Bybit loses nearly $1.5 billion in crypto hack—What we know so far

Dubai-based cryptocurrency exchange Bybit has found itself at the centre of a financial storm. Hackers made off with nearly $1.5 billion worth of Ethereum (ETH) from the platform’s cold wallet, triggering a mass panic among users. The fallout was immediate: over $4 billion in additional withdrawals followed, bringing the total outflow to a jaw-dropping $5.5 billion.

Blockchain analysts quickly pointed fingers at the North Korean hacking syndicate, Lazarus Group, notorious for targeting digital asset platforms. CEO Ben Zhou took to social media and a live X Spaces session to address the crisis, reassuring users: “Bybit is solvent even if this hack loss is not recovered. All client assets are 1:1 backed, and we can cover the loss.”

The Race to Secure Withdrawals

The security breach prompted a swift reaction from Bybit’s internal teams. Zhou recounted his immediate call for “all hands on deck” to facilitate withdrawals and manage user concerns.

A major complication arose when Safe—a decentralised custody protocol—temporarily shut down its smart wallet functionalities to investigate potential vulnerabilities. Safe’s move left Bybit unable to access $3 billion in USDT reserves stored in its cold wallets. “We had to develop new software, manually verify signatures, and work through the night to process withdrawals,” Zhou revealed.

Despite these challenges, Bybit managed to stabilise its operations, successfully withdrawing the $3 billion locked in Safe wallets and moving funds to alternative storage solutions. Zhou confirmed that “about 50% of all exchange funds” had been withdrawn during the crisis.

North Korea’s Alleged Involvement

Blockchain investigator ZachXBT and crypto intelligence firm Arkham traced the stolen funds, finding patterns similar to previous Lazarus Group exploits. The notorious hacking collective, believed to operate under North Korea’s directive, has been responsible for multiple high-profile crypto thefts, allegedly using stolen assets to fund Pyongyang’s nuclear programme.

Arkham awarded ZachXBT a $50,000 bounty for his investigative work, which suggested that, if the Lazarus Group’s involvement is confirmed, North Korea could now be among the largest holders of Ethereum—surpassing even Ethereum’s co-founder Vitalik Buterin.

Calls to ‘Roll Back’ Ethereum

As the scale of the hack became clear, some within the crypto community floated a controversial idea: reversing the Ethereum blockchain to recover stolen funds. Even BitMEX co-founder Arthur Hayes suggested this possibility. Zhou admitted that Bybit had “engaged Vitalik [Buterin] and the Ethereum Foundation” to explore options. However, he acknowledged that rolling back Ethereum was unlikely due to the decentralised nature of the blockchain. “It’s not a one-man decision. It should be up to the community,” he said.

Experts were quick to highlight the immense technical and ethical challenges such a rollback would pose. Any attempt to alter Ethereum’s state retroactively would almost certainly result in a contentious hard fork, splitting the network and undermining trust in blockchain immutability.

Regulatory Scrutiny and Industry Fallout

The scale of Bybit’s hack is expected to attract significant regulatory scrutiny. In recent months, Bybit has already been navigating complex legal landscapes. In India, it faced penalties and suspension from the Financial Intelligence Unit for non-compliance with anti-money laundering regulations. Meanwhile, in France, the exchange was recently removed from the financial regulator’s blacklist after two years of engagement.

The breach also sent ripples through the cryptocurrency market. Ethereum’s price dropped nearly 4% in the immediate aftermath, reflecting investor anxiety over security vulnerabilities in the industry. The incident serves as a stark reminder that even well-established exchanges remain prime targets for increasingly sophisticated cybercriminals.

A Masterclass in Crisis Management?

While the breach was a disaster, Bybit’s crisis response earned praise from some industry observers. Casey Taylor commented on X: “Bybit just delivered a masterclass in crisis communications after experiencing the largest hack in crypto history.”

Bybit’s transparency, swift communication, and ability to process withdrawals helped contain panic. The company quickly secured a bridge loan to cover the loss and assured users that operations would continue without disruption. Unlike past exchange hacks that led to financial collapses, Bybit’s proactive approach demonstrated resilience.

What’s Next for Bybit and Crypto Security?

The Bybit hack underscores the evolving threats facing cryptocurrency exchanges. It raises urgent questions: How can platforms enhance security? Should decentralised wallets rethink their smart contract protocols? How should regulators respond to prevent such breaches in the future?

For now, Bybit remains operational, with its CEO vowing to implement stronger security measures and explore alternative custody solutions. However, the attack is a stark warning: even the biggest players in crypto are not immune. As the industry pushes forward, the need for robust security, regulatory compliance, and crisis preparedness has never been greater.