On February 21, 2025, Bybit—a leading centralized cryptocurrency exchange—suffered a critical security breach that resulted in the theft of over $1.5 billion in digital assets. The incident exposed serious vulnerabilities in multi-signature (multi-sig) cold storage solutions and highlighted that human factors remain a significant weak link in otherwise robust systems.
“Bybit’s breach involved a fraudulent interface that tricked operators into authorizing a malicious transaction. This altered the cold wallet’s smart contract logic, granting attackers control—similar to hot wallet compromises seen in the Horizon Bridge and Lazarus-linked hacks.
Aaron Ratcliff, Merkle Science Investigation and Attribution Lead
During a routine transfer of ETH from Bybit’s multi-sig cold wallet to its hot wallet, attackers exploited a critical flaw. Bybit explained that the transfer was a scheduled move, but the attackers manipulated the underlying smart contract logic and masked the signing interface. In simple terms, the transaction details that operators saw on the Safe wallet interface—Bybit’s trusted tool for verifying transactions—were altered so that they didn't reflect the true, malicious transaction. As a result, when operators approved what they believed was a legitimate transfer, they inadvertently handed control of the cold wallet to attackers.
Key elements of the attack included:
This method is reminiscent of previous breaches at WazirX and Radiant Capital. In the WazirX hack, attackers exploited weaknesses in multi-signature systems by manipulating transaction data. Similarly, the Radiant Capital breach involved a pre-deployed malicious contract that tricked signature verifiers.
These incidents underscore a troubling trend: attackers are increasingly targeting multi-sig cold storage solutions using sophisticated methods. As Binance CEO, Changpeng Zhao, highlighted, these recurring tactics demonstrate that the risk extends beyond any single provider—it’s a systemic vulnerability in crypto security.
Despite the significant scale of the hack, Bybit’s 1:1 reserve guarantee ensured that client assets remained fully intact. Remarkably, the exchange processed over 350,000 withdrawal requests efficiently within 12 hours, restoring confidence across the crypto community and showcasing Bybit’s preparedness in the face of crisis. Additionally, Bybit has successfully frozen $42.89 million in assets through swift and coordinated action with crypto institutions like Tether and FixedFloat, demonstrating the power of collaborative efforts in enhancing security and asset recovery.
In parallel, Safe Wallet swiftly paused its services to conduct a risk assessment and safeguard user assets. Within 24 hours, it implemented enhanced security measures including:
Our on-chain investigation into the Bybit hack has provided critical insights into the manipulation techniques used in this breach. Our findings emphasize that despite robust technical safeguards, human factors and interface vulnerabilities remain critical targets for sophisticated attackers.
According to Merkle Science's research, the stolen funds from the Bybit hack were laundered using a sophisticated multi-step strategy:
Interestingly, our investigation has also uncovered connections between the Bybit Hack and previous hacks on Poloniex, Phemex, and BingX, revealing a complex web of interconnected laundering activities.
The Bybit hack underscores a need for shifting security paradigms in the crypto industry. To better protect digital assets and enhance resilience to sophisticated attacks, the cryptosphere must integrate multi-layered defenses that encompass technical measures and human factors. We recommend the following actions:
Given the evolving threat landscape, we urge industry stakeholders to integrate blockchain forensics tools like Merkle Science’s Tracker. With automated cross-chain tracing and advanced fund flow mapping, Tracker helps you stay ahead of evolving crypto crime and fortify your security posture.
The Bybit breach serves as a stark reminder of the persistent and sophisticated threats facing the crypto industry. By adopting advanced security measures, reinforcing operational protocols, and leveraging blockchain forensics tools, the industry can build a more resilient ecosystem and protect valuable digital assets from future attacks.
