Bybit Cryptocurrency Exchange Hack: What Happened, Impact, and Lessons

A confirmed data breach at Bybit Cryptocurrency Exchange exposed financial and payment data.

In February 2025, Bybit suffered one of the largest cryptocurrency thefts on record when attackers manipulated a routine transfer from an Ethereum cold wallet and redirected the assets to addresses they controlled.

Public reporting and post-incident analysis describe the event as a targeted crypto heist involving Bybit’s multisig wallet workflow, not a confirmed mass compromise of customer personal data records.

Investigations published after the incident found that attackers manipulated the transaction approval process so authorized signers believed they were approving a legitimate internal transfer when they were actually authorizing a malicious transaction that handed control of the wallet to the attackers.

Multiple reports place the value of the theft at roughly $1.4 billion to $1.5 billion, making it the largest crypto heist of its kind at the time.

Later forensic reporting said attacker activity inside the affected third-party environment likely began earlier in February, with malicious changes to the Safe wallet interface identified before the theft itself.

Anyone whose data Bybit Cryptocurrency Exchange held is potentially affected, specifically customers whose records were exposed.

Technical reviews said the attackers tampered with the Safe web interface so it behaved normally for most users but selectively altered transactions involving targeted Bybit wallets.

Other reporting described the incident as a blend of supply-chain compromise, UI manipulation, and smart contract abuse rather than a straightforward exchange-server breach.

Financial data has a short shelf life for the victim to react -- fraudulent charges can show up within days, not months.

This is the uncomfortable part of a vendor breach: the victim organization can do everything right internally and still be exposed through a partner it had to trust.

The theft was executed on February 21, 2025 during the wallet transfer process.

The exposure here is through a third-party vendor relationship, not a direct intrusion into the victim's own systems.

Safe said it rebuilt and reconfigured infrastructure, rotated credentials, and added further validation and monitoring after the attack.

Public reporting and investigations widely attributed the operation to North Korea-linked Lazarus activity.

Early February 2025: Investigators later reported attacker activity tied to a compromised Safe developer environment.

Late February 2025: Bybit shared conclusions from outside investigations linking the attack to Safe infrastructure and Lazarus attribution grew stronger through public reporting and the FBI statement.

If you have any relationship with Bybit Cryptocurrency Exchange, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.

A fraud alert on financial statements is worth considering now, since financial data exposure tends to turn into attempted fraud quickly.

If you run a similar vendor relationship yourself, this is a reasonable prompt to review what data that vendor actually holds and why.

Any unsolicited message referencing this breach is worth treating with suspicion, since attackers commonly impersonate the breached company afterward.