Incident reportExchange hackEthereum
Bybit −$1.5B
The signers approved a transfer. The screen just didn't show them the real one.
What happened
Bybit lost about $1.5 billion in ETH from a cold wallet. The signing interface the team relied on had been tampered with, so a routine-looking transfer handed control of the wallet to the attacker.
Timeline
Feb 21
A cold-wallet transfer is signed; the wallet is drained of roughly $1.5 billion in ETH.
Feb 21
Bybit's CEO goes live to say the exchange is solvent and withdrawals continue.
Feb 26
The FBI attributes the theft to North Korea and asks exchanges to block the funds.
Aftermath
Bybit stayed open and replaced the lost ETH with loans and purchases. Most of the stolen funds were laundered within weeks.
Date2025-02-21
Lost$1.5B
WhoAttributed by the FBI to North Korea (TraderTraitor)
It was a routine transfer.
Lesson Cold storage is only as cold as the laptop that signs for it.