Bybit Recovers from $1.4 Billion Hacker Attack

Cryptocurrency exchange Bybit is successfully, recovering from a $1.4 billion hack through a combination of loans, whale deposits, and substantial Ethereum (ETH) purchases. Blockchain analytics firm Lookonchain reported on February 24, 2025, that Bybit managed to cover its losses, restoring stability to its operations.

The breach, one of the largest in cryptocurrency history, targeted the exchange’s multi-signature cold wallet, allegedly orchestrated by the North Korea-backed Lazarus Group. Despite the scale of the attack, Bybit’s swift response has enabled it to close the financial gap and reassure its users.

Breakdown of Bybit’s Recovery Efforts

According to Lookonchain’s detailed analysis, Bybit amassed a total of 446,870 ETH, valued at approximately $1.23 billion, from various sources to replenish its reserves.

A significant portion of this recovery involved direct purchases, with the exchange acquiring 266,694 ETH worth $742 million. One notable transaction saw 157,660 ETH, equivalent to $437.8 million, transferred from a single address, likely an over-the-counter (OTC) buyer.

Additionally, another entity contributed 109,033 ETH, valued at $304.1 million, sourced from both centralized and decentralized exchanges. These large-scale ETH acquisitions played a critical role in stabilizing Bybit’s financial position.

Beyond its own purchases, Bybit received substantial support from whales and institutional players in the form of loans and deposits. Crypto exchange Bitget provided a loan of 40,000 ETH, worth $106 million, while MEXC contributed 12,653 stETH, valued at $33.9 million.

Another address, possibly an OTC buyer, sent 22,609 ETH ($61.9 million), and an unknown entity transferred 20,000 ETH ($53.7 million).

Investment firm Mirana Ventures and an address potentially linked to Fenbushi Capital each supplied 10,000 ETH, amounting to $28 million apiece. Smaller yet significant contributions included 2,499 ETH from users tied to “@yuchao” and 2,200 ETH from DWF Labs.

Collectively, these loans and deposits from whales and institutions accounted for over $127 million in ETH, bolstering Bybit’s recovery.

CEO Confirms Full Recovery

Following Lookonchain’s revelations, Bybit CEO Ben Zhou took to X on February 24, 2025, to confirm the exchange’s success in closing the “ETH gap.” Zhou emphasized that Bybit had fully restored its reserves and announced that a new audited proof-of-reserves report would be released imminently.

This report, utilizing a Merkle tree system, will demonstrate that Bybit maintains a 1:1 ratio of client assets, ensuring every user’s funds are fully backed. The move is a clear effort to rebuild trust among its user base after the unprecedented hack, showcasing transparency and accountability.

Connecting the Phemex Breach and Lazarus Group

Blockchain investigator ZachXBT uncovered compelling evidence linking the Bybit hack to a recent breach at the Phemex exchange. On-chain data revealed that the attackers merged funds from both incidents using identical initial theft addresses, a technique reminiscent of tactics employed by the Lazarus Group.

This North Korean state-backed hacking collective has a notorious history of targeting cryptocurrency exchanges, and their involvement suggests a sophisticated, coordinated effort. The connection between the two hacks underscores the persistent cybersecurity challenges facing the crypto industry.

Market Impact and Bybit’s Bold Strategy

Bybit’s aggressive response to the hack, particularly its $742 million Ethereum purchase, has had a noticeable impact on the broader market. The acquisition contributed to a 6% recovery in ETH’s price from the previous week’s decline, reflecting the exchange’s influence as a major player.

By opting to buy such a significant amount of ETH, Bybit not only addressed its immediate financial shortfall but also signaled confidence in the cryptocurrency’s long-term value. This bold strategy, combined with loans and institutional support, has positioned Bybit to emerge from the crisis stronger than before.

To solidify user confidence, Bybit’s proof-of-reserves report will provide a detailed, audited snapshot of its financial health. The use of a Merkle tree system ensures that the data is verifiable and tamper-proof, offering users a clear view of how their assets are secured. This step is particularly crucial following a hack of such magnitude, as it addresses concerns about solvency and operational integrity. Bybit’s proactive measures both in recovering funds and committing to transparency demonstrate its determination to maintain its standing in the competitive cryptocurrency exchange landscape.

Subscribe to Notifications