In a massive blow to the cryptocurrency industry, Bybit confirmed on Friday that it had fallen victim to a highly sophisticated cyberattack, resulting in the theft of over $1.5 billion worth of
#Ethereum from one of its cold wallets. This unprecedented breach now stands as the largest crypto hack to date, surpassing infamous incidents like the
#RONNIN Ronin Network ($624 million)
$RONIN , Poly Network ($611 million)
#Polygon $POL and
#bnb BNB Bridge ($586 million)
$BNB exploits.
The Attack: A Deceptive Manipulation
Bybit CEO Ben Zhou revealed that the breach occurred during a routine transfer involving the exchange’s ETH multisig cold wallet. Attackers leveraged an advanced manipulation technique to alter the underlying smart contract logic while keeping the signing interface unchanged. This deception tricked the system into executing unauthorized transfers to an unknown address.
“The transaction appeared legitimate on the surface, but attackers masked the signing interface while modifying the actual smart contract logic,” Bybit explained in a statement on X. As a result, more than 400,000 ETH and stETH tokens—valued at over $1.5 billion—were siphoned off.
Lazarus Group Linked to the Breach
Blockchain intelligence firms Elliptic and Arkham Intelligence quickly identified North Korea’s state-sponsored Lazarus Group as the likely culprit. Independent researcher ZachXBT further linked the Bybit hack to a similar breach at Phemex last month, strengthening suspicions of Lazarus involvement.
North Korea has been labeled “arguably the world’s leading cyber criminal enterprise” by Google, with the Lazarus Group orchestrating numerous high-profile crypto heists to fund the regime. Last year alone, Chainalysis estimated that the group stole $1.34 billion across 47 hacks, accounting for 61% of all stolen crypto.
Elliptic reported that Lazarus follows a distinct laundering pattern, swiftly converting stolen assets into native blockchain tokens like ETH to evade asset freezes. Following the Bybit breach, stolen stETH and cmETH—valued in the hundreds of millions—were promptly converted into ETH and funneled through 50 different wallets before being exchanged for Bitcoin via platforms like eXch.
A New Era of Cyberattacks
Check Point Research noted that this attack signifies a shift in cybercrime tactics, with hackers now exploiting supply chain vulnerabilities and manipulating user interfaces rather than solely targeting protocol weaknesses.
“The Bybit incident underscores a critical security flaw—multisig cold wallets are only as safe as the individuals authorizing transactions,” Check Point warned, referencing the exploit of the Gnosis Safe Protocol’s execTransaction function to deceive signers.
TRM Labs corroborated these findings, stating with high confidence that Lazarus was behind the attack based on overlapping blockchain activity with previous North Korean-linked thefts.
Market Fallout and Customer Reassurances
News of the breach sent shockwaves through the crypto market, causing Ethereum’s price to drop over 4% as the stolen funds were offloaded. Within the first 30 minutes, nearly $200 million worth of Lido Staked Ether (stETH) had been liquidated, further amplifying market volatility.
To reassure customers, Bybit CEO Zhou emphasized that all other cold wallets remain secure and that withdrawals are operating normally. The exchange has also secured a bridge loan from undisclosed partners to cover any potential losses and ensure continued operations. However, fears of insolvency have prompted many users to withdraw funds as a precaution.
Industry Implications and Lessons Learned
This record-breaking heist underscores the vulnerabilities in the crypto ecosystem, particularly the risks associated with human error and social engineering. While cold wallets are traditionally considered secure due to their offline nature, this breach highlights the importance of improved security measures.
“Crypto heists are on the rise because of their lucrative payouts, the difficulty of tracing stolen funds, and the general lack of familiarity with Web3 security among organizations,” cybersecurity firm Mandiant warned last month.
As investigations continue, experts are urging exchanges to adopt stricter security measures, educate staff on phishing and smart contract vulnerabilities, and enhance global cooperation between law enforcement agencies and blockchain analytics firms to combat cyber threats.
For now, the crypto community anxiously awaits further updates, hoping this historic breach will serve as a catalyst for stronger security protocols. Until then, the Bybit hack stands as a stark reminder of the ever-evolving landscape of cybercrime in the digital age.
Sources:
CNBC
TechCrunch
Investing.com
The Hacker News
This article was originally published on Crypto Reporter.