Why did the Bybit hacker favor ETH? High value or high liquidity?

The hackers' preference for ETH in the Bybit hack is attributed to its high value and liquidity, providing lucrative targets and quick realization channels.

Feb 22, 2025 at 03:30 pm

On the evening of February 21st, Beijing time, the cryptocurrency trading platform Bybit was hacked, and over 400,000 ETH and stETH with a total asset value of over $1.5 billion (approximately 10.8 billion yuan) were transferred to unknown addresses. This hacking incident is the largest - scale theft in history. Security agencies have confirmed that the attacker is the notorious hacker group Lazarus Group, which stole $200 million worth of Bitcoin by hacking into a South Korean exchange in 2017. In this attack, why do hackers have a special preference for ETH? Is it because of its high value or high liquidity?

High Value: The Unique Status of ETH

In terms of market price, the price of ETH has always been at a high level. With the development of the cryptocurrency market, the value of ETH has also been constantly rising. This makes ETH an extremely attractive target for hackers. Once a large amount of ETH is successfully stolen, hackers can obtain huge profits by selling these assets. Taking the Bybit hacking incident as an example, the stolen over 400,000 ETH is worth over $1.5 billion, which is undoubtedly a huge fortune.

In addition, the core role of ETH in the cryptocurrency ecosystem also increases its value. Many decentralized applications (dapps) and smart contracts are built on the Ethereum platform, and ETH is the foundation for the operation of these applications and contracts. Therefore, controlling a large amount of ETH is equivalent to controlling a part of the cryptocurrency ecosystem, which is very attractive to hackers.

High Liquidity: The Key to Quick Realization

Besides high value, the high liquidity of ETH is also an important reason why hackers choose it. Liquidity refers to the ability of an asset to be bought and sold quickly at a reasonable price. In the cryptocurrency market, ETH has a very high liquidity, which means that hackers can exchange the stolen ETH for other assets or directly realize it into cash in a short time.

The high liquidity of ETH is mainly reflected in the following aspects:

Extensive trading pairs: On most cryptocurrency exchanges, ETH has a rich variety of trading pairs and can be traded with Bitcoin, stablecoins, and various other cryptocurrencies. This allows hackers to flexibly choose which asset to exchange ETH for according to market conditions to maximize their interests.

A large number of trading platforms: ETH can be traded on numerous cryptocurrency trading platforms around the world, whether they are centralized exchanges or decentralized exchanges. This provides hackers with more options and facilitates their operations on different platforms to avoid being tracked.

Active market participants: Ethereum has a large user base and active market participants, which makes the trading of ETH very frequent. In such an active market environment, hackers can easily sell the stolen ETH without causing too much impact on the market price.

Taking the previous paths of Lazarus Group in handling the stolen funds as an example, they generally take three steps to "dispose" of the obtained stolen funds: The first step is to exchange all ERC20 (including liquid - derivative tokens such as stETH) for ETH; the second step is to exchange ETH for BTC; the third step is to gradually convert BTC into fiat currency through Asian exchanges. During the whole process, the high liquidity of ETH enables the stolen funds to be quickly and smoothly converted, providing convenience for hackers to finally realize the funds.

The Dual Temptation of High Value and High Liquidity

Overall, the reason why hackers on Bybit have a special preference for ETH is both its high value and high liquidity. The high value makes ETH a "lucrative target" in the eyes of hackers, and the high liquidity provides hackers with a way to quickly realize the funds. The two complement each other and jointly constitute the great attraction of ETH to hackers.

In addition, the smart contracts and decentralized applications of Ethereum also provide hackers with more opportunities and means of attack. In this Bybit hacking incident, hackers successfully controlled the ETH cold wallet by manipulating the smart - contract logic of the cold wallet, thus achieving the theft of a large amount of ETH. This also reminds the cryptocurrency industry that while developing, it must strengthen security protection and guard against various possible attacks.

This Bybit hacking incident has once again sounded the security alarm for the cryptocurrency market. For investors and cryptocurrency exchanges, it is necessary to attach more importance to asset security, strengthen security protection measures, and improve the ability to respond to hacker attacks. At the same time, regulatory authorities should also strengthen the supervision of the cryptocurrency market, standardize the market order, and protect the legitimate rights and interests of investors. Only in this way can the healthy and stable development of the cryptocurrency market be promoted.

Disclaimer:info@kdj.com

The information provided is not trading advice. kdj.com does not assume any responsibility for any investments made based on the information provided in this article. Cryptocurrencies are highly volatile and it is highly recommended that you invest with caution after thorough research！

If you believe that the content used on this website infringes your copyright, please contact us immediately (info@kdj.com) and we will delete it promptly.

Fear & Greed Index

Trade Now

Biggest Gainers

RAIN

$0.007852

113.00%

Trade Now
PIPPIN

$0.06097

51.96%

Trade Now
PARTI

$0.1396

42.04%

Trade Now
WAVES

$0.9141

41.69%

Trade Now
ARC

$0.04302

35.73%

Trade Now
HONEY

$0.01029

21.80%

Trade Now

Latest Crypto News

Bitcoin, eCash Fork, and Airdrop Dynamics: A Deep Dive into Crypto's Latest Controversies
2026-05-03 12:55:01
Consensus 2026 Miami: Web3, Blockchain, Cryptocurrency, NFTs, Metaverse, Conference, May 5th — Where Wall Street Meets the Digital Frontier
2026-05-02 12:45:01
Fed Holds Rates Steady, Triggering Bitcoin Price Drop Amidst Geopolitical Tensions
2026-05-01 06:45:01
Bitcoin Miners Electrify the Grid: Ohio Gas Plant Acquisition Powers Up a New Era for Digital Gold
2026-05-01 00:45:01
MegaETH's MEGA Token Hits the Big Apple: Setting New Performance Benchmarks for Real-Time Blockchain
2026-05-01 00:55:01
Solana's Slippery Slope: Price Prediction Points to Resistance Loss and Potential Further Drops
2026-05-01 06:45:01

Related knowledge

What Every New Crypto User Should Know Before Trading on Binance

Jun 19,2026 at 05:40am

Account Setup and Verification1. Binance requires identity verification before enabling fiat deposits or higher withdrawal limits. Users must submit g...

How to Navigate Binance App Efficiently? Essential Features Explained

Jun 19,2026 at 05:59pm

Core Navigation Structure1. The Binance mobile app organizes functionality into five primary bottom tabs: Home, Trade, Wallet, Orders, and More. Each ...

The Most Common Crypto Exchange Mistakes New Users Make and How to Avoid Them

Jun 19,2026 at 07:40am

Ignoring Wallet Address Verification1. Copying and pasting wallet addresses without manual cross-checking remains one of the most frequent errors duri...

How to Verify Binance Proof of Reserves as a User

Jun 18,2026 at 06:39pm

Accessing Binance’s Official Reserve Dashboard1. Navigate directly to Binance’s Proof of Reserves page via the official website’s Security section—not...

What Is Proof of Reserves? How Binance Demonstrates Asset Transparency

Jun 17,2026 at 09:39am

What Is Proof of Reserves?1. Proof of Reserves (PoR) is a cryptographic verification mechanism designed to confirm that a centralized cryptocurrency e...

How to Track Crypto Transactions for Tax Compliance

Jun 14,2026 at 01:48am

Global Regulatory Frameworks Impacting Transaction Tracking1. The Crypto-Asset Reporting Framework (CARF) mandates that all service providers facilita...