# Hacker Techniques and Questions Behind Bybit’s Nearly $1.5 Billion Theft Source: https://slowmist.medium.com/slowmist-hacker-techniques-and-questions-behind-bybits-nearly-1-5-billion-theft-09f0b59da2e2 ## Summary SlowMist's analysis of the February 21, 2025 Bybit theft, which it says involved over $1.46 billion, traces the attack to a manipulated Safe multisig wallet and links it to North Korean actors. ZachXBT disclosed the outflow, and Bybit CEO Ben Zhou said the attacker deployed a malicious contract and used sweepETH and sweepERC20 functions to move 400,000 ETH and stETH from the cold wallet. SlowMist hypothesizes the attacker is a North Korean hacker, and ZachXBT has confirmed the attack was performed by the Lazarus Group. Bybit says all customer assets remain fully backed 1:1 and withdrawals are unaffected. ## Article Press enter or click to view image in full size Background On February 21, 2025, on-chain investigator ZachXBT disclosed a large-scale fund outflow from the Bybit platform. This incident resulted in the theft of over $1.46 billion, making it the largest cryptocurrency theft in recent years. Press enter or click to view image in full size On-Chain Tracking and Analysis Following the incident, the SlowMist security team promptly issued a security alert and launched an investigation to track the stolen assets. Press enter or click to view image in full size According to the SlowMist security team’s analysis, the stolen assets primarily include: 401,347 ETH (～$1.068 billion) 8,000 mETH (～$26 million) 90,375.5479 stETH (～$260 million) 15,000 cmETH (～$43 million) Press enter or click to view image in full size Press enter or click to view image in full size We used the on-chain tracking and anti-money laundering tool MistTrack(https://misttrack.io/) to analyze the initial hacker address 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2 and obtained the following information: The stolen ETH is being dispersed. The initial hacker address distributed 400,000 ETH across 40 addresses, each receiving 10,000 ETH, and the transfers are still ongoing. Press enter or click to view image in full size Among them, 205 ETH was swapped for BTC via Chainflip and cross-chained to the address bc1qlu4a33zjspefa3tnq566xszcr0fvwz05ewhqfq. Press enter or click to view image in full size cmETH Flow: 15,000 cmETH was transferred to the address 0x1542368a03ad1f03d96D51B414f4738961Cf4443. Notably, mETH Protocol posted on X, stating that in response to the Bybit security incident, the team promptly suspended cmETH withdrawals, preventing unauthorized transactions. As a result, mETH Protocol successfully recovered 15,000 cmETH from the hacker’s address. Press enter or click to view image in full size mETH and stETH Transfers: 8,000 mETH and 90,375.5479 stETH were transferred to the address 0xA4B2Fd68593B6F34E51cB9eDB66E71c1B4Ab449e. They were then swapped for 98,048 ETH via Uniswap and ParaSwap before being moved to 0xdd90071d52f20e85c89802e5dc1ec0a7b6475f92. The 0xdd9 address further dispersed the ETH into 9 addresses, each receiving 10,000 ETH, with no further transfers observed so far. Press enter or click to view image in full size Additionally, tracing the initial attack address 0x0fa09C3A328792253f8dee7116848723b72a6d2e, as identified in the attack analysis section, revealed that its initial funds originated from Binance. Press enter or click to view image in full size The initial hacker address 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2 currently holds a balance of 1,346 ETH. We will continue monitoring the associated addresses. Press enter or click to view image in full size Following the incident, SlowMist promptly analyzed the attacker’s method of obtaining Safe multisig access and their money laundering techniques, leading to the hypothesis that the attacker is a North Korean hacker. Press enter or click to view image in full size Possible Social Engineering Attack Method: Press enter or click to view image in full size Using MistTrack for analysis, we also discovered links between the hacker addresses in this incident and those associated with the BingX Hacker and Phemex Hacker. Press enter or click to view image in full size Press enter or click to view image in full size ZachXBT has also confirmed that this attack was performed by the Lazarus Group, which has long been involved in transnational cyberattacks and cryptocurrency theft. According to reports, the evidence provided by ZachXBT — including test transactions, linked wallets, forensic charts, and timeline analysis — demonstrates that the attacker repeatedly employed techniques commonly used by Lazarus Group. Meanwhile, Arkham stated that all relevant data has been shared with Bybit to assist the platform in further investigations. Press enter or click to view image in full size Attack Method Analysis At 23:44 on the night of the incident, Bybit CEO Ben Zhou issued a statement on X, providing a detailed explanation of the technical aspects of the attack: Press enter or click to view image in full size Through on-chain signature analysis, we have identified several traces: Press enter or click to view image in full size 1.Deployment of Malicious Contract: On UTC 2025–02–19 07:15:23, the attacker deployed a malicious implementation contract: 0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516. 2.Tampering with Safe Contract Logic: On UTC 2025–02–21 14:13:35, the attacker replaced the Safe contract with a malicious version (0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882) by signing a transaction with three Owner accounts. This led to the identification of the initial attack address: 0x0fa09C3A328792253f8dee7116848723b72a6d2e. 3.Embedding Malicious Logic: Using DELEGATECALL, the attacker injected the malicious logic contract into STORAGE slot 0 at 0x96221423681A6d52E184D440a8eFCEbB105C7242. Press enter or click to view image in full size Press enter or click to view image in full size 4. Executing Backdoor Functions to Transfer Funds: The attacker utilized the sweepETH and sweepERC20 functions within the malicious contract to transfer 400,000 ETH and stETH (totaling approximately $1.5 billion) from the cold wallet to unknown addresses. From a technical perspective, this attack shares similarities with the WazirX and Radiant Capital hacks, as all three incidents targeted Safe multisig wallets. In the WazirX hack, the attacker also pre-deployed a malicious implementation contract, signed a transaction using three Owner accounts, and used DELEGATECALL to inject the malicious logic contract into STORAGE slot 0, replacing the Safe contract with a compromised version. Press enter or click to view image in full size Press enter or click to view image in full size https://etherscan.io/tx/0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d For the Radiant Capital hack, according to the official disclosure, the attacker used a sophisticated method that tricked the signature verifier into displaying seemingly legitimate transactions on the frontend. This approach is similar to the details revealed in Ben Zhou’s post. Press enter or click to view image in full size (https://medium.com/@RadiantCapital/radiant-post-mortem-fecd6cd38081) Moreover, all three incidents involved the same permission-checking mechanism in the malicious contracts, where the owner addresses were hardcoded to verify contract callers. Additionally, the error messages thrown during permission checks in the Bybit and WazirX hacks were also similar. Press enter or click to view image in full size In this incident, the issue stemmed from a manipulated frontend, which was altered to deceive users. This is not an isolated case. North Korean hackers have employed this method to attack multiple platforms over the past year, including: WazirX — $230M loss (Safe multisig) Radiant Capital — $50M loss (Safe multisig) DMM Bitcoin — $305M loss (Gonco multisig) This attack method has been industrialized and refined, making it a significant threat that requires heightened vigilance. According to Bybit’s official announcement: Press enter or click to view image in full size https://announcements.bybit.com/article/incident-update---eth-cold-wallet-incident-blt292c0454d26e9140/ Combined with Ben Zhou’s tweet: Press enter or click to view image in full size Key Questions Raised: Routine ETH Transfers Did the attacker obtain internal financial operation data from Bybit in advance, allowing them to determine the timing of ETH multi-signature cold wallet transfers? Through the Safe system, did the attacker trick signers into approving malicious transactions via a spoofed interface? Was the Safe frontend system compromised and taken over? 2. Safe Contract UI Tampering Did signers see the correct address and URL on the Safe interface while unknowingly signing altered transaction data? The critical question: Who initiated the signing request first? How secure was their device? With these uncertainties in mind, we look forward to the official disclosure of further investigation results. Market Impact Following the incident, Bybit promptly issued an announcement assuring users that all customer assets remain fully backed 1:1 and that the platform can cover the loss. User withdrawals remain unaffected. On February 22, 2025, at 10:51 (UTC), Bybit CEO Ben Zhou confirmed on X that deposits and withdrawals are operating normally. Press enter or click to view image in full size Conclusion This incident once again highlights the severe security challenges faced by the cryptocurrency industry. As the space continues to evolve, hacker groups — especially state-backed actors like Lazarus Group — are constantly advancing their attack methods. For cryptocurrency exchanges, this serves as a critical wake-up call to enhance security measures, adopt advanced defense mechanisms, and implement multi-factor authentication, secure wallet management, asset monitoring, and risk assessment to safeguard user funds. For individual users, security awareness is equally crucial. It is highly recommended to prioritize hardware wallets for storage and avoid keeping large amounts of funds on exchanges for extended periods. In this constantly evolving landscape, only through continuous upgrades in security defenses can the industry ensure digital asset safety and drive sustainable growth. About SlowMist SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc. SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime. By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.