On February 21, 2025, crypto history was rewritten when Bybit suffered the largest hack ever recorded, losing a staggering $1.5 billion.

The theft shook not just Bybit, but the entire cryptocurrency market, triggering panic withdrawals and intense speculation.

How It Happened

At 1:30 PM CET, Bybit's team initiated a routine transfer from their secure cold wallet, containing approximately 491,000 Ether (ETH), to a hot wallet for regular operations.

Without anyone knowing, hackers had already infiltrated the system. Instead of transferring funds internally, the transaction diverted to an unknown external wallet controlled by cybercriminals.

Within 15 minutes, panic spread across social media. Blockchain transparency made it immediately evident—funds weren't moving as intended. Renowned crypto detective Zac XBT confirmed the worst: Bybit had indeed been robbed.

Technical Breakdown

Investigations revealed the vulnerability wasn't within Bybit itself but in their third-party multisignature solution, Safe (formerly Gnosis Safe).

Cybercriminals exploited Safe’s off-chain signature method by corrupting a JavaScript file hosted on Safe’s AWS infrastructure.

This compromised interface deceived Bybit executives, including CEO Ben Zhou, into authorizing a seemingly legitimate transaction.

Who’s Behind It?

Early investigations, including statements from the FBI, point towards North Korea’s infamous Lazarus Group.

The operation's precision—activated only when certain conditions were met and meticulously timed—indicates a sophisticated, targeted attack.

Market Impact and Crisis Management

Following the breach, Bybit quickly suspended ETH withdrawals. CEO Ben Zhou publicly reassured users that customer funds remained fully backed.

Despite this, a wave of panic withdrawals swept through the platform, draining over $5.3 billion in assets within hours, as users feared another FTX-like collapse.

Bybit swiftly stabilized the situation, securing emergency funding through loans and OTC deals from industry giants like Galaxy Digital, Wintermute, and Bitget.

Remarkably, within 12 hours, Bybit restored full withdrawal capabilities, safeguarding user confidence and platform stability.

Where's the Money Now?

As of early March, the saga continues. Approximately 77% of stolen funds remain traceable on the blockchain, 20% have successfully vanished, and 3% have been frozen by authorities.

Hackers have since aggressively converted stolen ETH into various other coins, complicating the tracking process. Authorities and blockchain analytics firms continue playing cat-and-mouse, attempting to trace the remaining funds.

Community Reactions and Theories

Crypto Twitter erupted with speculation, questioning how hackers precisely timed their attack. Was there inside information? Did someone from Bybit or Safe unknowingly facilitate the breach?

Others speculate on the hackers' motives—why stop at $1.5 billion? Analysts suggest the stolen sum was carefully chosen to avoid crashing crypto markets entirely, preserving the stolen funds' value.

The targeted, surgical nature of the attack underlines the growing threat of supply chain attacks, emphasizing the necessity for stronger security practices.

Both Safe and Bybit have since upgraded their security protocols, yet this historic hack serves as a powerful reminder of crypto’s inherent risks.

Stay tuned as the crypto community watches closely, wondering how much of the stolen fortune will ultimately vanish—and how blockchain security will evolve from this landmark incident.

If you want to know which coins to buy in March, join us and benefit from:

👉🏻 Join our telegram group and don’t miss this momentum!

Make 2025 unforgettable.

See you inside,
TheCryptoPicks❤️