated effort led to the freezing of $42.89M in just one day. Thanks to the following teams for their swift action: @Tether_to: Flagged address and froze 181K USDT @THORChain: Blocked the blacklist @ChangeNOW_io: Froze 34 ETH @FixedFloat: Froze 120K USDC + USDT…

— Bybit (@Bybit_Official) February 23, 2025

In a forum post, the eXch team claimed that Bybit had frozen some of its users’ funds during deposits over the past year. They said this action damaged its reputation. The exchange also accused Bybit of ignoring all messages sent to resolve the issue. Bybit CEO replied to the post, urging eXch to reconsider. He emphasized that the issue goes beyond Bybit, highlighting the industry’s overall stance against hackers.