Log in Request a demo

Significant cyber incident

Bybit cryptocurrency theft

On 21 February 2025, attackers stole about 1.5 billion US dollars in crypto assets from one Ethereum cold wallet of the exchange Bybit.

In short

On 21 February 2025, attackers stole about 1.5 billion US dollars in crypto assets from one Ethereum cold wallet of the exchange Bybit. Bybit says the attackers got access through the credentials of a developer at Safe, the wallet service Bybit used, and moved the funds out across 39 addresses. On 26 February 2025 the FBI said North Korea was behind the theft.

Last updated 9 October 2026

What happened

On 21 February 2025, Bybit began a routine move of funds from an Ethereum multisig cold wallet to a warm wallet. About 40 minutes later, at 14:13 UTC, the attackers changed the smart contract logic of the cold wallet and moved the funds out, split across 39 addresses. Bybit lists the loss as $1.46 billion, made up of ETH, stETH, cmETH and mETH.

Bybit’s first account said the signers were phished and the Safe interface was spoofed. On 26 February 2025 Bybit said its forensic review found that the credentials of a Safe developer were compromised, which gave the attacker access to Safe{Wallet} infrastructure. Two outside firms hired by Bybit found no sign of compromise inside Bybit’s own systems.

The same day the FBI said North Korea was behind the theft, and later US Treasury material repeated the $1.5 billion figure. Bybit kept processing withdrawals and said it covered the shortfall within about two days.

Timeline

  1. 2025-02-21 13:30 UTC

    Bybit starts a routine transfer from an Ethereum multisig cold wallet to a warm wallet.

  2. 2025-02-21 14:13 UTC

    The attackers change the cold wallet's contract logic and move the funds out, split across 39 addresses.

  3. 2025-02-21 15:44 UTC

    Bybit's CEO says the attackers took control of the specific ETH cold wallet.

  4. 2025-02-21 21:07 UTC

    Bybit reports the case to the appropriate authorities.

  5. 2025-02-22

    Safe says its codebase was not compromised and pauses Wallet functionality for a review. Bybit says it processed 99.994% of over 350,000 withdrawal requests within 10 hours.

  6. 2025-02-22 15:32 UTC

    Bybit launches a recovery bounty of 10% of the stolen funds.

  7. 2025-02-23

    Bybit says $42.89 million of the funds were frozen with help from industry partners.

  8. 2025-02-24

    Bybit says it received $1.23 billion in ETH, covering the ETH shortfall.

  9. 2025-02-25

    Bybit launches the LazarusBounty program.

  10. 2025-02-26

    The FBI publishes a public service announcement saying North Korea was responsible and calls the activity TraderTraitor.

  11. 2025-02-26

    Bybit says its forensic review found that the credentials of a Safe developer were compromised.

  12. 2026-08-07

    Bybit announces a civil suit against North Korea, its Reconnaissance General Bureau and the Lazarus Group, and a preliminary injunction freezing identified assets.

How the attack worked

The target was the signing step

Bybit used a multisig cold wallet managed through the Safe interface. Several people must approve a transfer from such a wallet. Bybit says the attackers abused the Safe interface during a routine cold-to-warm transfer and changed the contract logic of the wallet, so the funds could be moved out.

Where the attacker got in

Bybit’s 26 February 2025 statement says the credentials of a Safe developer were compromised. It says this gave the attacker unauthorized access to Safe{Wallet} infrastructure and let them deceive signers into approving a malicious transaction. Bybit’s timeline says reports by its two outside forensic firms pointed to malicious JavaScript on the Safe{Wallet} platform. Bybit says Safe confirmed there was no compromise of its codebase and no malicious dependencies.

Bybit first described the event as phishing of the signers with a spoofed Safe interface. The later wording points to the supplier side. This page does not cover how the developer was first compromised, because Safe’s own statement could not be opened for this review.

Background on the group

The FBI calls this North Korean activity TraderTraitor. A 2022 CISA advisory on a group using that name describes spearphishing of staff at cryptocurrency companies, often in system administration or DevOps. The messages often look like job offers and push malware-laced crypto applications. No source opened here ties that method to this specific incident.

Cash-out

The FBI says the actors moved quickly, converting some assets to Bitcoin and other assets spread across thousands of addresses on several blockchains. It expects further laundering and conversion to fiat currency.

Impact

Bybit: about $1.5 billion in virtual assets stolen (FBI, Treasury). Bybit lists $1.46 billion from one cold wallet: 401,347 ETH, 90,375 stETH, 15,000 cmETH and 8,000 mETH.
Only one cold wallet was affected, according to Bybit.
Bybit says it processed 99.994% of over 350,000 withdrawal requests within 10 hours and covered the ETH shortfall within about two days.
Safe temporarily paused its Wallet functionality for a review, according to Bybit.
Recovery as of 7 August 2026, per Bybit: about US$48.4 million recovered and about US$30.5 million frozen across more than 28 exchanges and custodians.
Treasury calls it one of the largest digital asset thefts ever.

Government and regulator response

  • 21 February 2025: Bybit reported the case to the appropriate authorities and moved most funds out of its Safe Wallet administered addresses on the day of the incident.
  • 22 February 2025: Bybit launched a recovery bounty of 10% of the stolen funds. Safe confirmed no codebase compromise and paused Wallet functionality for a review.
  • 25 February 2025: Bybit launched the LazarusBounty program.
  • 26 February 2025: The FBI published its public service announcement, attributed the theft to North Korea, listed Ethereum addresses and asked node operators, exchanges, bridges, analytics firms, and DeFi services to block transactions linked to the laundering addresses. The same day Bybit published its findings from its two outside forensic firms.
  • 7 August 2026: Bybit announced a civil suit in the US District Court for the District of Columbia and a preliminary injunction freezing identified assets. Bybit says it keeps sharing blockchain intelligence with the FBI.
  • 2026: The US Treasury 2026 National Proliferation Financing Risk Assessment cites the theft as a North Korean heist.

Lessons

  1. Your supplier's weak point is your weak point

    Bybit says the attacker got in through a Safe developer's credentials, not through Bybit's own systems. Review the tools and vendors that sit in your approval path for big transactions.

  2. Check what you sign, outside the screen

    Bybit says signers were deceived into approving a malicious transaction. If the only view of a transaction is one web interface, a change to that interface can hide the real action.

  3. Developer access is high value

    The compromised credentials belonged to a developer with reach into Safe{Wallet} infrastructure. Treat developer accounts and machines like admin accounts.

  4. Contract changes need extra eyes

    The attackers changed the wallet's contract logic during a routine transfer. A change to wallet logic should look different from a normal transfer and need its own approval.

  5. Speed matters after theft

    The FBI says the actors converted assets and spread them across thousands of addresses quickly. Early reports to authorities and exchanges give more chance to freeze funds.

  6. Plan for liquidity and talk openly

    Bybit said it processed withdrawals and covered the ETH shortfall within about two days, and shared its findings within five days.

What to check in your own organization

  1. Signing path

    List every web tool, wallet service and script that shows a transaction to your approvers. Ask who can change each one.

  2. Independent transaction check

    Confirm approvers can verify what they sign on a second, separate device or tool, not only in the vendor interface.

  3. Developer and vendor credentials

    Review who has access to build, deploy and cloud settings for tools you depend on, and whether those accounts use strong multifactor authentication.

  4. Wallet change controls

    Check that any change to wallet or contract logic needs a separate approval from a normal transfer.

  5. Phishing and job-offer lures

    Run training for developers and system administrators on fake recruitment messages and unsolicited apps, as CISA advises.

  6. Incident plan

    Check you have a plan that includes reporting to the FBI or your national authority, and a way to contact exchanges quickly.

  7. Address blocking

    Check that your screening can ingest address lists published by authorities, such as the FBI list of laundering addresses.

Questions

How much was stolen from Bybit?

The FBI says about $1.5 billion in virtual assets. Bybit lists $1.46 billion from one Ethereum cold wallet.

When did it happen?

On or about 21 February 2025. Bybit says the funds were moved out at 14:13 UTC.

Who did the FBI blame?

On 26 February 2025 the FBI said North Korea was responsible and called the activity TraderTraitor. Bybit names the Lazarus Group.

How did the attackers get in?

Bybit says the credentials of a Safe developer were compromised, giving access to Safe{Wallet} infrastructure and letting the attacker deceive signers. Bybit's own systems showed no sign of compromise, according to its forensic experts.

Did Bybit get any money back?

Per Bybit on 7 August 2026, about US$48.4 million was recovered and about US$30.5 million was frozen.

Was there a court case?

Bybit says it filed a civil suit in the US District Court for the District of Columbia and won a preliminary injunction freezing identified assets.

In our research

  1. Bybit theft: what it teaches about supplier access October 2026
  2. tj-actions compromise: how to catch it in your CI October 2026
  3. Check-in outage: one supplier, many airports October 2026
  4. TraderTraitor: North Korea’s Crypto Heist Machine December 2025
  5. The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
  6. APT38: From SWIFT Heists to Crypto Fortresses September 2025

Sources

  1. North Korea Responsible for $1.5 Billion Bybit Hack (alert I-022625-PSA) FBI Internet Crime Complaint Center
  2. Bybit Security Incident: Timeline of Events and FAQs Bybit
  3. Bybit Confirms Security Integrity Amid Safe{Wallet} Incident Bybit
  4. Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction Bybit
  5. 2026 National Proliferation Financing Risk Assessment US Department of the Treasury
  6. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A) CISA

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT38

APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance General Bureau. MITRE lists banks, cryptocurrency exchanges and SWIFT system endpoints among its targets. The US Department of Justice named APT38 in November 2025 forfeiture cases over four 2023 cryptocurrency heists.

Read more

Glossary term

Malicious package

A malicious package is a software package that has been made or changed to carry harmful code, then shared through a package source that developers trust.

Read more