Incident Overview
On February 21, 2025, Bybit, one of the largest cryptocurrency exchanges, suffered a massive security breach, resulting in the loss of approximately $1.46 billion worth of Ethereum (ETH). The attack exploited a multisignature (multisig) cold wallet vulnerability through a sophisticated phishing and smart contract manipulation scheme.
The Bybit hack on February 21, 2025, resulted from a multisignature cold wallet breach caused by a sophisticated phishing attack that manipulated smart contract logic. The attackers deceived Bybit’s security team using a "musked" transaction, where the UI displayed a legitimate Safe (Gnosis Safe) address, but the actual transaction altered the wallet’s smart contract permissions, granting the hackers control. Once the fraudulent transaction was signed, the attackers withdrew 401,346 ETH (~$1.13 billion) and additional assets like mETH and stETH, swiftly swapping them for ETH on decentralized exchanges (DEXes) to obscure their trail.
On-chain analyst ZachXBT first flagged the suspicious transactions, prompting further investigation. The stolen assets were split across multiple wallets, making it difficult to track and recover the funds. Bybit confirmed that only one cold wallet was compromised and reassured users that withdrawals remained operational.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Bybit, these are the critical security checks that could have prevented this incident (February 2025).
- Verify all logic paths related to Safe Multisig wallet Phishing Exploit / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$43.0M
Net Loss
1356600000
Post-Incident Timeline
-
2025-02-23
mETH Protocol recovered 15,000 cmETH ($43M) from the Bybit hack, thanks to its 8-hour withdrawal delay, which allowed the team to pause unauthorized withdrawals. The recovery was led by Mudit Gupta (Polygon’s CISO) and SEAL security team. Additionally, Tether froze $181,000 USDT, and Bybit confirmed bounties of $4.3M for the recovery team and $18,100 for Tether. Exchanges helped freeze $42.89M in stolen funds, making this one of the fastest large-scale recoveries.
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Proof-of-Concept Exploits
On-Chain Evidence & References
- Twitter/X Alert https://x.com/dhkleung/status/1893073663391604753
Sources & References
Learn to Prevent the Next Bybit
The Bybit hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.