Introduction

On the evening of February 21, 2025, globally renowned cryptocurrency exchange Bybit experienced a massive hacker attack, with $1.46 billion worth of Ethereum stolen, becoming the largest theft in cryptocurrency history. The incident triggered severe market turbulence, with Bitcoin (BTC) plummeting over 4500 points, and the crypto space fell into panic. The North Korean hacker group Lazarus has been identified as the mastermind behind the attack, and Bybit urgently committed to fully compensating user losses. How did this crisis occur? How can it be prevented in the future? This article will provide an in-depth analysis.

Incident Review: Bybit suffered an 'epic' attack.

According to on-chain data monitoring, on the night of February 21, Bybit exchange's hot wallet address showed unusual transactions. Hackers used complex techniques to bypass multiple risk control systems and transferred a total of $1.46 billion worth of Ethereum (ETH) in batches. The stolen amount far exceeded historical records (the previous largest being $450 million from Mt.Gox in 2022), leading to global attention.

After Bybit was attacked, on-chain detective ZachXBT submitted a detailed analysis report to Arkham, confirming that this incident was perpetrated by the North Korean hacker group Lazarus. This group has frequently targeted cryptocurrency institutions in recent years and has been classified as a "national-level cybercrime group" by the FBI.

Market Impact: Bloodbath in the crypto space

After the news of the massive asset theft broke, the cryptocurrency market quickly collapsed:

• Bitcoin (BTC) plummeted from $99k to $95k that night, a drop of over 4500 points.

• Ethereum (ETH) also fell synchronously, dropping to $2,600 within 24 hours, a decrease of 8%;

• Panic spread, with the total liquidation amount across the network surpassing $2.5 billion, resulting in heavy losses for leveraged traders.

Analysts pointed out that this incident not only exposed security vulnerabilities of exchanges but also shook investors' trust in centralized platforms (CEX), with some users beginning to transfer assets en masse to decentralized wallets, further exacerbating market volatility.

Bybit's Emergency Response: Committing to 1:1 full compensation, recovering funds, and ensuring repayment.

In the face of the crisis, the Bybit team released a statement within three hours after the incident, promising that "all user assets will be compensated 1:1" to recover the stolen funds and ensure user asset safety, while suspending deposit and withdrawal services to facilitate security audits. CEO Zhou Peng stated, "The safety of user funds is our bottom line. The platform has activated an insurance fund and emergency reserves to ensure the smooth execution of the compensation plan."

• Report to the authorities and initiate investigations: Bybit has reported the case to the relevant authorities and is cooperating with blockchain forensic experts to track the flow of stolen funds.

• Blocking Hacker Addresses: Bybit is actively cooperating with on-chain analysis providers to identify and isolate affected addresses to limit the hackers' ability to sell the stolen ETH in the market. At the same time, Bybit has also contacted other exchanges and market makers, including Binance and Bitget, seeking assistance in freezing the stolen funds.

• Seeking a Loan: Bybit is seeking cross-chain loans to cope with the surge in withdrawal requests following the incident.

• Guaranteeing User Repayment: Bybit CEO Ben Zhou has repeatedly emphasized that Bybit is well-reserved and all customer assets will be repaid 1:1.

In addition, Bybit is also actively communicating with users through the X platform and live broadcasts to increase the transparency of the incident. Mr. Zhou stated that Bybit's withdrawal services remain normal, and retail withdrawals will be prioritized.

Although Bybit responded quickly, doubts about its risk control capabilities have not subsided. Some users pointed out that Lazarus's previous attack methods have been disclosed multiple times, questioning why the exchange failed to prevent it in advance. Industry insiders are calling for centralized platforms to quickly upgrade security mechanisms such as smart contract audits and cold-hot wallet isolation.

Mastermind: Lazarus's "Cryptocurrency Hunting"

According to the ZachXBT report, in this attack, hackers used a combination of phishing attacks and zero-day exploits to infiltrate Bybit's internal system and forge withdrawal requests. The Lazarus group has been financing the North Korean regime through cryptocurrency thefts in recent years, stealing $100 million worth of assets from Atomic Wallet in 2023 and losing $100 million in the 2024 attack on the cross-chain protocol Harmony, highlighting its threat once again.

The U.S. Treasury previously warned that Lazarus is laundering funds through mixers, cross-chain bridges, and other technologies, converting them into fiat currency to support North Korean military activities. The call for cryptocurrency regulation in the international community may heat up again due to this incident.

Market Response and Subsequent Impact

The Bybit hacking incident has caused a certain impact on the cryptocurrency market:

• Ethereum price drop: After the news broke, the price of Ethereum fell sharply.

• Market sentiment has been hit: The hacking incident has raised investors' concerns about the security of centralized exchanges.

• Massive Withdrawals: Bybit faced an unprecedented number of withdrawal requests.

Nevertheless, Bybit is still trying to stabilize the situation, emphasizing its sound financial status and committing to fully compensate user losses. Binance founder Zhao Changpeng (CZ) also suggested that Bybit temporarily halt withdrawals and expressed willingness to provide assistance.

Bitget CEO Garcy Chen also stated: "Bybit is a respected competitor and partner. Although the loss is significant, it is equivalent to their annual profit. I believe customer funds are 100% safe, and there’s no need to panic or withdraw. Keep it up, Brother Ben!"

Industry Reflection: How to resolve the crisis of security and trust?

The Bybit incident sounds the alarm for the cryptocurrency industry:

1. Technical Aspects: Exchanges need to adopt stricter on-chain monitoring and real-time anomaly transaction interception systems;

2. User Education: Be wary of phishing attacks and avoid authorizing unknown contracts;

3. Regulatory Cooperation: Countries need to establish cross-border hacker tracking and asset freezing mechanisms.

Well-known security agency Slow Mist Technology advises: "Users should prioritize exchanges with multi-signature and offline cold storage, and regularly check authorization permissions."

Conclusion

Bybit's exorbitant theft case once again proves that while the cryptocurrency industry pursues innovation and efficiency, security remains the cornerstone of survival. Although the platform promises compensation, restoring market confidence will still take time. For ordinary investors, diversifying assets and enhancing security awareness may be the most pragmatic strategy at present.

"In the crypto world, your private key is your lifeline." — This time, the price we paid is too heavy.

Follow Deanna for first-hand on-chain security information and in-depth analysis!

Data in this article is as of February 22, 2025, investment involves risks, and caution is needed when entering the market.

Original Statement: This article is exclusively compiled and requires authorization for reprinting.