Hack history / 2025 / Hack or exploit
Bybit
Hack or exploit on Feb 21, 2025 · Signer Phishing
ATTRIBUTEDATTACK TX CONFIRMED ON CHAINSOURCES AGREE ON DATE AND LOSS · 5 SOURCES
Lost
$1.46B
sources: $1.40B to $1.50B
Returned
$42.9M
3% of the loss, as a source states it
Rank
#4
among thefts by dollars lost
What happened
On February 21, 2025, Lazarus Group phished Bybit's DevOps engineer and spoofed the Safe UI to trick signers into blind-signing a masked transaction that deployed a rogue hot-wallet policy. This drained approximately $1.4-1.5 billion in ETH and assets.
FBI reports the stolen assets were being converted and laundered across thousands of addresses. DefiLlama's returned figure for this incident reflects client losses Bybit covered, not funds taken back from the attacker.
Details
- Date
- Feb 21, 2025
- Kind
- Hack or exploit
- Method
- Signer Phishing
- How in
- Phishing and scams
- Target
- Centralized exchange
- Chains
- Ethereum
- Attributed to
- North Korea (TraderTraitor)
After the theft
- Recovered or frozen
- $42.9M
“$1.50B taken, $1.46B after recovery or freezing” (Web3 Is Going Great)
Reported by
Related incidents
Cite this page
SwanBluechip, "Bybit hack, Feb 21, 2025: $1.46B lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht42886485d2/ (data as of 2026-10-31).