Biggest Crypto Hack, $1.4B ETH Hack, Proof of Reserves and more

The Dilation Effect reveals that the Bybit attacker exploited delegatecall to run a malicious transfer function. This function uses SSTORE to alter slot 0, changing the multi-signature contract’s implementation address on the cold wallet to the attacker’s. By disguising this as a simple fund transfer, reviewers are misled, unaware that a critical contract modification is underway.

Blockchain analysis indicates that the hacker behind Bybit’s $1.4B heist appears to have received ETH from Binance to cover gas fees. This transaction helped facilitate the necessary operations, adding a new twist to the unfolding investigation.

OKX expressed support for Bybit amid the recent hack. In a tweet, the exchange confirmed that its wallet infrastructure is different, preventing similar issues, and stated that its security teams are engaged and ready to assist. OKX will continue monitoring blacklisted wallet addresses to ensure user safety.

Bybit CEO Ben Zhou assured customers that client funds remain safe, stating, “no matter what, your money is safe.” He also confirmed that the Bybit treasury is fully capable of covering the 400,000 ETH hacked, reinforcing confidence in the platform’s ability to safeguard user assets.

According to Truth Labs, a serious vulnerability exists on Bybit’s Layer 2, Mantle. Their analysis shows one person controls enough multi-sig wallets—6 of the 13 required signatures, with 4 inactive wallets potentially under the same control—to drain or manipulate the entire network. Users are urged to withdraw funds immediately.

Bybit CEO Ben Zhou stated that the exchange won’t buy ETH immediately to cover hack losses due to the massive volume involved. However, he confirmed that 80% of the required ETH has already been secured through a bridge loan.

ByBit CEO Confirms all-hands-on deck and all employees available for maximum levels of customer service. Gaurantees all customer funds will be covered and safe despite hack. He claims “there could be multiple reasons how this happened.”

Following the withdrawal of 401,346 ETH, the hacker began dispersing funds across multiple wallets. Specifically, 39 addresses received 10,000 ETH each, with an additional 9 addresses also receiving 10,000 ETH apiece. This classic laundering tactic spreads out funds to complicate tracing efforts. Below is the complete list of hacker wallets.

Arkham released a list of Bybit hacker wallets, revealing the attacker controls $1.37B in ETH across 53 wallets. This exploit is the largest ever, representing 16% of all crypto hacks.

Safe’s security team is collaborating with Bybit on an ongoing investigation. Although there is no evidence that the official Safe frontend was compromised, the Safe Wallet is temporarily pausing certain functions as a precaution. SlowMist noted that the situation bears similarities to the previous Radiant Capital incident linked to North Korean hackers.

A hacker has compromised $1.4B from Bybit, initiating large transfers of roughly 10K ETH per address. In the past 30 minutes, at least $200M USDT moved from Bybit’s cold wallet to its hot wallet, though it’s unclear whether this was for user withdrawals or an ETH buyback. While most of the stolen funds are in ETH—and its price briefly dropped 3% before recovering—on-chain data confirms the loss represents only 8.64% of Bybit’s $16.2B reserves, ensuring the exchange can cover the shortfall. Despite the surge in activity, withdrawals remain fully functional.

Cryptocurrency prices reversed early gains after reports surfaced that Bybit experienced $1.5 billion in outflows amid a potential security incident. Bitcoin slid from near $100,000 to about $97,000, while ether dropped nearly 4%, falling below $2,700. This downturn also triggered liquidations of roughly $100 million in leveraged long positions, according to CoinGlass data.

Ethena Labs confirms that all spot assets backing USDe are held off-exchange, including Bybit via Copper Clearloop, ensuring no spot backing value is directly on any exchange. The company’s Bybit hedge positions remain below $30 million in unrealized PNL, which is less than half of the reserve fund. Consequently, USDe remains fully collateralized, preserving its stability despite recent market developments.

Bybit’s proof of reserves indicated the exchange held $16.2 billion in assets before the recent hack. The stolen $1.4 billion accounted for 8.64% of Bybit’s total holdings. Despite this breach, the exchange maintains that it remains solvent and that all other cold wallets and operations are unaffected.

Tron founder Justin Sun stated that he and his team are closely monitoring the Bybit incident following the hack. He assured that Tron will offer full support to its partners in tracking the misappropriated funds, pledging to leverage all available resources to assist in the investigation and fund recovery efforts.

Bybit is experiencing significant outflows, with over $1.4B in ETH and stETH leaving the platform. The funds are rapidly being transferred to new addresses where they are actively being sold, including $200M in stETH already offloaded. Notably, activity has been detected from address 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2.

Bybit detected unauthorized activity in an ETH multisig cold wallet transferring funds to a warm wallet after hackers manipulated the signing interface and altered smart contract logic. The security team and blockchain forensic experts are investigating. All other cold wallets remain secure, ensuring client funds and overall operations are unaffected.

According to Crypto Rover, a rapid outflow exceeding $1.46 billion from Bybit has raised alarms over a potential security breach. The incident could disrupt trading and shake investor confidence. Traders are advised to closely monitor emerging developments for further impact.

Bybit continues processing withdrawals seamlessly after a recent signing hack. With over $20 billion in assets on the platform and cold wallets remaining untouched, the incident appears isolated. Investors remain reassured that contagion is highly unlikely; market confidence holds strong.

Bybit was hacked for over $1.4 billion following suspicious ETH outflows reported by on-chain sleuth ZachXBT. CEO Ben Zhou confirmed hackers exploited a spoofed UI to alter a cold wallet’s smart contract logic, transferring all ETH to an unknown address. The exchange remains solvent and seeks help tracking the funds.