Hackers steal $1.5bn from crypto exchange Bybit in biggest-ever heist

Theft deals blow to an industry that has been reinvigorated by Donald Trump’s re-election

Ethereum coins were stolen from Bybit’s offline or ‘cold’ wallet

In a significant security breach, Dubai-based cryptocurrency exchange Bybit has reported the theft of approximately $1.5 billion worth of Ethereum. The incident occurred during a routine transfer from a cold wallet to a warm wallet, where attackers manipulated the transaction interface, gaining control over the cold wallet and transferring its contents to an unknown address. Hackers have stolen approximately $1.5 billion in crypto tokens from Bybit in what the exchange has called the largest theft in the industry’s history.

Bybit’s CEO, Ben Zhou, revealed on X that Ethereum coins were drained from the exchange’s offline “cold” wallet. In a live-stream update, he stated, “As far as we know, this could be the largest hack in the history of our industry.” Bybit's CEO, Ben Zhou, has assured clients that the exchange remains solvent, with all client assets fully backed. Despite an initial surge in withdrawal requests over 350,000 processed swiftly the situation has stabilized. The company is collaborating with blockchain forensic experts to trace and recover the stolen funds, which are reportedly being moved to new addresses.

Following the attack, there was a surge in withdrawals from the platform, though the outflow has since slowed. Zhou assured users that Bybit is securing a bridge loan from its partners and will compensate for any unrecovered funds. The hack is a significant setback for the crypto industry, which has been experiencing renewed optimism, partly due to expectations that the Trump administration may adopt a more favourable stance toward digital assets.

Crypto theft has long plagued the industry. In 2011, Mt. Gox, then a leading Bitcoin exchange, lost about 25,000 coins, valued at $470 million at the time. Similarly, Binance suffered a $570 million loss in October 2022 due to a flaw in a smart contract.

On Friday, Zhou confirmed that around 400,000 Ethereum coins worth about $1.5 billion were taken. Ethereum is currently the third most-traded cryptocurrency, following Bitcoin and Tether, a stablecoin pegged to the U.S. dollar.

Despite their reputation for security, cold wallets such as Bybit’s require multiple signatures before transferring funds. Zhou admitted he was unsure how the breach occurred but stated that an investigation is underway. Blockchain research firm Arkham Intelligence reported on X that $1.36 billion in Ethereum had been traced from Bybit to multiple accounts, where it was quickly liquidated.

This event underscores ongoing security challenges within the cryptocurrency sector. Notably, the Lazarus Group, a North Korean hacking organization, has been implicated in previous large-scale crypto thefts, raising concerns about their potential involvement in this incident.

In the wake of the hack, the cryptocurrency market has experienced increased volatility. Bitcoin's price, which had recently approached $99,000, fell to $95,000 following the news. This breach is among the largest in the history of cryptocurrency exchanges, surpassing previous incidents such as the Mt. Gox hack in 2011 and the Binance hack in 2022. It highlights the critical need for enhanced security measures and regulatory oversight in the rapidly evolving digital asset landscape.