Bybit's $1.4B Crypto Heist: Resilience Amidst North Korea's Lazarus Group Strike

Bybit, a leading cryptocurrency exchange, has demonstrated remarkable financial resilience following a massive $1.4 billion hack and a subsequent $5.3 billion decline in total assets. The Feb. 21 attack, now the largest crypto theft in history, involved the theft of liquid-staked Ether (stETH), Mantle Staked ETH (mETH), and various ERC-20 tokens.

Despite the significant loss, Bybit's independent Proof-of-Reserve (PoR) auditor, Hacken, confirmed that the exchange's reserves remain greater than its liabilities. In a statement on Feb. 21, Hacken reassured users that their funds were fully backed. Bybit responded swiftly to the breach, processing over 350,000 withdrawal requests within 10 hours, completing 99.9% of them by 1:45 am UTC on Feb. 22.

Crypto exchanges rallied to support Bybit through emergency fund transfers, with Binance contributing 50,000 ETH, Bitget providing 40,000 ETH, and Du Jun, co-founder of HTX Group, sending 10,000 ETH. However, the Bybit hack alone accounts for over half of the $2.3 billion lost in crypto-related hacks in 2024.

Blockchain investigators, including Arkham Intelligence and ZachXBT, have linked the attack to the North Korea-affiliated Lazarus Group, the same entity behind the $600 million Ronin network breach. Meir Dolev, CTO of Cyvers, explained that Bybit's Ethereum multisig cold wallet was compromised through a deceptive transaction that tricked wallet signers into approving a malicious smart contract change, allowing the hacker to seize control and transfer ETH to an unknown address.

The incident underscores the persistent threat of sophisticated cyberattacks on centralized exchanges, regardless of robust security measures. Over the past year, North Korean hackers have been responsible for several high-profile crypto thefts, including the $305 million DMM Bitcoin hack, $50 million hacks at both Upbit and Radiant Capital, and a $16 million heist from Rain Management. International efforts to curb such cybercrimes continue, with the United States, Japan, and South Korea jointly sanctioning 1