ByBit hacked 1,4billions $ stolen ( in ETH).

[toums]

More than 1 billion already left the exchange.

ALERT: $1B+ OUTFLOWS FROM BYBIT

$1.4B in ETH and stETH outflows from Bybit

The funds have begun to move to new addresses where they are being sold. So far $200M stETH has been sold.

Address: 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2 pic.twitter.com/TfGm2UCjM5

— Arkham (@arkham) February 21, 2025

Funds are not safu.

Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change…

— Ben Zhou (@benbybit) February 21, 2025

This makes it the biggest hack (in fiat equivalent) in the history of CEX.

 

[Marshal]

The amount is just crazy. Anyone from this forum effected?

 

[0xDEADBEEF]

Congrats to Ben Zhou on his newfound billionaire status.

 

[sknomad]

This is why cold wallet is the most secure.

 

[cherry]

The whole idea of a custodial wallet is subversive to the point of a scam. Sheeple too weak to take personal responsibility for their money, give it to regulated companies, thinking that means their money is safe. I wonder how many who lost their money will keep their own wallets from now on? Probably very few, because the sheep want their lives run for them.

 

[JohnnyDoe]

Congrats to Ben Zhou on his newfound billionaire status.

This.
His explanation makes no sense.

 

[uplana]

I'm happy I learned in the early days from people around here to store my crypto in cold wallets!

 

[void]

and the s**t show goes on
https://www.coindesk.com/markets/20...ethereum-network-to-negate-usd1-4b-bybit-hack

yeah, we all should definitely focus on technologically superior innovative proof of stake networks where there is somebody who you can ask for help when things go wrong -

 

[Frankie]

I'm happy I learned in the early days from people around here to store my crypto in cold wallets!

100%. Anybody trusting ANY exchange more than to do a quick transaction and then immediately withdraw is a fool.

 

[Marie Manila]

One short question, I recently found approx. 1.4 billion USD in ETH and stETH. Unfortunately I have no SOF.
Any ideas how to cash it out with no questions asked?
It's urgent!


Joking aside.
This large amount can never be used by the thieves. There will always be queries about SOF.
And sooner or later they will make a mistake.

 

[cckuhqilfownnfctux]

One short question, I recently found approx. 1.4 billion USD in ETH and stETH. Unfortunately I have no SOF.
Any ideas how to cash it out with no questions asked?
It's urgent!


Joking aside.
This large amount can never be used by the thieves. There will always be queries about SOF.
And sooner or later they will make a mistake.

there are countries where no SoF questions asked when crypto is involved, for example Russia or China.

 

[void]

there are countries where no SoF questions asked when crypto is involved, for example Russia or China.

exactly, endless option to get rid of any volume, maybe not instantly but surely doable

 

[cckuhqilfownnfctux]

https://cryptonews.com/news/bybit-fraudster-gets-almost-decade-behind-bars-for-massive-scheme/
read between lines

 

[void]

this is even better than FTX

 

[ilke]

People Sheeple never learn.

 

[OKboomer]

Congrats to Ben Zhou on his newfound billionaire status.

This.
His explanation makes no sense.

Could you please explain how and why?
If this is his own exchange anyway, why would he steal it and probably damage big equity value of his exchange?
Moreover, today onchain tracing and analytics are so comprehensive and assisted by AI that he has almost no chance to launder his proceeds (or he will lose probably 60-80% of the net asset value to do so by dealing with those willing to handle it). So they are likely stuck with a 10-fig asset they can't properly spend in most jurisdictions
What would be the benefit?
Even if this negates their total income for this year, as they claim, assuming they are Dubai based, they would only be due 9% of that.

I am ready to believe things are not what they say they are, but i see no cohesive explanation, backed by any facts so far

Either way, shitty days for crypto ....

 

[void]

Either way, shitty days for crypto ....

this particular event (just like FTX, Celsius and similar stories) is maybe bad for crypto but positive for bitcoin, the holders and self-custody, just another lesson what not to do and what everyone should have known for years

 

[0xDEADBEEF]

Some updates over the weekend:

https://blog.trailofbits.com/2025/0...of-operational-security-failures-has-arrived/

Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents.

Overlap address:
0x33d057af74779925c4b2e720a820387cb89f8f65

Bybit hack txns on Feb 22, 2025:… pic.twitter.com/dh2oHUBCvW

— ZachXBT (@zachxbt) February 22, 2025

Could you please explain how and why?

Compromising the signing infrastructure is one of the worst things that can happen to a company. The fact that all signs point to basic security failures says a lot about the management. If they can’t get the fundamentals right, they’re a risk to the organization. I’ve flagged this kind of thing to risk committees before as a classic insider threat. Fraud like this usually comes down to a mix of opportunity and the belief that they can actually pull it off.

Saying the funds can’t be laundered is wishful thinking. Sure, AI-powered tracking makes it harder, but there are still plenty of ways to cash out. Slow, structured withdrawals, OTC deals, or working with state-sponsored actors (hint, hint) and darknet liquidity pools. A well-connected person can move large amounts over time, even if they take a haircut on the value.

And if management ignored basic security controls, it’s not a stretch to think they also lacked internal oversight. That kind of setup is exactly how insider fraud happens, making an inside job more than just possible, it’s actually pretty likely.

 

[void]

Some updates over the weekend:

https://blog.trailofbits.com/2025/0...of-operational-security-failures-has-arrived/

Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents.

Overlap address:
0x33d057af74779925c4b2e720a820387cb89f8f65

Bybit hack txns on Feb 22, 2025:… pic.twitter.com/dh2oHUBCvW

— ZachXBT (@zachxbt) February 22, 2025

Compromising the signing infrastructure is one of the worst things that can happen to a company. The fact that all signs point to basic security failures says a lot about the management. If they can’t get the fundamentals right, they’re a risk to the organization. I’ve flagged this kind of thing to risk committees before as a classic insider threat. Fraud like this usually comes down to a mix of opportunity and the belief that they can actually pull it off.

Saying the funds can’t be laundered is wishful thinking. Sure, AI-powered tracking makes it harder, but there are still plenty of ways to cash out. Slow, structured withdrawals, OTC deals, or working with state-sponsored actors (hint, hint) and darknet liquidity pools. A well-connected person can move large amounts over time, even if they take a haircut on the value.

And if management ignored basic security controls, it’s not a stretch to think they also lacked internal oversight. That kind of setup is exactly how insider fraud happens, making an inside job more than just possible, it’s actually pretty likely.

well said, the company has obviously critical design flaws in their infrastructure and processes and will likely disappear from the market (which is a good thing)
I'd be surprised if the attackers would have to give up more than 20% of the nominal market value of the loot to cash out

 

[OKboomer]

this particular event (just like FTX, Celsius and similar stories) is maybe bad for crypto but positive for bitcoin, the holders and self-custody, just another lesson what not to do and what everyone should have known for years

I would say it is shitty days for bitcoiners too. Even if they can gloat at every other coin bleeding to death, lazarus hopped onto BTC as well, so i assume all the old bs adages of compliance people about bitcoin being used for scams and money laundering will be back in full swing again and all attempts to make the industry look less scammy have been erased.
It was already hard cashing out crypto. I imagine it will get even worse now.