Singapore – Cryptocurrency exchange Bybit is battling a major crisis following a devastating security breach that saw a staggering $1.44 billion in Ethereum-based assets pilfered from its wallets. The hack, confirmed on Friday, February 21, 2025, has been attributed to the notorious North Korean Lazarus Group by prominent blockchain investigator ZachXBT, marking it as potentially one of the largest crypto heists in history.
The fallout from the exploit sent ripples through the crypto market, with Ethereum (ETH) prices plummeting and over $136 million in ETH futures positions liquidated within a 24-hour window.
Cold Wallet Compromised, Billions Drained
According to on-chain analysis, the attackers targeted a Bybit cold wallet holding Ethereum assets, systematically draining:
- 401,347 ETH: Valued at approximately $1.12 billion
- 90,376 stETH: Worth around $253 million
- 23,000 cmETH & mETH (combined): Estimated at $67 million
The stolen funds were rapidly dispersed across a network of newly created addresses, a signature tactic employed by Lazarus Group to obfuscate their illicit gains. Bybit has confirmed partnerships with blockchain analytics firms to meticulously track these wallets and actively work to prevent further laundering of the stolen assets.
“Definitive Proof” Links Attack to Lazarus Group
Renowned blockchain sleuth ZachXBT has presented compelling evidence definitively linking the Bybit attack to the Lazarus Group, a state-sponsored North Korean hacking organization infamous for targeting financial institutions and crypto platforms. ZachXBT, in collaboration with Josh from CF, pointed to on-chain patterns, including test transactions and wallet movements that mirror the recent $30 million Phemex hack, also attributed to Lazarus.
“TLDR myself and Josh from CF connected the Bybit hack on-chain to the Phemex hack,” ZachXBT stated via social media platform X, solidifying the connection.
Lazarus Group has a notorious track record in the crypto space, having been linked to the infamous $625 million Ronin Network breach and the $100 million Atomic Wallet exploit. The persistent targeting of crypto exchanges by this group underscores the ongoing security challenges within the decentralized finance ecosystem. Adding to the urgency, blockchain intelligence platform Arkham has offered a bounty of 50,000 ARKM tokens (approximately $32,000) for information leading to the identification of the perpetrators behind the Bybit attack.
Ethereum Price Stumbles, Futures Market Rocked
The news of the massive hack triggered a sharp negative reaction in the Ethereum market. ETH prices tumbled 6%, falling to $2,560 and effectively halting its recent rally towards the $2,900 mark. The market volatility resulted in a significant liquidation event, with over $136 million in ETH futures positions wiped out in 24 hours. Interestingly, long positions were slightly more affected than shorts, with $70 million in long liquidations compared to $66 million in short liquidations.
Technical Indicators Flash Caution for ETH
Analysts are closely watching Ethereum’s technical indicators in the wake of the hack. Key technical levels to monitor include:
- Resistance: $2,850, considered a critical sell zone dating back to August 2024.
- Support: $2,560, a crucial level that must hold to facilitate any potential price recovery.
For a bullish reversal, analysts suggest the Relative Strength Index (RSI) and Moving Average Convergence Divergence (MACD) indicators need to decisively cross into neutral territory. Failure to hold the $2,560 support level could trigger a deeper decline, with a potential plunge towards $1,500 if the price breaches $2,200.
Bybit CEO Assures Users, Opts for Bridge Loans
In an effort to reassure users and stabilize the market, Bybit CEO Ben Zhou addressed the breach, stating that the exchange has secured 80% of the stolen funds through bridge loans. This short-term liquidity solution is intended to allow Bybit to meet user withdrawals without resorting to massive ETH buybacks on the open market, which could further destabilize prices.
“We are not buying Ethereum—it’s too large an amount to move. Bridge loans help us manage withdrawals without market disruption,” Zhou explained.
Bybit has confirmed that they are actively collaborating with law enforcement agencies and prioritizing user withdrawals, even those currently under review, demonstrating a commitment to mitigating the impact on their user base.
Broader Implications for Crypto Security
This latest incident serves as a stark reminder of the persistent vulnerabilities within the cryptocurrency industry and the sophisticated threats posed by state-linked actors like Lazarus Group. Their repeated success in targeting crypto platforms, evidenced by previous attacks like the Ronin Network and Alphapo exploits, underscores the urgent need for enhanced security protocols and robust safeguards across the entire sector.
Bybit’s Official Response Highlights Key Actions:
- Incident reported to law enforcement authorities.
- Active tracking of wallets associated with the stolen funds to impede further movement.
- Commitment to providing regular updates to users regarding the ongoing situation.
Conclusion: Crypto Community on Edge as Investigations Unfold
As Bybit navigates this significant crisis, the crypto community remains on high alert, closely monitoring Ethereum’s price action and awaiting further updates on the investigation. The $1.44 billion hack underscores the inherent risks in decentralized finance and the ever-present threat from sophisticated, state-sponsored cybercriminal organizations. The industry now faces renewed pressure to fortify its defenses and proactively address the evolving landscape of crypto security threats.
Stay tuned for further updates as this story develops.
#BybitHack #LazarusGroup #Ethereum #CryptoNews
Disclaimer: This content is for informational purposes only and should not be considered financial advice. Cryptocurrency investments are inherently volatile and carry a high degree of risk. Conduct thorough research and consult with a financial advisor before making any investment decisions.
Leave a Reply