Bybit Suffers $1.4B Hack as Attackers Drain Ethereum Cold Wallet

Highlights:

• Bybit lost $1.4 billion in Ethereum through a phishing attack targeting its cold wallet.
• Hackers manipulated the wallet’s smart contract using a deceptive interface to authorize transfers.
• The attacker moved and sold the stolen funds via decentralized exchanges, impacting ETH’s market price.

Bybit reported a security breach on Friday, from which the hackers stole more than $1.4B in ETH from the cold storage. This Singapore-based company said that this attack was conducted with a high level of sophistication where the phishing attack had the aim of altering the wallet’s smart contract capability to allow private transfers.

This event became known after the on-chain analyst ZachXBT reported unusual outflows of $1.46 billion at 10.20 AM ET. The hacker immediately withdrew these funds, which include ETH, stETH, and mETH tokens, to their wallets. The attacker decided to spread the stolen funds to several wallets and exchange large sums of the tokens via Uniswap and KyberSwap platforms.

CEO of Bybit, Ben Zhou, reacted within 30 minutes to the hackers’ report about the exploit. Zhou said that the attackers used a deceptive transaction interface known as a ‘musked’ transaction, which actually shows the correct wallet ID and URL. This deceived Bybit’s team into signing a transaction that modified the nature of its smart contract within the cold wallet. Therefore, the hacker gained full control of the wallet meaning that they were able to fully and entirely empty the wallet’s ETH balance.

Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change…

— Ben Zhou (@benbybit) February 21, 2025

Funds Split and Liquidated via Decentralized Exchanges

According to the data from the blockchain, the attacker initially transferred 400,000 ETH (about $1.1 billion) to a wallet starting with 0x476. The other comparatively lesser figures corresponded to 90,000 stETH, 15,000 cmETH, and 8,000 cETH. The hacker used the “sweep ETH function” to move the funds in one go, ensuring they took all the tokens down to the last unit.

The majority of the assets were later transferred to another address (0xa4b2), where the hacker proceeded to swap the tokens for ETH using decentralized exchanges. Consequently, the market saw a noticeable effect of this liquidation process. The price of Ethereum dropped by over 4% due to the circulating stolen ETH dumped into the market. Within the first half an hour, a significant $200 million stETH tokens were liquidated, aggravating the market sentiment.

ALERT: $1B+ OUTFLOWS FROM BYBIT

$1.4B in ETH and stETH outflows from Bybit

The funds have begun to move to new addresses where they are being sold. So far $200M stETH has been sold.

Address: 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2 pic.twitter.com/TfGm2UCjM5

— Arkham (@arkham) February 21, 2025

However, Bybit’s team assured customers that the theft affected only one cold wallet. The exchange stated that all other hot and cold wallets remain intact and safe. Withdrawals continue to function as usual, and the exchange fully backs and reserves all clients’ funds on a 1:1 basis. “Bybit is solvent even if this hack loss is not recovered,” Zhou stated.

Security Measures Underway as Investigation Continuous

Bybit immediately responded to the attack situation by checking it while continuing to operate and further investigating the matter. The hack also coincided with the scheduled maintenance on the exchange’s live server. This added to the early theories about the cause of the incident. However, Zhou stressed that the maintenance work had no link with the hack.

Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing…

— Bybit (@Bybit_Official) February 21, 2025

In the phishing scheme, the hackers relied on human error by duping users through a fake interface that resembled Safe, a wallet management tool. All the signers saw legitimate details in the compromised transaction, masking the underlying malicious code. Thus, it enabled the attacker to breach Bybit’s defenses. This sheds light on the modern approaches to threat attacks in the cryptosphere.