Bybit Restores $1.4B ETH Reserves, Hunts Hackers

Crypto exchange Bybit has successfully restored its Ethereum (ETH) reserves following a recent $1.4 billion security breach. The exchange's CEO, Ben Zhou, confirmed the news on Feb. 24, stating that Bybit will soon release an updated proof-of-reserves report demonstrating that it now holds client assets 1:1.

According to Zhou, Bybit has already closed the ETH gap, and a new audited proof-of-reserves report will be published soon to show that the exchange is again fully backed at 100% 1:1 on client assets through a merkle tree. This confirmation aligns with a report from blockchain analytics firm Lookonchain, which stated that Bybit replenished its reserves through over-the-counter (OTC) purchases, whale deposits, and loans from major crypto platforms.

Lookonchain revealed that Bybit purchased 157,660 ETH worth roughly $437.8 million from investment firms such as FalconX and Wintermute via OTC transactions. Additionally, the exchange acquired another $304 million in ETH from centralized and decentralized exchanges.

In an effort to recover stolen funds, Bybit launched a 10% bounty program on Feb. 22, encouraging ethical hackers and cybersecurity experts to assist in the recovery process. The exchange has pledged a reward of up to 10% of the recovered funds, potentially offering as much as $140 million if the full amount is reclaimed. Zhou stated that Bybit has also collaborated with various crypto platforms to freeze and recover stolen assets, successfully freezing approximately $43 million so far.

Despite these recovery efforts, the attackers have begun laundering the stolen funds. Blockchain forensics firm Elliptic noted that the laundering methods closely resemble techniques used by the Lazarus Group. The hackers immediately converted stolen tokens into ETH through decentralized exchanges (DEXs) to evade asset freezing, spreading funds across 50 wallets within two hours of the attack. The attackers have also started converting ETH into Bitcoin using various trading services and may employ mixers such as Tornado Cash to further conceal their activities.

On-chain investigator ZachXBT discovered that the attackers attempted to launder funds using memecoins on Solana's Pump.Fun platform. The Solana Foundation and Pump.Fun responded by blocking and