Research and development
Last updated
2025/2/27
On February 21, 2025, the cryptocurrency exchange Bybit suffered what is being called the largest hack in its history, with losses amounting to approximately $1.5 billion (around ¥150 billion). This incident sent shockwaves through the crypto industry, underscoring once again the critical importance of robust security measures. In this article, we’ll review the incident, explore its background and causes, and consider countermeasures to prevent similar attacks in the future.
Bybit’s CEO, Ben Zhou, revealed that the breach targeted the exchange’s Ethereum (ETH) cold wallet. Hackers executed a sophisticated attack during a routine transfer to a warm wallet, tampering with the signing interface. Although the displayed address appeared legitimate, the underlying smart contract logic had been altered, resulting in the unauthorized withdrawal of approximately 401,346 ETH—valued at around $1.4 billion at the time, with additional tokens pushing the total to $1.5 billion.
Bybit’s response was swift and commendable. According to CNBC, within 72 hours of the hack, the exchange secured roughly 447,000 ETH through emergency loans from firms like Galaxy Digital, FalconX, and Wintermute, as well as deposits from major investors. An audit by cybersecurity firm Hacken confirmed that Bybit’s core asset reserves exceeded 100%, allowing it to maintain customer withdrawals. However, recovering the stolen funds has proven challenging. Investigations suggest that the North Korean hacking group “Lazarus Group” is likely behind the attack, though tracking efforts continue.
Several factors converged to enable this incident:
Sophisticated Social Engineering As reported by Ledger Insights, the hackers used phishing tactics to gain access to a device used by one of the cold wallet signers. By injecting malicious JavaScript into the Safe multi-signature wallet’s user interface via malware, they tricked the signer into approving fraudulent transactions unknowingly. This attack relied more on exploiting human psychology than technical vulnerabilities, making it harder to counter with traditional security measures.
Centralized Exchange Vulnerabilities Centralized exchanges (CEX) like Bybit manage vast amounts of assets, making them prime targets for hackers. Unlike decentralized finance (DeFi), where assets are spread across users, a CEX concentrates funds in one place, amplifying the potential damage of a single breach. The fact that even a “secure” cold wallet was compromised in this case is particularly alarming.
North Korean Involvement and Laundering Challenges Blockchain analytics firms like Chainalysis and Elliptic have linked the stolen funds to addresses associated with Lazarus Group, a North Korean outfit notorious for attacks like the Ronin Network ($600 million) and Poly Network ($611 million) heists. These funds are believed to support nuclear programs. Yet, blockchain’s transparency has allowed trackers to freeze over $19.5 million so far, suggesting the hackers haven’t fully succeeded in cashing out.
This incident highlights the need for the crypto industry to rethink security. Here are some practical steps forward:
Air-Gapped Devices ＜＜＜ Proposed implementation of our quantum cryptographic device Ledger Insights cites banks using offline PCs or devices with disabled USB ports. Bybit could isolate signer devices entirely from networks and require manual parameter entry (e.g., avoiding QR codes) for transaction proposals and approvals. This would significantly reduce the risk of phishing-induced tampering. However, in our view, the risk is still likely to exist and assets will always be exposed to the risk of hacking. Quantum cryptography devices provide hardware security and can prevent the risk of manual input during authentication and forgery of authentication screens due to impersonation. This makes it possible to block malicious access from outside.
Enhanced Transaction Transparency Introducing an independent verification layer to the multi-signature signing process could help. For instance, adding a step where signers visually confirm a transaction’s hash value before approval could expose interface spoofing attempts more effectively.
Adopting MPC (Multi-Party Computation) ＜＜＜ Proposed implementation of our quantum cryptographic device Replacing traditional multi-signature setups with MPC technology, which distributes private keys across multiple parties, could lessen reliance on individual signers and raise the bar for attackers. Solutions like those from Fireblocks are already in use, and Bybit might benefit from exploring this approach. We believe that it is difficult to eliminate these risks using existing security thinking, even with secret sharing. We believe that a quantum cryptographic device can guarantee 100% protection of assets even if there is a malicious whistleblower.
Stronger Collaboration with External Services The attack targeted Safe’s cloud hosting on Amazon AWS S3. Exchanges should align security standards with external partners and conduct regular audits or penetration tests to identify and address vulnerabilities in these integrations.
User Education and Decentralization Ultimately, encouraging users to adopt self-custody solutions—like hardware wallets or decentralized wallets—can reduce reliance on centralized exchanges and distribute risk across the ecosystem. Educating users on these options should be a priority.
The Bybit hack showed that while the crypto industry is growing, it still faces major security challenges. Bybit's efforts to overcome the crisis by quickly securing funds and responding transparently should be praised, but there is an urgent need to address the root cause of this, social engineering. A multi-layered approach that combines technological evolution with user education and the implementation of quantum cryptographic security will be essential to building a secure ecosystem in the future. I hope that the entire industry will use this incident as an opportunity to unite and aim for a stronger future. On our main page, we are posting special materials that simulate quantum cryptography technology based on this BYBIT hack. If you are interested, please register by email on our homepage and request access to the main page. We will send the link and password to your email.
