Bybit Suffers $1.5 Billion Hack but Remains Financially Stable, CEO Confirms

A Major Security Breach at Bybit

Bybit, one of the world’s leading cryptocurrency exchanges, has suffered a massive security breach, resulting in the loss of approximately $1.5 billion in Ethereum (ETH) and liquid-staked Ethereum (stETH). Blockchain analyst ZachXBT first reported the incident, highlighting "suspicious outflows" from Bybit’s Ethereum cold wallet.

What Happened?

According to blockchain data, around $1.5 billion has already been withdrawn, with $200 million liquidated on decentralized exchanges. The funds were transferred from Bybit’s cold wallet to an unknown address, where they are now being converted into other assets.

Bybit CEO Ben Zhou confirmed the hack, stating that an unauthorized party gained control of the affected ETH cold wallet and transferred the funds. However, he reassured users that all other cold wallets remain secure and that withdrawals are functioning normally.

Largest Crypto Hack in History?

If the losses remain unrecovered, this would mark the largest cryptocurrency hack in history in terms of dollar value. For comparison:

• The Mt. Gox hack resulted in a $470 million loss.

• The 2018 CoinCheck hack led to $530 million in stolen assets.

• The Ronin Bridge exploit in 2022 saw $650 million drained.

How Did the Hack Happen?

Zhou provided further insights into how the breach occurred. He explained that approximately an hour before the incident, a transfer was made from the exchange’s multi-signature wallet to a warm wallet. The transaction, which appeared legitimate at first, contained malicious code designed to alter the smart contract logic and siphon funds.

Following the attack, blockchain analysts urged the crypto community to blacklist the hacker’s associated addresses to prevent further movement of stolen assets.

Impact on the Market

The news of the hack led to a decline in the price of major cryptocurrencies. Ethereum's (ETH) price dropped by 4%, while Bitcoin's (BTC) price and other major digital assets also saw a decline of over 1.5% during a short period of time.

Bybit’s Response and Customer Assurance

Despite the significant loss, Bybit has assured its users that the platform remains financially stable. CEO Ben Zhou emphasized that all client funds are fully backed on a 1:1 basis and that the exchange has sufficient reserves to cover the losses.

“All client funds are safe, and our operations continue as usual without any disruption,” Bybit stated in an official announcement.

This attack is the latest in a string of crypto exchange breaches that have plagued the industry in early 2025, underscoring the growing need for robust security measures. Bybit has pledged to enhance its security protocols and is actively working with blockchain investigators to trace and recover the stolen funds.

Security Measures at Finst

In contrast to recent security breaches in the crypto industry, Finst upholds the highest security standards to protect all its clients’ assets. Here’s how Finst ensures the safety of its customers’ assets:

Advanced Security Features

• Biometric Protection & 2FA: Strong authentication mechanisms to help prevent unauthorized access using Strong Factor Authentication

• Closed-Loop System: Even if an attacker gains access, they cannot transfer funds to an unauthorized bank account.

• Device Pairing: Ensures that only trusted devices previously verified with both email and SMS verification can be used to log in to your Finst account.

• Data Encryption: Your personal information is fully encrypted, stored within the EU, and handled with strict confidentiality.

Institutional-Grade Asset Security

While security breaches continue to plague the crypto industry, platforms like Finst stand out for their rigorous security measures. Finst ensures the safety of assets through institutional-grade security protocols designed to protect users against both external attacks and internal threats.

• Cryptocurrency Vault: Assets are secured with Fireblocks, using Multi-Party Computation (MPC) technology to prevent external attacks, internal collusion, and human error.

• Strict Transaction Approval Policy: Multiple executives are required to approve crypto transfers. Additionally, crypto transfers can only be made to previously whitelisted addresses, which follow a strict whitelisting protocol.

• Money Safekeeping: Clients’ money is stored with EU-regulated banks on a 1:1 basis and kept separate from Finst's own money.

• Asset Segregation: Clients’ assets are safeguarded on a 1:1 basis using asset segregation. This means that assets are stored in a distinct safekeeping entity (Stichting Finst Custody) to ensure they remain separate from Finst’s own assets at all times.

• Proof of Reserves (PoR): Finst is the only Dutch crypto platform with a Proof of Reserves audit conducted by an independent and reputable audit firm, AuditNow, demonstrating financial transparency and solvency.

With these measures in place, Finst remains committed to offering users the most secure and reliable cryptocurrency trading experience.