Timeline | Bybit Loses Over 500K ETH in Hack, $1.5 Billion Loss

By: blockbeats|2025/02/21 16:45:02
Share
copy

On the early morning of February 22, on-chain detective Zachxbt detected a suspicious fund outflow incident on Bybit. Subsequent on-chain records showed that a multisig address controlled by Bybit transferred out $1.5 billion worth of ETH and used a DEX to convert LSD assets into native ETH. Possibly due to FUD sentiment, Ethereum briefly dropped below $2,700; Bybit's native platform token MNT briefly fell below $0.9, with a 24-hour decrease of 7.71%.

Bybit CEO Ben Zhou quickly responded, stating that indeed a hacker had control of a specific ETH cold wallet, but the rest of the cold wallets are secure and withdrawals are functioning normally. Ben Zhou also emphasized that Bybit has the ability to make payment and can bear this loss. BlockBeats will continue to monitor and provide real-time updates, as outlined in the timeline below:

Bybit CEO: Will Soon Host a Livestream to Address All Questions


On February 22, Bybit CEO Ben Zhou posted an update on Platform X stating, "I will soon start a livestream to answer all questions!! Please stay tuned."

ZachXBT: Bybit Hacker Has Distributed 10,000 ETH to 39 New Addresses, Urging All Parties to Blacklist Promptly


On February 22, ZachXBT stated that the Bybit hacker had just distributed 10,000 ETH to 39 new addresses. "If you are an exchange platform or service provider, please blacklist these addresses on all EVM chains."

Timeline | Bybit Loses Over 500K ETH in Hack, src=

SlowMist Founder: Bybit Hacker's Attack Method Similar to North Korean Hackers


On February 22, SlowMist founder COSMOS published a post saying, "Although there is no direct evidence at the moment, based on the Safe multisig approach and the current laundering method, it resembles North Korean hackers."

Bybit CEO: Platform Withdrawals Operating Normally, Other Cold and Hot Wallets Not Affected; Bybit has Payment Ability and Can Bear This Loss


On February 22, Bybit CEO Ben Zhou posted an update saying that Bybit's hot wallets, warm wallets, and all other cold wallets were not affected. The only wallet compromised was the ETH cold wallet. All withdrawals are operating normally. Additionally, it was emphasized, "Bybit still has the ability to make payments. Even if the loss from this hacker attack cannot be recovered, all client assets remain 1:1 backed, and we can bear this loss."

Bybit Hacker Starts to Disperse Funds to Multiple Addresses

On February 21, according to Arkham Monitoring, the Bybit hacker has started to disperse funds to multiple addresses.

Bybit Platform Total Assets Reach $15.727 Billion, with $5.18 Billion in Ethereum Assets

On February 21, according to Defillama data, the Bybit platform's total assets amount to $15.727 billion, including:

· $6.263 billion in Bitcoin;

· $5.18 billion in Ethereum;

· $1.35 billion in SOL;

· $1.143 billion in TRON.

Bybit CEO: Hacker Controls Specific ETH Cold Wallet, Other Cold Wallets Secure and Withdrawals Operating Normally

On February 21, Bybit Co-Founder and CEO Ben Zhou stated in a post, "Bybit's ETH multisig cold wallet made a transfer to our hot wallet approximately 1 hour ago. It appears the transaction was spoofed, with all signers seeing a spoofed interface displaying the correct address and URL coming from Safe.

However, the signature information was to alter the smart contract logic of our ETH cold wallet. This resulted in the hacker controlling our signed specific ETH cold wallet and moving all ETH in the wallet to this unconfirmed address.

Rest assured, all other cold wallets are secure. All withdrawals are functioning normally. I will continue to update as more unfolds. If there are teams that can assist us in tracking the stolen funds, it would be greatly appreciated."

Bybit Multi-Sig Address Transfers $1.5 Billion Worth of ETH and Swaps LSD Assets for Native ETH Using DEX

On February 21, crypto KOL Finish posted that, according to on-chain data, a Bybit multi-signature address transferred $1.5 billion worth of ETH to a new address. The funds reached the new address 0x47666fab8bd0ac7003bce3f5c3585383f09486e2, then were moved to 0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e, where 0xa4 is currently selling stETH and mETH in exchange for ETH.

「Currently, this address is using 4 different DEXs. If they were to simply swap the LSD for native ETH, the transaction execution would be very inefficient (high slippage). This scale of operation is typically done off-chain, so this is very unusual.」

Zachxbt Monitors Bybit for Suspected Fund Outflow

On February 21, the Zachxbt monitoring channel reported that they are currently monitoring a suspicious fund outflow from Bybit, totaling over $1.46 billion.

You may also like

$COIN Joins S&P 500, but Coinbase Isn't Celebrating

On May 13, S&P Dow Jones Indices announced that Coinbase would officially replace Discover Financial Services in the S&P 500 on May 19. While other companies like Block and MicroStrategy, closely tied to Bitcoin, were already part of the S&P 500, Coinbase became the first cryptocurrency exchange whose primary business is in the index. This also signifies that cryptocurrency is gradually moving from the fringes to the mainstream in the U.S.



On the day of the announcement, Coinbase's stock price surged by 23%, surpassing the $250 mark. However, just 3 days later, Coinbase was hit by two consecutive events: a hack where employees were bribed to steal customer data and a demand for a $20 million ransom, and an investigation by the U.S. Securities and Exchange Commission (SEC) into the authenticity of its claim of having over 100 million "verified users" in its securities filings and marketing materials. These two events acted as mini-bombs, and at the time of writing, Coinbase's stock had already dropped by over 7.3%.


Coincidentally, Discover Financial Services, being replaced by Coinbase, can also be considered the "Coinbase" of the previous payment era. Discover is a U.S.-based digital banking and payment services company headquartered in Illinois, founded in 1960. Its payment network, Discover Network, is the fourth largest payment network apart from Visa, Mastercard, and American Express.


In April, after the approval of the acquisition of Discover by the sixth-largest U.S. bank, Capital One, this well-established digital banking company of over 60 years smoothly handed over its S&P 500 "seat" to this emerging cryptocurrency "bank." This unexpected coincidence also portrayed the handover between the new and old eras in Coinbase's entry into the S&P 500, resembling a relay race scene. However, this relay baton also brought Coinbase's accumulated "external troubles and internal strife" to a tipping point.


Side Effects of ETFs


Over the past decade, cryptocurrency exchanges have been the most stable "profit machines." They play a role in providing liquidity to the entire industry and rely on trading fees to sustain their operations. However, with the comprehensive rollout of ETF products in the U.S. market, this profit model is facing unprecedented challenges. As the leader in the "American stack," with over 80% of its business coming from the U.S., Coinbase is most affected by this.



Starting from the approval of Bitcoin and Ethereum spot ETFs, traditional financial capital has significantly onboarded users and funds that originally belonged to exchanges in a more cost-effective, compliant, and transparent manner. The transaction fee revenue of cryptocurrency exchanges has started to decline, and this trend may further intensify in the coming months.


According to Coinbase's 2024 Q4 financial report, the platform's total trading revenue was $417 million, a 45% year-on-year decrease. The contribution of BTC and ETH's trading revenue dropped from 65% in the same period last year to less than 50%.


This decline is not a result of a decrease in market enthusiasm. In fact, since the approval of the Bitcoin ETF in January 2024, the inflow of BTC into the U.S. market has continued to reach new highs, with asset management giants like BlackRock and Fidelity rapidly expanding their management scale. Data shows that BlackRock's iShares Bitcoin ETF (IBIT) alone has surpassed $17 billion in assets under management. As of mid-May 2025, the cumulative net inflow of 11 major institutional Bitcoin spot ETFs on the market has exceeded $41.5 billion, with a total net asset value of $1214.69 billion, accounting for approximately 5.91% of the total Bitcoin market capitalization.


Chart showing the trend of net outflows for Grayscale among the 11 institutions


Institutional investors and some retail investors are shifting towards ETF products, partly due to compliance and tax considerations. On one hand, ETFs have much lower trading costs compared to cryptocurrency exchanges. While Coinbase's spot trading fee rate varies annually in a tiered manner but averages around 1.49%, for example, the management fee for IBIT ETF is only 0.25%, and the majority of ETF institution fees fluctuate around 0.15% to 0.25%.



In other words, the more rational users are, the more likely they are to move from exchanges to ETF products, especially for investors aiming for long-term holdings.


According to multiple sources, several institutions, including VanEck and Grayscale, have submitted applications to the SEC for a Solana (SOL) ETF, with some institutions also planning to submit an XRP ETF proposal. Once approved, this may trigger a new round of fund migration. According to a report submitted by Coinbase to the SEC, as of April, the platform's trading revenue from XRP and Solana accounted for 18% and 10%, nearly one-third of the platform's fee revenue.



However, the Bitcoin and Ethereum ETFs passed in 2024 also reduced the fees for these two tokens on Coinbase from 30% and 15% to 26% and 10%, respectively. If the SOL and XRP ETFs are approved, it will further undermine the core fee revenue of exchanges like Coinbase.


The expansion of ETF products is gradually weakening the financial intermediary status of cryptocurrency exchanges. From their original roles as matchmakers and clearers to now gradually becoming mere "on-ramps and off-ramps" for funds, exchanges are seeing their marginal value squeezed by ETFs.


Robinhood Takes a Stand, Traditional Brokerages Join the Fray


On May 12, 2025, SEC Chairman Paul S. Atkins gave a keynote speech at the Tokenization and Cryptocurrency Working Group roundtable. The theme of his speech revolved around "It is a new day at the SEC," where he indicated that the SEC would not approach enforcement and regulation the same way as before but would instead pave the way for cryptocurrency assets in the U.S. market.



With signs of cryptocurrency compliance such as the SEC's "NEW DAY" declaration, an increasing number of traditional brokerages are attempting to enter the cryptocurrency industry. One of the most representative cases is the well-known U.S. brokerage Robinhood, which began expanding its crypto business in 2018. By the time of its IPO in 2021, Robinhood's crypto business revenue accounted for over 50% of the company, with a significant boost from the Dogecoin "moonshot" promoted by Musk.


In Q1 2025 earnings report, Robinhood showcased strong growth, especially in revenue from cryptocurrency and options trading. Fueled by Trump's Memecoin, cryptocurrency-related revenue reached $250 million, nearly doubling year-over-year. Consequently, Robinhood Gold subscription users reached 3.5 million, a 90% increase from the previous year, with the rapid growth of Robinhood Gold providing the company with a stable source of income.



Meanwhile, RobinHood is actively pursuing acquisitions in the cryptocurrency space. In 2024, it announced a $2 billion acquisition of the long-standing European cryptocurrency exchange Bitstamp. Additionally, Canada's largest cryptocurrency CEX, WonderFi, which recently went public on the Toronto Stock Exchange, also announced its integration with RobinHood Crypto. After obtaining virtual asset licenses in the UK, Canada, Singapore, and other markets, RobinHood has taken a proactive approach in the compliant cryptocurrency trading market.



Furthermore, an increasing number of brokerage firms are exploring the same path. Futu Securities, Tiger Brokers, and others are also dipping their toes into cryptocurrency trading, with some having applied for or obtained the VA license from the Hong Kong SFC. Although their user bases are currently small, traditional brokerages have a natural advantage in user trust, regulatory licenses, and low fee structures. This could pose a threat to native cryptocurrency platforms in the future.



User Data Breach: Is Coinbase Still Secure?


In April 2025, security researchers discovered that some Coinbase user data was leaked on the dark web. While the platform initially responded by attributing it to a "technical misinformation," it still raised concerns among users regarding its security and privacy protection. Just two days before Dow Jones Indexes announced Coinbase's addition to the S&P 500 Index, on May 11, 2025, Coinbase received an email from an unknown threat actor claiming to have obtained customer account information and internal documents, demanding a $20 million ransom to keep the data private. Subsequent investigations confirmed the data breach.


Cybercriminals obtained the data by bribing overseas customer service agents and support staff, mainly in "non-U.S. regions such as India." These agents abused their access to Coinbase's internal customer support system and stole customer data. As early as February this year, blockchain detective ZachXBT revealed on X platform that between December 2024 and January 2025, Coinbase users lost over $65 million to social engineering scams, with the actual amount potentially higher.


Among the victims was a well-known figure, 67-year-old Ed Suman, an established artist in the art world for nearly two decades, having been involved in the creation of artworks such as Jeff Koons' "Balloon Dog" sculpture. Earlier this year, he fell victim to an impersonation scam involving fake Coinbase customer support, resulting in a loss of over $2 million in cryptocurrency. ZachXBT critiqued Coinbase for its inadequate handling of such scams, noting that other major exchanges have not faced similar issues and recommending Coinbase to enhance its security measures.


Amidst a series of ongoing social engineering incidents, although there has not been any impact on user assets at the technical level so far, it has raised concerns among many retail and institutional investors. Especially institutions holding massive assets on Coinbase. Just considering the U.S. BTC ETF institutions, as of mid-May 2025, they collectively hold nearly 840,000 BTC, and 75% of these are custodied by Coinbase. If we price BTC at $100,000, this amount reaches a staggering $63 billion, which is equivalent to the nominal GDP of two Iceland in the year 2024.


Visualization: ChatGPT, Source: Farside


In addition, Coinbase Custody also serves over 300 institutional clients, including hedge funds, family offices, pension funds, and endowments. As of the Q1 2025 financial report, Coinbase's total assets under management (including institutional and retail clients) reached $404 billion. The specific amount of institutional custodied assets was not explicitly disclosed in the latest report, but it should still be over 50% based on the Q4 2024 report.


Visualization: ChatGPT


Once this security barrier is breached, not only could the rate of user attrition far exceed expectations, but more importantly, institutional trust in it would undermine the foundation of its business. Therefore, after a hacking event, Coinbase's stock price plummeted significantly.


CEXs are All in Self-Rescue Mode


Facing a decline in spot trading fee revenue, Coinbase is also accelerating its transformation, attempting to find growth opportunities in derivatives and emerging assets. Coinbase acquired a stake in the options platform Deribit at the end of 2024 and announced the official launch of perpetual contract products in 2025. This acquisition fills in Coinbase's gap in options trading and its relatively small global market share.



Deribit has a strong presence in non-U.S. markets, especially in Asia and Europe. The acquisition has enabled Coinbase to gain a dominant position in bitcoin and ethereum options trading on Deribit, accounting for approximately 80% of the global options trading volume, with daily trading volume remaining above $2 billion.


Meanwhile, 80-90% of Deribit's customer base consists of institutional investors, with their professionalism and liquidity in the Bitcoin and Ethereum options market highly favored by institutions. Coinbase's compliance advantage, coupled with its already robust institutional ecosystem, makes it even more suitable. By using institutions as an entry point, it can face the squeeze from giants like Binance and OKX in the derivatives market.



Facing a similar dilemma is Kraken, which is attempting to replicate Binance Futures' model in non-U.S. markets. Since the derivatives market relies more on professional users, fee rates are relatively higher and stickiness is stronger, making it a significant source of revenue for exchanges. In the first half of 2025, Kraken completed the acquisition of TradeStation Crypto and a futures exchange, aiming to build a complete derivatives trading ecosystem to hedge the risk of declining spot transaction fee income.


With the surge of Memecoin in 2024, Binance, OKX, and various CEX platforms began massively listing small-market-cap, highly volatile tokens to activate active trading users. Due to the wealth effect and trading activity of Memecoins, Coinbase was also forced to join the battle, successively listing popular tokens from the Solana ecosystem such as BOOK OF MEME and Dogwifhat. Although these coins are controversial, they are frequently traded, with fee rates several times higher than mainstream coins, serving as a "blood-boosting" method for spot trading.


However, due to its status as a publicly traded company, this practice is a riskier endeavor for Coinbase. Even in the current crypto-friendly environment, the SEC is still investigating whether tokens like SOL, ADA, and SAND constitute securities.


In addition to the forced transformation strategies carried out by the aforementioned CEXs, they are also starting to lay out RWAs and the most talked-about stablecoin payment fields, such as the PYUSD launched through a collaboration between Coinbase and Paypal, Coinbase's support for the Euro stablecoin EURC by Circle that complies with EU MiCA regulatory requirements, or the USD1 launched through a collaboration between Binance and WIFL. In the increasingly crowded trading field, many CEXs have shifted their focus from just the trading market to the application field.


The golden age of transaction fees has quietly ended, and the second half of the crypto exchange platform game has silently begun.


Arthur Hayes: Why I'm Betting on ETH While the Market Is Obsessed with SOL

"I personally have also allocated 20% to gold, expecting the price of gold to potentially rise to $10,000-20,000 by the end of this market cycle."

Key Market Insights for May 16th, how much did you miss out on?

1. On-chain Flows: $111.3M inflow to Ethereum this week; $237.6M outflow from Berachain 2. Largest Price Swings: $ETHFI, $NEIRO 3. Top News: Data: Solana Network's revenue reached $7.9M on the 13th, surpassing the sum of all other L1 and L2 chains

CryptoPunks Changes Hands Twice, Did the Originator of NFTs Finally Find Its "Forever Home" This Time?

The original NFT pioneer CryptoPunks has once again officially changed ownership after being sold to the Bored Ape Yacht Club (BAYC) developer Yuga Labs.

MOG Coin Skyrockets as Elon Musk and Garry Tan Embrace "mog/acc" Identity

「mog/acc」 is rapidly sweeping through various figures, from Elon Musk to Garry Tan, boosting the project's visibility and ultimately driving up the price.

STARTUP's Price Surges 40x in 30 Minutes: How did he become the Emotion King of Believe?

He is both a KOL and understands the market script, playing a game where attention is the currency.

Popular coins

Latest Crypto News

Read more