(Kitco News) – Bybit, the world’s second-ranked crypto exchange by volume, announced on Friday that it was the victim of an attack that saw hackers make off with over $1.4 billion in ether (ETH).
“Bybit detected unauthorized activity involving one of our ETH cold wallets,” they wrote in an X post. “Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic. As a result, the attacker was able to gain control of the affected ETH cold wallet and transfer its holdings to an unidentified address.”
Bybit said their security team is working to investigate the incident, and they invited “Any teams with expertise in blockchain analytics and fund recovery” to join the effort.
“We want to assure our users and partners that all other Bybit cold wallets remain fully secure,” they added. “All client funds are safe, and our operations continue as usual without any disruption.”
Bybit cofounder Ben Zhou provided more details in a series of posts to his own X account. “Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago,” he wrote. “It appears that this specific transaction was musked [sic], all the signers saw the musked [sic] UI which showed the correct address and the URL was from @safe.”
“However the signing message was to change the smart contract logic of our ETH cold wallet,” he added. “This resulted Hacker took control of the specific ETH cold wallet we signed and transfered all ETH in the cold wallet to this unidentified address.”
“Please rest assured that all other cold wallets are secure,” Zhou said. “All withdraws are NORMAL.”
Zhou also sought to reassure the cryptosphere in a follow-up post that Bybit would remain in good shape even if the funds were never recovered.
Bybit is Solvent even if this hack loss is not recovered, all of clients assets are 1 to 1 backed, we can cover the loss.
— Ben Zhou (@benbybit) February 21, 2025
ETH sold off sharply as the news of the attack spread, dropping from $2,828 at 10:18 am EST to a low of $2,654 by 12:38 pm.
ETH last traded at $2,688.12 for a loss of 1.86% on the session.
