Bybit’s Race to Freeze $1.4 Billion in Stolen Crypto
In February 2025, Dubai-based crypto exchange Bybit suffered what is widely described as the largest theft in crypto history. A few weeks later, CEO Ben Zhou warned that the coming week would be critical. His warning was not about customers’ money, which stayed accessible. It was about freezing the stolen funds before the hackers could cash them out.
What Happened
The hack took place on 21 February 2025. Attackers drained more than $1.4 billion in staked Ether and other Ethereum-based tokens. According to Zhou, a transfer that was made to look legitimate actually carried malicious code that changed the wallet’s smart contract logic and diverted the funds.
A later forensic review by Verichains found that a harmless JavaScript file had been swapped for a malicious version built specifically to target Bybit’s Ethereum multisig cold wallet. Analysts suspected North Korea’s Lazarus group was behind the attack.
Customer Funds Stayed Accessible
Zhou moved quickly to reassure users. He said all other cold wallets were secure, withdrawals were operating normally, and client assets were backed one-to-one, so Bybit could cover the loss.
The news still set off a rush to withdraw. DefiLlama estimated a bank run of over $4 billion, and Bybit says it processed more than 350,000 withdrawal requests within 12 hours. The one exception was Ether itself. ETH withdrawals were temporarily unavailable, and Bybit arranged a bridge loan from partners specifically to cover them.
Why This Was a Critical Week
Bybit then went after the stolen money. It offered up to $140 million in bounties, paying 5% of any frozen amount to whoever traced it and 5% to the entity that froze it.
In an early March update, Zhou said about 77% of the stolen funds were still traceable, 20% had gone dark, and only about 3% had been frozen. He added that 83% of the stolen ETH had already been converted to bitcoin, mostly through THORChain. He warned that the following week was critical for freezing funds before they could be cashed out through exchanges, over-the-counter desks, and peer-to-peer platforms.
Lessons from Past Incidents
Bybit is not the first exchange to lose customer-linked assets. In 2014, Mt. Gox lost roughly 850,000 bitcoin, worth around $450 million at the time. In 2019, hackers stole about 7,000 bitcoin, roughly $40 million, from Binance using phishing and malware.
Not every exchange failure is a hack, though. FTX collapsed in 2022 because customer funds were misused, and its founder Sam Bankman-Fried was convicted of fraud in 2023.
What Crypto Users Can Take From This
A few general practices reduce exposure to exchange risk:
- Enable two-factor authentication on every account.
- Follow only official exchange channels during an incident, since scammers often exploit the confusion.
- Avoid keeping all your assets on a single exchange.
- Consider a hardware wallet for long-term holdings.
- Avoid decisions driven by panic.
This is general information, not financial advice.
Final Thoughts
Even when an exchange stays solvent, a major breach shows how much users depend on its security and its response. Bybit’s case is a reminder to stay informed and spread your risk.
Have you ever experienced a crypto exchange issue? Share your thoughts in the comments below.