Bybit Suffers Major Exploit as Hacker Steals Over $1.4B Worth of ETH

Bybit has suffered a major exploit, with a hacker stealing more than $1.4 billion worth of ETH and staked ETH. The crypto exchange's CEO Ben Zhou confirmed the hack via Twitter on Friday, noting the attacker exploited a vulnerability that allowed them to drain its ETH cold wallet.

Major crypto exchange Bybit has fallen victim to a large-scale hack, with an attacker making away with over $1.4 billion in ETH and staked ETH.

The hack was confirmed by Bybit CEO Ben Zhou on Friday, who stated that the attacker exploited a vulnerability to drain the exchange's ETH cold wallet.

News of the hack, which ranks among the largest ever in the crypto market, caused several crypto prices to react lower. Ethereum price gave up some of its intraday gains, though the reaction was still relatively muted at the time of writing.

Bybit solvent despite hack: CEO

Bybit also posted an update detailing the incident:

“Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic. As a result, the attacker was able to gain control of the affected ETH cold wallet and transfer its holdings to an unidentified address.”

While the exchange did take a hit from the attack, Zhou stated that Bybit “was solvent” and that the exchange can cover these losses. The exchange's withdrawals were also unaffected, he noted.

“Bybit is solvent even if this hack loss is not recovered,” he posted on X. “All of clients’ assets are 1-to-1 backed, we can cover the loss.”

Several blockchain security platforms and investigators, including ZachXBT, noted that the hacker had already begun to transfer the funds to new addresses.

Meanwhile, blockchain intelligence firm Arkham announced a bounty as ecosystem players attempt to uncover the hacker's identity.