Bybit Alert: Multi-Sig ETH Cold Wallet Compromised, $1.5B Withdrawn And Now Being Sold

The major security breach at Bybit caused the unauthorized movement of 401,346 ETH worth approximately $1.13 billion from exchange wallets on 21st February, 14:16:11 UTC. Whale Alert detected the massive transfer and discovered Bybit’s cold wallet funds heading to an unexpected destination.

Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing…

— Bybit (@Bybit_Official) February 21, 2025

Bybit Confirms Sophisticated Attack

The ByBit team revealed the breach was caused by a highly complicated attack scheme targeting their multi-signature (multi-sig) Ethereum cold wallet. Attackers tricked the signing system into presenting verified transactions before altering the underlying smart contract logic in a hidden manner. Through this manipulation, the hacker achieved unrestricted management of the breached cold wallet, which they used to move its entire balance to a secret account.

Bybit’s Response and Security Measures

Bybit users received reassurance through an official announcement that stated the following points:

• All other cold wallets maintained their safety during this incident.
• The security of client deposits operates independently from the breach.
• The standard operating procedures stay uninterrupted while business goes on as expected.

The exchange team started an immediate investigation which involves collaboration with blockchain forensic experts to seek the stolen funds. The platform extends invitations to blockchain experts who specialize in asset tracing so they can help track down the stolen funds.

Are the Stolen Funds Being Sold?

One can’t say if the stolen funds have already been sold or when they will be sold. However, if attackers transfer offload these funds, market volatility may increase, potentially decreasing the ETH price.

The exchange has promised to provide ongoing transparency during its investigation process and will deliver new information whenever available.

What This Means for Crypto Security

The attack reveals essential weaknesses even in the most secure crypto exchanges. Cryto-asset protection requires enhanced smart contract security combined with advanced threat detection systems and better wallet authentication technology to defend against skilled cyber criminals.

The crypto community stays on high alert while monitoring for all suspicious ETH activity because it could show the hacker’s future actions as Bybit attempts to bounce back from this incident.

Source