Bybit Hack News Live : $1 Billion Hack Bounty Solved by Zachxbt , Ethereum Stolen and More

Conor Grogan labeled the Bybit hack as the largest theft in human history, suggesting it may ignite discussions about potential Ethereum forks. Meanwhile, investor Arthur Hayes stated that if the Ethereum community opts for a rollback, he would support the decision, given his significant holdings in the cryptocurrency.

A MEXC hot wallet transferred 12,652 stETH (≈$33.75M) to the Bybit cold wallet. Additionally, Bybit is set to receive 64,452 ETH (≈$170M) in loan support from Bitget—an institution withdrawing funds from Binance and MEXC. Furthermore, a whale or institutional entity transferred 11,800 ETH (≈$31M) from Binance to Bybit’s cold wallet, aiding customer withdrawals. These coordinated moves highlight significant inter-exchange efforts to secure liquidity and support clients amid ongoing market challenges.

According to Eric Wall, North Korean hackers are expected to convert stolen ERC20 tokens into ETH, then into BTC, and eventually into CNY via Asian exchanges. These funds are believed to be used to finance North Korea’s nuclear weapons and ballistic missile programs.

Ethereum experienced a significant pullback to $2,850 after Bybit’s hack, where $1.44B in ETH-based assets were stolen. Despite the setback, Ethereum (ETH)—the world’s second-largest cryptocurrency by market capitalization—is now trading at $2,728.71, up 0.15% from the previous close. The day’s trading has seen highs of $2,839.50 and lows of $2,712.00, showcasing Ethereum’s resilience amidst market turbulence.

Park Jin Hyok to the Lazarus Group, a mysterious hacker collective believed to be backed by North Korea. Active since 2010, Lazarus Group has been implicated in multiple high-stakes cyberattacks globally. Their previous exploits include major hacks such as the Axie Infinity Ronin Bridge incident that resulted in a $625M loss, along with attacks on Harmony Bridge ($100M), Atomic Wallet ($100M), Stake ($41M), Alphapo Hot Wallet (over $60M), and WazirX ($230M).

At 19:09 UTC today, renowned on-chain sleuth ZachXBT submitted compelling evidence linking Bybit’s $1B hack to the Lazarus Group. His submission featured detailed analysis of test transactions, connected wallets, forensic graphs, and timing analyses. This definitive proof has been shared with Bybit to support their ongoing investigation.

Since the hack 10 hours ago, Bybit has experienced record withdrawal volumes, with over 350,000 requests and nearly 99.994% completed, leaving around 2,100 pending. Despite facing one of the worst hacks in financial history, all functions remain operational. The entire team is on deck, fully supporting clients throughout this crisis.

The Dilation Effect reveals that the Bybit attacker exploited delegatecall to run a malicious transfer function. This function uses SSTORE to alter slot 0, changing the multi-signature contract’s implementation address on the cold wallet to the attacker’s. By disguising this as a simple fund transfer, reviewers are misled, unaware that a critical contract modification is underway.

Blockchain analysis indicates that the hacker behind Bybit’s $1.4B heist appears to have received ETH from Binance to cover gas fees. This transaction helped facilitate the necessary operations, adding a new twist to the unfolding investigation.

OKX expressed support for Bybit amid the recent hack. In a tweet, the exchange confirmed that its wallet infrastructure is different, preventing similar issues, and stated that its security teams are engaged and ready to assist. OKX will continue monitoring blacklisted wallet addresses to ensure user safety.

Bybit CEO Ben Zhou assured customers that client funds remain safe, stating, “no matter what, your money is safe.” He also confirmed that the Bybit treasury is fully capable of covering the 400,000 ETH hacked, reinforcing confidence in the platform’s ability to safeguard user assets.

According to Truth Labs, a serious vulnerability exists on Bybit’s Layer 2, Mantle. Their analysis shows one person controls enough multi-sig wallets—6 of the 13 required signatures, with 4 inactive wallets potentially under the same control—to drain or manipulate the entire network. Users are urged to withdraw funds immediately.

Bybit CEO Ben Zhou stated that the exchange won’t buy ETH immediately to cover hack losses due to the massive volume involved. However, he confirmed that 80% of the required ETH has already been secured through a bridge loan.

ByBit CEO Confirms all-hands-on deck and all employees available for maximum levels of customer service. Gaurantees all customer funds will be covered and safe despite hack. He claims “there could be multiple reasons how this happened.”

Following the withdrawal of 401,346 ETH, the hacker began dispersing funds across multiple wallets. Specifically, 39 addresses received 10,000 ETH each, with an additional 9 addresses also receiving 10,000 ETH apiece. This classic laundering tactic spreads out funds to complicate tracing efforts. Below is the complete list of hacker wallets.

Arkham released a list of Bybit hacker wallets, revealing the attacker controls $1.37B in ETH across 53 wallets. This exploit is the largest ever, representing 16% of all crypto hacks.

Safe’s security team is collaborating with Bybit on an ongoing investigation. Although there is no evidence that the official Safe frontend was compromised, the Safe Wallet is temporarily pausing certain functions as a precaution. SlowMist noted that the situation bears similarities to the previous Radiant Capital incident linked to North Korean hackers.

A hacker has compromised $1.4B from Bybit, initiating large transfers of roughly 10K ETH per address. In the past 30 minutes, at least $200M USDT moved from Bybit’s cold wallet to its hot wallet, though it’s unclear whether this was for user withdrawals or an ETH buyback. While most of the stolen funds are in ETH—and its price briefly dropped 3% before recovering—on-chain data confirms the loss represents only 8.64% of Bybit’s $16.2B reserves, ensuring the exchange can cover the shortfall. Despite the surge in activity, withdrawals remain fully functional.

Cryptocurrency prices reversed early gains after reports surfaced that Bybit experienced $1.5 billion in outflows amid a potential security incident. Bitcoin slid from near $100,000 to about $97,000, while ether dropped nearly 4%, falling below $2,700. This downturn also triggered liquidations of roughly $100 million in leveraged long positions, according to CoinGlass data.

Ethena Labs confirms that all spot assets backing USDe are held off-exchange, including Bybit via Copper Clearloop, ensuring no spot backing value is directly on any exchange. The company’s Bybit hedge positions remain below $30 million in unrealized PNL, which is less than half of the reserve fund. Consequently, USDe remains fully collateralized, preserving its stability despite recent market developments.

Bybit’s proof of reserves indicated the exchange held $16.2 billion in assets before the recent hack. The stolen $1.4 billion accounted for 8.64% of Bybit’s total holdings. Despite this breach, the exchange maintains that it remains solvent and that all other cold wallets and operations are unaffected.

Tron founder Justin Sun stated that he and his team are closely monitoring the Bybit incident following the hack. He assured that Tron will offer full support to its partners in tracking the misappropriated funds, pledging to leverage all available resources to assist in the investigation and fund recovery efforts.

Bybit is experiencing significant outflows, with over $1.4B in ETH and stETH leaving the platform. The funds are rapidly being transferred to new addresses where they are actively being sold, including $200M in stETH already offloaded. Notably, activity has been detected from address 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2.

Bybit detected unauthorized activity in an ETH multisig cold wallet transferring funds to a warm wallet after hackers manipulated the signing interface and altered smart contract logic. The security team and blockchain forensic experts are investigating. All other cold wallets remain secure, ensuring client funds and overall operations are unaffected.

According to Crypto Rover, a rapid outflow exceeding $1.46 billion from Bybit has raised alarms over a potential security breach. The incident could disrupt trading and shake investor confidence. Traders are advised to closely monitor emerging developments for further impact.

Bybit continues processing withdrawals seamlessly after a recent signing hack. With over $20 billion in assets on the platform and cold wallets remaining untouched, the incident appears isolated. Investors remain reassured that contagion is highly unlikely; market confidence holds strong.

Bybit was hacked for over $1.4 billion following suspicious ETH outflows reported by on-chain sleuth ZachXBT. CEO Ben Zhou confirmed hackers exploited a spoofed UI to alter a cold wallet’s smart contract logic, transferring all ETH to an unknown address. The exchange remains solvent and seeks help tracking the funds.