INCIDENT REPORT · CP-2025-001
Bybit exchange cold-wallet theft
L3 · ELEVATEDCONFIRMED
Attackers drained roughly 401,000 ETH and related tokens from a Bybit Ethereum cold wallet during a routine transfer, after tampering with the Safe{Wallet} multisig interface the exchange used.
- Incident ID
- CP-2025-001
- Incident date
- 21 FEB 2025
- Detection date
- 21 FEB 2025
- Affected countries
- United Arab Emirates
- Plotted location
- Dubai, United Arab Emirates (Affected organization headquarters)
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Record-scale theft from a major exchange funding a sanctioned state, but no disruption to essential services.
- Attack type
- Cryptocurrency Theft
- Nature
- Malicious activity
- Attack vector
- Compromised Safe{Wallet} developer workstation used to tamper with Safe{Wallet} front-end JavaScript, tricking Bybit signers into approving a malicious cold-wallet transaction
- Sectors
- Finance
- Critical infrastructure
- No
- Organizations affected
- Bybit, Safe{Wallet}
- Operational consequences
- About $1.5 billion in virtual assets were stolen, described as the largest crypto theft on record at the time; the FBI published laundering addresses and asked the industry to block them. Bybit said it remained solvent and restored its ETH reserves.
- Estimated financial impact
- $1.5B — FBI PSA I-022625-PSA states approximately $1.5 billion in virtual assets were stolen.
- Attribution (as stated)
- Attributed by FBI to North Korea (TraderTraitor, also tracked as Lazarus Group)
SOURCE REFERENCES
- [1] Alert Number: I-022625-PSA (North Korea Responsible for $1.5 Billion Bybit Hack)FBI / IC3 · ic3.gov · 26 FEB 2025
- [2] Lazarus hacked Bybit via breached Safe{Wallet} developer machineBleepingComputer · bleepingcomputer.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.