"Bybit's $1.4B Crypto Heist: Industry's Biggest Theft"

Cryptocurrency exchange Bybit suffered a significant blow on Feb. 21, with a hack resulting in the theft of over $1.4 billion in liquid-staked Ether (STETH), Mantle Staked ETH (mETH), and other ERC-20 tokens. This incident marked the largest crypto theft in history, according to DefiLlama data.

The hack led to a decline of over $5.3 billion in Bybit's total assets, including the $1.4 billion lost to the hack. Despite this setback, Bybit's exchange reserves still exceed its liabilities, as confirmed by its independent Proof-of-Reserve (PoR) auditor, Hacken. In a Feb. 21 post on X, Hacken stated, "Today’s hack was massive—a tough hit for the industry. But here’s the bottom line: Bybit’s reserves still exceed its liabilities. As their independent PoR auditor, we’ve confirmed that user funds remain fully backed."

Bybit processed more than 350,000 withdrawal requests within 10 hours, completing 99.9% of them by 1:45 am UTC, according to Bybit co-founder and CEO Ben Zhou. In a Feb. 22 X post, Zhou stated, "Although we have been hit by the worst hack possibly in the history of any medians (banks, crypto, finance), But all Bybit functions and product remain functional, the Whole team had been awake all night to process and answer client questions and concerns."

The Bybit hack alone accounts for more than half of the $2.3 billion stolen in crypto-related hacks in 2024, highlighting the significant impact of the incident on the industry.

Blockchain security analysts, including Arkham Intelligence and onchain sleuth ZachXBT, have traced the Bybit attack to the North Korean state-affiliated Lazarus Group. Meir Dolev, co-founder and chief technical officer at Cyvers, noted that the attack shares similarities with the $230 million WazirX hack and the $58 million Radiant Capital hack. Dolev explained that the Ethereum multisig cold wallet was compromised through a deceptive transaction, tricking signers into unknowingly approving a malicious smart contract logic change, allowing the hacker to gain control of the cold wallet and transfer