On February 21, 2025, a serious incident occurred at one of the largest cryptocurrency exchanges, Bybit. A significant amount of ETH was withdrawn as a result of a cold wallet breach.
Attack on Bybit's Cold Wallets
A hacker attacked Bybit's multisignature cold wallet using a UI spoofing technique. Although multiple signatures are required for transactions, the attackers tricked signers into viewing the correct address and URL from the Safe wallet management platform. Consequently, they altered the wallet's contract logic, allowing the hacker to seize control and transfer tokens to an unknown address.
Market and User Reactions
Ethereum's price sharply dropped by 3% within minutes due to large-scale liquidations. Nearly $200 million in Lido Staked Ether (stETH) was sold within the first 30 minutes following the news. Some users are urging to withdraw funds from the exchange quickly, while others trust the platform to recover the stolen assets.
Comments and Next Steps
Bybit confirmed that all other cold wallets remain secure. The exchange has not halted withdrawals, but a former Binance CEO advised to temporarily suspend them. Bybit emphasizes it is investigating the incident and welcomes assistance from teams specializing in blockchain analytics, asset tracking, and fund recovery.
Currently, the Bybit incident has elicited a significant market reaction. The exchange continues to operate, emphasizing the safety of user assets and intending to conduct a thorough investigation of the occurrence.
