One Click, $1.5 Billion Vanished: Inside the Bybit Lazarus Cyberattack and the 72-Hour Survival War

14:13 UTC: One Manipulated Transfer, $1.46 Billion

February 21, 2025, began as a routine Friday for Bybit's treasury team: a scheduled transfer from one of the exchange's Ethereum cold wallets. At 14:13 UTC, that single transaction was manipulated. The signers believed they were approving an ordinary operation; what actually executed emptied the wallet. The incident timeline Bybit published later confirmed the final accounting: a total loss of $1.46 billion, comprising 401,347 ETH, 90,375 stETH, 15,000 cmETH and 8,000 mETH. ^[1]

The stolen assets did not travel as one pile in one transfer to one thief. From the first block they were dispersed across 39 receiving addresses — native ether alongside liquid-staking tokens — a structure designed to scatter fingerprints and outrun chain analysts from the very first minutes. ^[1]

In the opening hours, certainty was scarce. Nobody could immediately say whether Bybit's infrastructure, the Safe multisig stack, or something else entirely had failed, and speculation filled the vacuum. What would later be established is that the event was the largest theft in the industry's history, instantly overshadowing every exchange hack that came before it. ^{[1], [5]}

The Breach Was Human: Phishing a Safe Developer

The question that dominated the first days was simple: if Bybit's own authorized signers approved the withdrawal, what had fooled them? On February 28, Safe's ecosystem foundation statement supplied the confirmed answer. Its investigation found that a targeted social-engineering — phishing — campaign had compromised a Safe developer's machine, and that attacker access was used to alter the Safe Wallet front end specifically for the Bybit transaction. ^[3]

Just as important was what Safe ruled out: no vulnerability existed in its smart contracts or source code. The multisig contracts executed faithfully what they were instructed to execute. The deception lived entirely in the presentation layer — the interface humans trust when they read what they are signing. ^[3]

That distinction separates early fear from final fact. Initial reporting raised the specter of a systemic Safe exploit endangering thousands of dependent protocols. The investigation narrowed the scope dramatically: one developer workstation, one customized front end, one targeted victim. The confirmed threat model — not the imagined one — is what the industry must now defend against. ^[3]

Three Hours Later: A Livestream, and Withdrawals Stay Open

At roughly 17:15 UTC — about three hours after the manipulated transfer — Bybit CEO Ben Zhou began livestreaming to an audience bracing for an obituary. He told viewers that Bybit remained solvent and that client assets were still backed one-to-one, framing the exchange's survival as something users could watch happen in real time. ^{[1], [4]}

They watched, and they tested. Bybit kept withdrawals open through the panic, and the numbers it later published were remarkable: approximately $4 billion withdrawn, more than 350,000 withdrawal requests processed, and 99.994 percent of them completed within 10 hours — a stress test that has broken weaker exchanges. ^[1]

The freezes told a quieter story. Tether froze only about $181,000 in USDT connected to the theft. Bybit later reported that partners collectively froze $42.89 million in stolen or linked funds — an industry-wide total that should never be attributed to Tether alone. ^[1]

Seventy-Two Hours to Refill the Vault

Within 72 hours of the incident, Bybit had replenished the reserves backing user balances through bridge loans, large deposits and over-the-counter purchases while keeping withdrawals open. The theft itself was not recovered; the balance-sheet gap was refilled through emergency financing and asset acquisition. ^{[1], [4]}

A subsequent proof-of-reserves report showed Bybit's key assets backed above 100 percent — verifiable headroom rather than verbal assurance. The initial uncertainty about whether the exchange could survive the run was replaced by an audited, published margin of safety. ^[1]

Crisis management, not luck, drove the outcome: continuous communication, honest numbers, open rails and rapid recapitalization. That the 72-hour refill was feasible at all speaks to Bybit's own scale — and that scale is itself a lesson about which custodians can survive a Lazarus-grade strike. ^{[1], [4]}

TraderTraitor: Attribution, Laundering and the Long Shadow

On February 26, the FBI formally attributed the theft to North Korean state-sponsored cyber actors under its TraderTraitor designation — the Lazarus Group constellation — and characterized the loss as approximately $1.5 billion. The bureau also documented the laundering playbook: rapid conversion through swaps and cross-chain bridges, and piecemeal movement designed to complicate tracing. ^[2]

Analysts at CSIS cast the heist as both record and warning: proof that crypto exchanges are now strategic targets of state actors, and that national-security-grade operational security has become baseline infrastructure for any serious custodian. ^[5]

The technical lesson cuts deepest. No cryptographic primitive failed and no contract was broken; a human was deceived through a trusted interface. Defenses must therefore shift toward verifiable transaction previews, isolated signing environments and front-end integrity — the exact layers where this theft actually happened. ^{[3], [5]}

For users, the episode reframed an old mantra. "Not your keys, not your coins" assumes self-custody removes trust; Bybit showed that even institutional cold-wallet signers can be weaponized against themselves through the software layer. Trust survived on transparency, reserves and speed — and on the uncomfortable admission that the weakest link was never the blockchain. ^{[1], [3]}