The Bybit hack has sent shockwaves through the crypto space in 2025. The $1.5 billion security breach is now one of the biggest crypto exchange hacks in history. Hackers exploited a wallet vulnerability, draining Ethereum (ETH) and leaving traders asking what went wrong. So, could this have been prevented? And most importantly, are customer funds safe? Let’s break down exactly what happened, how Bybit has responded, and what this means for the crypto market moving forward.

What was the Bybit hack 2025?

The Bybit hack was a highly coordinated attack that resulted in $1.5 billion in Ethereum (ETH) being drained from the platform. Investigations suggest that hackers exploited a single-signing transaction vulnerability, allowing them to bypass wallet security and execute unauthorized withdrawals.

How did the Bybit hack happen?

Blockchain security firms analyzing the Bybit hack have pointed to a flaw in the wallet signing process, which may have been the key entry point for attackers. Here’s how it might have played out:

• A transaction signing exploit started off everything where attackers took advantage of a single-signing transaction vulnerability. This move allowed them to authorize multiple withdrawals using one “single” approval.
• Cold wallet compromise followed next. Unlike most crypto hacks targeting hot wallets, this attack appears to have affected Bybit’s cold storage, raising concerns about deeper security loopholes.
• All of this was paired with phishing & social engineering attacks. The miscreants may have gained access to internal credentials through phishing scams targeting Bybit employees. But all that was a part of the early hypothesis, and Bybit seems to have cracked the primary reason (more on that later). 

What is a single-signing transaction vulnerability?

At its core, this vulnerability allows a single transaction approval to be reused or manipulated, leading to unauthorized withdrawals. Let us try to understand it in parts:

• Smart contract signing flaw – When funds are moved from a cold wallet to a hot wallet, the system generates an approval signature to verify the transaction.
• Exploiting the approval process – Attackers intercepted this signature and used it to trigger multiple unauthorized transactions.
• Draining funds in seconds – Since the system treated these as approved transactions, the attackers could move Ethereum (ETH) out of Bybit’s reserves without triggering immediate alarms.

Were there other security loopholes?

While the single-signing transaction flaw appears to be the main exploit, other potential issues might include phishing attacks, smart contract vulnerabilities, and, obviously, the delayed detection of the attack. 

While all these insights surfaced initially, new information has surfaced regarding the root cause of the 2025 Bybit hack.

What caused the Bybit hack of 2025?

​​Contrary to initial fears of an internal security failure, forensic investigations have pointed to a breach in Safe{Wallet}, a third-party wallet infrastructure that Bybit used for multi-signature transactions.

What is Safe{Wallet}?

Think of Safe{Wallet} as a smart contract-powered vault designed to keep transactions secure using multi-signature approvals. It runs on AWS S3, meaning it stores and loads JavaScript files from the cloud to process transactions. Sounds efficient, right? Well, that’s also where things went south.

Hackers found a way to inject malicious JavaScript into Safe{Wallet}’s AWS S3 bucket, silently tweaking transactions in real time. So, while Bybit’s core security wasn’t technically “hacked,” the tool it used for approving and executing transactions was manipulated. Basically, Bybit signed off on transfers, but the hackers rewrote the final destination without anyone noticing.

How did the attack happen?

During a routine ETH cold wallet transfer to a warm wallet, the malicious script — embedded within Safe{Wallet}’s JavaScript; modified the transaction details as it was being signed.

That’s exactly what happened here — Bybit’s signers approved the transaction, believing it was secure, but the modified Safe{Wallet} script quietly changed the recipient address to the attacker’s.

Real-time transaction hijacking

The JavaScript injection was designed to trigger only when transactions originated from specific addresses — Bybit’s cold wallet contract and another unknown address (likely a test address used by the attackers). This meant:

• If a normal user interacted with Safe{Wallet}, nothing suspicious happened.
• When Bybit processed a high-value transfer, the script altered the destination wallet just before execution.

Not a typical exchange hack

Most crypto exchange hacks like Mt. Gox (2014) or Coincheck (2018) involved private key leaks or direct breaches of exchange wallets. Those are like burglars breaking into a bank vault.

The Bybit hack 2025, however, was different; it was an infrastructure-level attack. Instead of stealing private keys, the hackers manipulated the transaction signing process itself, meaning:

• Bybit’s actual wallet security was not breached.
• The hack exploited a tool used in signing transactions instead of the storage of assets themselves.

Why this matters for crypto security

This hack exposes a serious security flaw; even if an exchange locks down its own systems, third-party integrations can become weak points.

This whole mess is a wake-up call: crypto platforms can’t just trust third-party tools without constant security audits, independent transaction checks, and tighter multi-signature protections. If hackers can hijack the signing process itself, even the best wallet security means nothing.

Even in a multi-sig setup, as this hack proves, if the signers are unknowingly approving fraudulent transactions, security measures become futile.

Who was behind the Bybit hack of 2025?

The Bybit hack 2025 has been attributed to the notorious Lazarus Group, a North Korean state-sponsored hacking collective infamous for orchestrating some of the largest cryptocurrency heists in history. This group has been linked to multiple high-profile cybercrimes, including the recent Phemex hack, where approximately $85 million was stolen. 

How did they pull It off?

Lazarus Group didn’t just hack and grab. Instead, they executed a surgical strike on Bybit’s transaction approval process. By sneaking into the Safe{Wallet} system, they silently rerouted funds during legitimate transfers. 

The result? 401,000 ETH vanished before anyone could blink, a $1.5 billion disaster.

How the hackers cleaned the money

Stealing crypto is easy. Spending it without getting caught is the real challenge. Lazarus followed their usual laundering playbook:

• Centralized mixers
• Cross-chain bridges 
• Obscure exchanges
• Funneling funds through low-KYC platforms that don’t ask too many questions.

Same old tricks, just with a bigger bag this time. Want a deep dive? Check this breakdown:

This mix of assets made laundering trickier, as staked assets can’t be easily liquidated without detection. This forced the attackers to rely on bridges, mixers, and centralized exchanges — a move that made them more traceable.

What was Bybit’s response?

Bybit acted swiftly after the breach, implementing a multi-layered response plan.

Immediate actions

• Funds were secured & 1:1 asset backing assurance was given to the users.
• There was a security overhaul led by the strengthening of multi-sig wallets, monitoring tools, and API security.
• The exchange launched a 10% recovery bounty for white-hat hackers, amounting to $140mn+.
• Bybit froze orders & initiated fund tracking with partners like Chainalysis, Arkham, and more. 

LazarusBounty.com – A new weapon against crypto crime

In a groundbreaking move, Bybit launched LazarusBounty.com, an industry-first bounty aggregator targeting North Korea’s Lazarus Group.

What makes it different?

• Bounty hunters can earn instantly 
• Exchanges & mixers are incentivized to act 
• Good vs. bad actor rankings
• Live wallet data for investigators
  

How could LazarusBounty improve?

Our suggestions to tighten this service include:

1. Introducing a “Hot Wallet Defense” network

Right now, LazarusBounty is reactive, tracking stolen funds after the fact. Bybit could pivot to proactively securing exchanges’ hot wallets before an attack happens.

This could be done via a decentralized honeypot system, where exchanges integrate real-time tracking scripts that flag suspicious transactions before they settle on-chain.

2. Involve regulators with real-time alerts

Bybit could add a regulatory dashboard, notifying law enforcement agencies immediately when Lazarus-linked funds move.

The current issue is that exchanges often freeze assets too late. A direct link to Interpol, OFAC, or FATF could speed up action.

3. Open bounties on wallet movements

Right now, the bounty is tied to fund freezes. But what if bounty hunters could track and claim specific wallets? Bybit could allow users to “claim” a wallet; if it moves, they receive a reward for tracking the laundering path.

4. Public blacklist API for exchanges

Exchanges don’t always act fast because they lack real-time wallet tracking. Solution? A live API that instantly updates high-risk wallets, forcing exchanges to act before funds disappear into mixers.

How much has been recovered?

As of late February 2025, $42.8 million of the stolen assets from the Bybit hack 2025 have been frozen or recovered. Read on for the complete breakdown:

• Ethereum (ETH): 34 ETH (≈$97,000) was intercepted and frozen by ChangeNOW, stopping the attackers from moving it further.
• Bitcoin (BTC): 0.38755 BTC (≈$37,000) was blocked on the Avalanche network after hackers bridged it cross-chain.
• Stablecoins (USDT/USDC): Tether froze 181,000 USDT, while FixedFloat locked down $120,000 in mixed USDT and USDC linked to the stolen funds.
• Staked Ethereum derivatives: 15,000 ETH was successfully recovered by mETH Protocol before the attackers could withdraw it. This move prevented further liquidation of liquid-staked assets.

How were the stolen funds tracked and frozen?

The recovery of these assets has been made possible through a multi-layered, global effort, combining:

• Exchange freezes: Platforms like FixedFloat, ChangeNOW, Bitget, and THORChain have identified and frozen deposits linked to the stolen funds.
• Stablecoin issuer blacklisting: Tether and Circle flagged and froze accounts holding stolen USDT and USDC, preventing the hackers from using these assets.
• Blockchain intelligence tracking: Forensic teams, including Elliptic, Arkham, Chainalysis, and TRM Labs, have mapped out how the attackers moved their funds, helping exchanges block transactions before they could be cashed out.
• Bounty programs & community participation: Bybit’s LazarusBounty.com has incentivized independent investigators to track stolen funds, offering 5% bounties for successful freezes and up to 10% for fund recoveries.

What does the Bybit hack change for crypto?

The Bybit hack of 2025 has proven that even multi-signature wallets and cold storage aren’t safe from infrastructure breaches. As hackers get more creative, exchanges must harden security, audit integrations, and implement real-time fraud detection. The idea is not to trust but “to verify.”

The future of crypto exchanges depends on proactive defense, industry-wide collaboration, and smarter fund recovery strategies to counteract increasingly sophisticated cyber threats.

Frequently asked questions

Best crypto platforms in Europe

OKX Explore

YouHodler Explore

Wirex Explore

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

eToro Explore

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

Explore

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

Explore

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

Explore

BingX Explore

Best crypto platforms in Europe

OKX

YouHodler

Wirex

eToro

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

eToro

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

eToro

Close modal

Don’t invest unless you’re prepared to lose all 
the money you invest.

This is a high-risk investment and you should not expect to be protected if something goes wrong.

Take 2 mins to learn more

eToro

BingX