Bybit Hack: 5 Mistakes Behind the $1.5 Billion Crypto Theft

A popular myth says crypto kept in a cold wallet is out of a hacker's reach. The Bybit hack of February 21, 2025 shows why that belief is only half true. No one cracked Bybit's offline keys. Yet attackers still walked away with about $1.5 billion in Ethereum, according to the FBI. The weak point was the screen the signers trusted, not the vault itself.

This case study looks at the incident as a chain of mistakes. Each link could have broken the attack, and each one teaches something you can use. The sections below cover:

• Key dates in Pakistan time, from the first laptop infection to the FBI's statement
• A plain-language account of how signers approved a transfer they could not see
• Five things that went wrong, and which ones were Bybit's to control
• Who was blamed, and how much of that blame is confirmed
• Practical lessons for crypto users and security teams in Pakistan

What Was the Bybit Hack?

Bybit is a large crypto exchange based in Dubai. A Reuters report carried by Insurance Journal said it handled more than $36 billion in average daily trading volume. Citing CoinMarketCap data, it put Bybit's assets at about $16.2 billion before the theft. The stolen Ether equaled roughly 9% of those assets.

On February 21, 2025, Bybit was moving Ether from its multisig cold wallet to a hot wallet. A multisig wallet needs several authorized people, called signers, to approve each transaction. This was a routine job. During that transfer, control of the cold wallet passed to the attacker.

The Hacker News reported that Bybit spotted unauthorized activity around 12:30 PM UTC. More than 400,000 ETH and stETH, worth over $1.5 billion, went to an unknown address. Elliptic, quoted by Reuters, called it the largest crypto theft on record, well above the $611 million taken from Poly Network in 2021.

Bybit Hack Timeline in Pakistan Time

Pakistan Standard Time is five hours ahead of UTC. Where a source gave only a date, the table shows the date alone.

How Did the Attackers Trick the Signers?

This is the heart of the Bybit hack explained in simple terms. Bybit used Safe{Wallet}, a popular service for running a multisig wallet. When signers approve a transfer, they open Safe's web interface, check the details on screen and sign with their devices.

According to Sygnia's initial findings, reported by The Block, the attackers placed malicious code in Safe's cloud storage, which served the website's JavaScript. The code stayed quiet for everyone else. It only switched on when the transaction came from Bybit's wallet address or one other address.

When Bybit's signers opened the page, their browsers loaded and cached that code. The screen showed what looked like a normal transfer. Underneath, the transaction they signed changed the wallet's logic and handed control to the attacker. Bybit described this as a masked signing interface that showed the correct address while the smart contract logic was altered.

Sygnia found the code on every machine used to start and sign the transfer. It also said its review so far had found no compromise of Bybit's own infrastructure. Two minutes after the theft, the attacker replaced the files with clean copies to hide the trail.

Where Did It Start?

Safe's own review, carried out with Google Cloud's Mandiant and reported by The Hacker News, traced the start to one developer's laptop. That developer was among the few staff with higher access. The attackers used the infected machine to take over the developer's active AWS sessions, which let them skip multi-factor authentication. They then cleared logs and removed their malware.

This is a classic supply chain attack. The target was Bybit, but the door was a trusted supplier. Bybit could have had perfect passwords and still been hit, because the tool its signers relied on had been changed behind their backs.

Five Things That Went Wrong

A "what went wrong" review is not about blaming one person. It looks for the controls that failed in sequence. Based on the sources above, five links in the Bybit hack chain stand out.

1. One Developer Laptop Held Too Much Power

A single infected machine gave access to the cloud storage that served a site used by large crypto holders. Access to production systems should not rest on one personal device.

2. Active Sessions Outlived Their Welcome

Multi-factor authentication only protects the login. Once the attackers held a live session token, MFA no longer stood in the way. Safe's post-mortem, as reported by The Hacker News, says the attackers hijacked those sessions and timed their actions to the developer's working hours.

3. Front-End Files Changed Without an Alarm

The malicious JavaScript sat on the live site for about two days. A simple file integrity check, comparing what is served with what was approved, might have flagged the change much sooner.

4. Signers Trusted the Screen

Every signer saw a normal-looking transfer. That is the danger of "blind signing": approving a transaction based on a summary instead of the raw data. Several signers checking the same faked screen add no real safety, because they all see the same lie.

5. Too Much Sat in One Wallet

One cold wallet held about 9% of the exchange's assets, by Reuters' estimate. Spreading funds across more wallets would have reduced the damage of one bad signature. So would a cap on how much any single transfer can move.

Where Did $1.5 Billion Go After the Theft?

The attacker moved fast. Elliptic told The Hacker News that the funds were split across about 50 wallets within two hours. More than $75 million then passed through the eXch service and was converted to Bitcoin. eXch denies laundering for Lazarus.

By March 4, Ben Zhou said 83% of the stolen Ether had been converted to Bitcoin across 6,954 wallets, according to The Block. The same report said 72% of the moved funds went through THORChain, a cross-chain swap protocol, and about 16% went through eXch.

Note the small gap between figures. The FBI and Bybit used about $1.5 billion, while some trackers quoted around $1.4 billion. The difference most likely comes from Ether's price, which fell after the theft. It also depends on how staked tokens like stETH are valued.

Who Was Blamed, and How Sure Are Investigators?

Attribution in cyber security comes in levels. A government statement carries more weight than an analyst's tweet. Here is how the claims about this North Korea crypto hack line up, from strongest to weakest.

The confirmed facts are the theft, the amount, the method described by Sygnia and Safe, and the FBI's public attribution. The deeper details of who inside North Korea's program did what come from analysts. Treat those as well-supported claims, not court findings. In the sources reviewed for this article, we found no arrests or charges tied to the Bybit hack.

What Happened Next: Withdrawals, Loans and Bounties

Bybit's response is worth studying as a lesson in crisis handling. Zhou kept withdrawals open. In a livestream reported by Reuters, he said Bybit had processed more than 70% of withdrawal requests. He added that bridge loans from partners already covered about 80% of the loss.

Decrypt reported that withdrawals topped $5.3 billion within a day. On February 24, Zhou said Bybit had "fully closed the ETH gap." Lookonchain data cited by Decrypt put Bybit's purchases, loans and deposits at about 446,870 ETH, worth around $1.23 billion.

Bybit also offered a reward: 10% of any recovered funds, and 5% for exchanges and mixers that freeze them, according to The Block. Frozen amounts stayed small. By March 4, Zhou put the frozen share at about 3%.

Bybit and Binance: The Same Pattern Twice

If you read our Binance hack explainer, the pattern will look familiar. That October 2026 theft also began with a compromised engineer's laptop, and analysts again pointed to TraderTraitor. In both cases, the attackers did not break the cryptography. They went after the people and tools around the keys.

For students, this is the key point. Cold wallet security is about more than keeping keys offline. It covers the laptops, browsers, cloud accounts and suppliers that touch every transaction.

What the Bybit Hack Means for Crypto Users in Pakistan

Crypto use in Pakistan is moving toward formal rules. Dawn reported in July 2025 that the federal cabinet approved the Pakistan Virtual Assets Regulatory Authority (PVARA). It is an independent body to license and supervise virtual asset service providers. Its listed duties include anti-money laundering checks and cyber risk mitigation.

That matters, but no regulator can make an exchange impossible to hack. Here is what this case means for you:

• An exchange can lose funds without any customer making a mistake. Keep only what you trade on an exchange.
• How an exchange behaves after a breach tells you a lot. Open withdrawals and public updates are good signs.
• The same social engineering used on the Safe developer reaches ordinary users too. Fake job tests and "please run this file" messages on Telegram or WhatsApp deserve suspicion. Our guide to fraud calls in Pakistan covers the local versions.
• If your phone or laptop acts strangely after you open an unknown file, check it with our phone hacking warning signs guide.

Defensive Lessons for Exchanges and Security Teams

These steps come straight from the mistakes behind the Bybit hack. They work for an exchange, a fintech startup or a software house that ships code to clients.

1. Verify what you sign. Check the raw transaction on a second, independent device or tool before approving. Never rely on a single web page.
2. Lock down developer access. Use separate, hardened machines for production work, and limit who can change live files.
3. Shorten and bind sessions. Expire cloud sessions quickly and tie them to known devices, so a stolen token loses value fast.
4. Watch your front end. Monitor served JavaScript for changes and alert on any file that does not match an approved build.
5. Treat suppliers as part of your attack surface. Ask how your wallet, hosting and software providers detect tampering.
6. Limit the blast radius. Split large holdings and cap the value of any single transfer.
7. Plan the bad day. Prepare liquidity, communication and freeze requests in advance, as Bybit's quick response showed.

Turning Case Studies Like Bybit Into Practical Skills at PSTA

Reading about a breach is useful. Working through one in a lab is better. PSTA's Cyber Security and Ethical Hacking course runs for 12 weeks and starts at beginner level. You can study on our Abbottabad campus or join live online classes from anywhere in Pakistan.

The course has seven modules. Module 2 covers phishing and social engineering, the starting point for the Safe developer's infection. Module 5 covers malware analysis, threat intelligence and incident response, and Module 7 is built around real-world case studies and a final security project. You practice building timelines and writing findings a manager can act on.

If you already have the basics and want to test systems the way attackers do, with permission, PSTA's Advanced Ethical Hacking and Penetration Testing program is the next track. To plan certifications alongside either course, see our cyber security certifications for beginners guide.

Before You Sign Anything Again

The Bybit theft did not need a stolen password. It needed people to trust a screen. This week, pick one crypto or banking app you use. Find out how it lets you confirm a transfer outside the main screen, such as a device prompt or an address whitelist. Turn it on if it is off.

Want to take apart incidents like this with an instructor? Drop us a WhatsApp message and ask when the next cyber security batch starts.