I. Overview of the key points of the report
This report focuses on the Bybit ETH reserve recovery event. As a well-known cryptocurrency trading platform, Bybit was hacked on February 21, 2025, a large amount of ETH was stolen, and the reserve dropped sharply, which attracted market attention. Subsequently, Bybit took active actions to restore the reserve, and this process had a significant impact on the platform, the market, and investors.
II. Background
1. Current status of cryptocurrency market
The cryptocurrency market has always been volatile and full of uncertainty. Ethereum (ETH), as the second largest cryptocurrency by market value, is widely used in smart contracts, decentralized finance and other fields. Its price trend and market dynamics have a profound impact on the entire crypto market. Before the hacker attack on Bybit, the price of ETH was in a volatile upward stage, with high trading activity, and the market was generally optimistic about the prospects of ETH.
2. Bybit Platform Situation
Bybit has a large user base in the field of cryptocurrency trading and provides a variety of cryptocurrency derivatives trading services. At 20:30 Beijing time on February 21, 2025, Bybit detected unauthorized activity in the Ethereum cold wallet during a routine transfer of ETH from an ETH multi-signature cold wallet to a hot wallet, resulting in the theft of more than 400,000 ETH and stETH with a total asset value of more than US$1.5 billion. Before the attack, at 21:00 UTC+8 on February 21, Bybit's ETH reserves were 443,691 ETH; after the attack, at 4:00 UTC+8 on the 22nd, the reserves fell to a low of 63,807 ETH. This incident caused users to worry about the security of platform assets and the stability of transactions, and a large number of users initiated withdrawal requests.
III. The process of restoring ETH reserves
1. Decision-making
After the attack, Bybit made a quick decision. On the one hand, it assured users that the platform had strong reserves, all customer assets were fully protected, its other cold wallets were safe, and the platform and services were operating normally. On the other hand, it actively sought external assistance and internal funds allocation plans to restore ETH reserves and stabilize market confidence.
2. Implementation steps
1. External assistance:
- Support from friendly companies: Bitget quickly took action and transferred 40,000 ETH (about 106 million US dollars) to Bybit's cold wallet. Binance hot wallet transferred 11,800 ETH (about 31.02 million US dollars) to Bybit's cold wallet, and MEXC hot wallet transferred 12,652 stETH (about 33.7 million US dollars) to Bybit's cold wallet. As of February 22, Bybit received about 64,452 ETH loan support, which effectively alleviated Bybit's funding pressure.
- Institutional cooperation: It is suspected that an institution is conducting OTC ETH transactions with Bybit and has deposited 22,600 ETH into the latter; the suspected Fenbushi Capital address has withdrawn 10,000 ETH from Binance and other addresses and injected all of them into Bybit. In addition, Bybit may also obtain ETH through cooperation with other financial institutions or cryptocurrency funds, but the specific details have not yet been fully disclosed.
2. Internal fund allocation: Bybit CEO Ben Zhou mentioned that 2.95 billion USDT is being transferred from cold wallets to hot wallets. Although he emphasized that this is a planned fund transfer, this operation may also be to stabilize the platform liquidity and prepare for the subsequent restoration of ETH reserves, such as converting part of USDT into ETH through market transactions.
(III) Timeline
Timeline Specific actions and results
February 21, 2025 20:30 Bybit detected unauthorized activity in Ethereum cold wallets, over $1.5 billion in ETH and stETH were stolen
February 21, 2025 21:00 UTC+8 ETH reserves are 443,691 ETH
February 22, 2025 4:00 UTC+8 ETH reserves fell to 63,807 ETH
On the morning of February 22, 2025, Bybit CEO Ben Zhou said that more than 350,000 withdrawal requests were processed within 10 hours after the attack, and 99.994% of the withdrawals were completed, with only about 2,100 withdrawals still being processed.
February 22-23, 2025 Bitget, Binance, MEXC, etc. transferred ETH or stETH to Bybit, and Bybit received over 64,000 ETH loan support; suspected institutions conducted OTC transactions with Bybit for ETH, and Fenbushi Capital address injected ETH, etc.
February 23, 2025 12:00 UTC+8 ETH reserves have been restored to 159,702
IV. Impact Analysis
1. Impact on the Bybit Platform
1. Short-term impact: After the hacker attack, the platform faced a huge crisis of trust, and users withdrew a large number of funds, and the pressure of capital outflow increased dramatically. Within 24 hours, DeFi Llama data showed that Bybit had a net outflow of 2.485 billion US dollars. However, Bybit actively responded and quickly processed withdrawal requests, which stabilized user sentiment to a certain extent.
2. Long-term challenges and opportunities: Restoring ETH reserves will help the platform regain user trust. The platform needs to strengthen security protection and improve technology and management to prevent similar incidents from happening again. Successful restoration of reserves may also prompt the platform to innovate in risk management and business development, such as introducing stricter asset security measures and expanding new funding channels.
2. Impact on the cryptocurrency market
1. Market panic and confidence loss: This attack is a large-scale theft in the history of encryption, which has caused panic in the market. Investors have doubts about the security of cryptocurrency trading platforms, resulting in a loss of overall market confidence. Cryptocurrency prices may fluctuate in the short term.
2. Increased attention to industry security: The Bybit incident sounded the alarm for the entire cryptocurrency industry, prompting other trading platforms to re-examine and strengthen their own security mechanisms, and promoting the industry to increase investment in security technology research and development, risk prevention and control, etc.
(III) Impact on investors
1. Concerns about asset security: Bybit users are highly concerned about the security of their assets. Some users choose to transfer their assets from Bybit to other platforms to reduce risks.
2. Changes in investment decisions: This incident affects investors’ choice of cryptocurrency trading platforms and investment strategies. Investors will be more cautious when choosing a platform, paying attention to factors such as the platform’s security measures and reserve conditions; in terms of investment strategy, they may diversify their investments and reduce their reliance on a single platform.
V. Future Outlook
1. Forecast of Bybit Platform Development
1. Security upgrade: Bybit will inevitably invest a lot of resources to strengthen security protection, such as upgrading wallet security technology, establishing a more complete risk monitoring system, strengthening internal personnel management and auditing, etc., to prevent similar hacker attacks from happening again.
2. Business adjustment and expansion: In order to restore market share and user trust, Bybit may optimize its existing business and launch more value-added services, such as providing more detailed reserve certificates and asset insurance. It may also expand into new business areas, such as exploring cooperation with traditional financial institutions to improve compliance and stability.
2. Potential impact on the cryptocurrency market
1. Accelerated formation of industry norms: The Bybit incident may push regulators to speed up the formulation and improvement of regulatory rules for the cryptocurrency industry, prompting the industry to develop in a more standardized and secure direction.
2. Changes in the market competition landscape: Other trading platforms may take this opportunity to enhance their competitiveness and attract users flowing out of Bybit. The market competition landscape may change to a certain extent, and platforms with more complete security mechanisms and good reputations will have more advantages.
VI. Conclusion
Bybit's restoration of ETH reserves is a key measure to deal with the hacker attack crisis. Although it has achieved certain results and the reserves have been restored to 159,702, it still faces many challenges in the future. For the platform, rebuilding trust and strengthening security are the top priorities; for the market, this incident is an opportunity to promote the progress of the industry and prompt the industry to continuously improve in terms of security and regulations. Investors should also be more cautious when paying attention to the cryptocurrency market and make investment decisions by considering multiple factors.
