Hacker Techniques and Questions Behind Bybit’s Nearly $1.5 Billion Theft

SlowMist's analysis of the February 21, 2025 Bybit theft, which it says involved over $1.46 billion, traces the attack to a manipulated Safe multisig wallet and links it to North Korean actors. ZachXBT disclosed the outflow, and Bybit CEO Ben Zhou said the attacker deployed a malicious contract and used sweepETH and sweepERC20 functions to move 400,000 ETH and stETH from the cold wallet. SlowMist hypothesizes the attacker is a North Korean hacker, and ZachXBT has confirmed the attack was performed by the Lazarus Group. Bybit says all customer assets remain fully backed 1:1 and withdrawals are unaffected.