In the largest cryptocurrency heist to date, Seychelles-based exchange Bybit lost approximately $1.5 billion in Ethereum (ETH) on February 21, 2025, due to a sophisticated hack by North Korean-linked hackers.

The breach, confirmed by Bybit’s CEO Ben Zhou, marks a significant escalation in cybercrime targeting the crypto industry and raises critical questions about the security of digital assets.

Let’s try to make an in-depth analysis of the hack, the technical methods used, the role of blockchain analysis, the involvement of the Lazarus Group, and the broader implications for the cryptocurrency ecosystem.

Bybit: A Major Player in the Crypto Market

Bybit, founded in 2018 and headquartered in Seychelles, has established itself as a leading cryptocurrency exchange, known for its high trading volumes and diverse offerings, including buying and selling cryptocurrencies at current market prices, speculating on future price movements with leverage, earning rewards by locking up funds to support blockchain operations.

The exchange's user-friendly interface and reputation for robust security measures, such as multi-signature (multi-sig) cold wallets and regular security audits, attracted a global user base. This reputation made the hack particularly alarming, as it exposed vulnerabilities in even the most trusted platforms.

Discovery of the Hack

The hack was first detected by on-chain analyst ZachXBT, who flagged suspicious outflows totaling $1.46 billion from Bybit’s wallets at 10:20 a.m. ET on February 21, 2025.

These outflows, involving 401,347 ETH, raised immediate concerns about a potential security breach. Within 30 minutes, Bybit CEO Ben Zhou confirmed the breach in a post on X (formerly Twitter), attributing the attack to a "masked" transaction technique that exploited the exchange’s multi-signature cold wallet during a routine transfer to a warm wallet.

Understanding Multi-Signature Cold Wallets and Their Security

What is a Multi-Signature Cold Wallet?

A multi-signature (multi-sig) cold wallet is a type of cryptocurrency storage designed to enhance security by requiring multiple private keys to authorize a transaction.

Unlike single-key wallets, which rely on one key and are more vulnerable to theft, multi-sig wallets distribute control among several parties or devices. For example, a 2-of-3 multi-sig wallet requires two out of three designated signers to approve a transaction.

Cold wallets, on the other hand, are offline storage solutions, meaning they are not connected to the internet, reducing the risk of online attacks such as hacking or phishing.

Bybit’s multi-sig cold wallet setup required approvals from multiple signers, a standard practice for safeguarding large amounts of cryptocurrency.

Bybit’s use of multi-sig cold wallets was intended to protect its substantial ETH holdings, making the breach particularly surprising and highlighting the sophistication of the attack.

How the Hack Was Executed: Technical Details

The attackers bypassed Bybit’s multi-sig security through a combination of social engineering and advanced technical manipulation.

Here’s a detailed breakdown of the attack:

1. Initial Access via Social Engineering

The hackers, believed to be part of the North Korean Lazarus Group, likely gained initial access through advanced phishing techniques, such as:

• Spear-phishing emails: Targeted emails designed to trick employees or signers into revealing credentials or clicking malicious links.
• Fake websites: Phishing sites that mimic legitimate Bybit interfaces to capture private keys or seed phrases.
• Malware infection: Deploying malware to compromise the systems or devices used by signers.

These social engineering tactics exploited human error, a critical vulnerability in even the most secure systems.

2. Transaction Manipulation via Masked Interface

During a routine transfer from Bybit’s ETH multi-sig cold wallet to a warm wallet (an online wallet for faster transactions), the attackers executed their exploit. The hackers altered the signing interface, the user-facing component where signers approve transactions. This interface was manipulated to display a legitimate transaction address while embedding malicious code in the underlying smart contract logic.

The signers, unaware of the manipulation, approved what appeared to be a routine transfer. However, the approved transaction contained malicious code that altered the wallet’s control mechanisms.

3. Smart Contract Logic Alteration

The malicious code embedded in the transaction exploited vulnerabilities in the transaction approval process.

The approved transaction altered the smart contract logic, granting the attackers control over the wallet. This allowed them to transfer 401,347 ETH to an unidentified address under their control.

The attack did not compromise the Ethereum blockchain or its smart contracts but rather exploited Bybit’s internal process for validating and approving transactions.

4. Fund Laundering and Dispersion

After gaining control of the funds, the attackers quickly dispersed the stolen ETH across multiple wallets to obfuscate their trail.

The ETH was split into increments of 1,000 ETH and sent to over 40 different wallets.

The attackers converted the ETH into other cryptocurrencies or fiat through decentralized exchanges (DEXs), which lack the know-your-customer (KYC) requirements of centralized exchanges, making it harder to freeze or recover the funds.

Blockchain Analysis and Fund Tracking

Blockchain analysis firms played a crucial role in tracing the stolen funds, despite the attackers’ efforts to obscure their movements.

Key firms and tools involved include:

• Elliptic: A blockchain analytics firm that tracked the stolen ETH as it was dispersed and liquidated. Elliptic’s software analyzes transaction patterns and wallet addresses to identify suspicious activity.
• Arkham Intelligence: Another analytics firm that provided real-time tracking of the funds, identifying associated wallets and transaction flows.
• MistTrack by Slow Mist: A blockchain forensics tool used to map the movement of the stolen ETH across the Ethereum network. MistTrack flagged test transactions and wallet patterns indicative of Lazarus Group techniques.

Despite these efforts, the speed and scale of the liquidation made recovery challenging.

The attackers’ use of DEXs and mixers (tools that shuffle cryptocurrency to hide its origin) further complicated the process.

Lazarus Group: The Culprits Behind the Hack

Who is the Lazarus Group?

The Lazarus Group is a North Korean state-sponsored hacking collective known for orchestrating high-profile cybercrimes, including cryptocurrency heists, ransomware attacks, and espionage.

The group is believed to operate under the direction of North Korea’s Reconnaissance General Bureau, with the primary goal of generating revenue for the regime.

Evidence Linking Lazarus to the Bybit Hack

Blockchain analysts, including ZachXBT, connected the Bybit hack to previous Lazarus Group exploits based on several indicators.

• Test transactions: Small transfers sent before the main attack to test wallet functionality, a hallmark of Lazarus tactics.
• Associated wallets: Wallets used in the Bybit hack were linked to those involved in previous hacks, such as the Phemex exploit.
• Forensic charts and timing analysis: Patterns in transaction timing and wallet activity matched known Lazarus behaviors.

Lazarus Group’s Track Record

The Lazarus Group has a long history of cryptocurrency thefts, with notable examples including:

• Ronin Network hack (2022): Stole $600 million in ETH and USDC from the Axie Infinity gaming platform.
• Phemex hack (2024): Linked to the Bybit hack through similar techniques and wallet patterns.
• 2024 totals: Estimated to have stolen $1.34 billion across 47 hacks, accounting for 61% of all illicit crypto activity that year.

The group’s advanced techniques, such as zero-day exploits (previously unknown vulnerabilities) and sophisticated social engineering, make them a formidable threat to the cryptocurrency industry.

Implications for Ethereum and the Crypto Ecosystem

Ethereum’s Security

Despite the scale of the hack, Ethereum itself was not compromised.

The vulnerability lay in Bybit’s internal processes, not in the Ethereum blockchain or its smart contracts.

Here’s why.

The Ethereum blockchain, a decentralized ledger of transactions, remained secure. The attack did not exploit flaws in the blockchain’s consensus mechanism (proof of stake) or its smart contract system.

The breach stemmed from manipulated transaction approvals, highlighting the risks of human-centric processes in cryptocurrency management.

While the smart contract code itself was not hacked, the manipulation of the approval process through a masked interface raises concerns about the security of user interfaces and transaction signing mechanisms in multi-sig wallets.

Broader Market Impact

The hack had immediate and ripple effects on the cryptocurrency market.

ETH prices fell by over 3% following the confirmation of the hack, reflecting heightened volatility.

The breach coincided with ETHDenver, one of the largest Ethereum ecosystem conferences, casting a bearish shadow over an event typically bullish for ETH.

The incident eroded trust in centralized exchanges, prompting users to question the safety of their assets and increasing interest in decentralized finance (DeFi) solutions.

And of course, the mere fact that the biggest hack ever happened during the bull market is not to be neglected.

Bybit’s Response and Recovery Efforts

Bybit’s swift response helped mitigate panic and demonstrated operational resilience.

The exchange processed over 580,000 withdrawal requests post-hack, ensuring users could access their funds.

Bybit also secured bridge loans to cover losses, reassuring users of its solvency. The exchange launched a program offering up to 10% of recovered funds to ethical hackers who assist in retrieving the stolen ETH.

These measures, while proactive, highlight the challenges of recovering funds in such large-scale hacks, especially given the attackers’ laundering techniques.

Preventive Measures for the Future

To avoid similar hacks, experts recommend a comprehensive set of security measures based on industry best practices and insights from the Bybit incident.

1. Multi-Factor Authentication (MFA)

Require multiple layers of verification for transaction approvals, such as:

• Biometric authentication: Fingerprint or facial recognition.
• Hardware tokens: Physical devices that generate one-time codes.
• Time-based one-time passwords (TOTP): Apps like Google Authenticator for temporary codes.

2. Secure Communication Channels

Use encrypted and verified channels for all transaction-related communications, such as:

• End-to-end encrypted email: Tools like ProtonMail or Signal for secure messaging.
• Dedicated secure portals: Internal systems for transaction approvals, isolated from external threats.

3. Regular Security Audits

Conduct frequent assessments and penetration testing to identify vulnerabilities:

• Third-party audits: Engage reputable firms to review security protocols.
• Simulated attacks: Test systems against phishing, malware, and social engineering scenarios.

4. Employee Training

Educate staff on recognizing social engineering threats, such as:

• Spear-phishing awareness: Train employees to identify suspicious emails or links.
• Credential hygiene: Avoid reusing passwords or storing keys insecurely.

5. Diversified Asset Management

Spread funds across multiple wallets to limit exposure:

• Cold and hot wallet balance: Keep the majority of funds in cold storage, with minimal amounts in hot wallets for daily operations.
• Multi-sig distribution: Use different multi-sig configurations for different asset pools.

6. Anomaly Detection Systems

Implement tools to detect and alert on unusual transaction patterns, such as:

• Machine learning models: Identify deviations from normal activity, such as large transfers at unusual times.
• Real-time alerts: Notify security teams of suspicious outflows.

7. Stay Updated on Threats

Continuously update security measures to counter emerging cyber threats:

• Threat intelligence feeds: Subscribe to services that track new attack vectors.
• Zero-day exploit defenses: Deploy patches and updates promptly to address newly discovered vulnerabilities.

These measures are crucial, especially given the Lazarus Group’s advanced techniques, which include zero-day exploits, sophisticated social engineering, and rapid fund laundering.

Conclusion: Lessons for the Crypto Industry

The Bybit hack, the largest cryptocurrency heist in history, underscores the persistent security challenges facing the industry, particularly from state-sponsored actors like the Lazarus Group.

While Ethereum remains secure, the incident highlights the need for robust internal processes, advanced cybersecurity measures, and continuous vigilance to protect digital assets.

As the cryptocurrency ecosystem evolves, exchanges must prioritize user trust and operational resilience to navigate such crises effectively.

The Bybit breach serves as a stark reminder that even the most secure platforms are vulnerable to human error and sophisticated attacks, emphasizing the importance of layered security and industry-wide collaboration to combat cybercrime.