Cryptocurrency exchange Bybit disclosed in February 2025 that it suffered a severe security incident in which assets from one of its Ethereum cold wallets were transferred out [1]. Subsequent company statements noted that preliminary forensics determined Bybit's own infrastructure had not been breached and that the attack was related to the Safe Wallet signing process [2]. Later media and law enforcement reports attributed the attack, which this site retains only where explicitly named in the cited sources [2].
Backfill: this event became public on Feb 21, 2025 and we added it on Nov 10, 2026. It is not a new event.
CriticalMonitoringBackfillOfficially confirmed
Bybit Discloses Attack on Ethereum Cold Wallet Resulting in Massive Asset Theft
1 min read
- Disclosed
- Feb 21, 2025
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Finance
What to do nowOur advice
Later media and law enforcement reports attributed the attack, which this site retains only where explicitly named in the cited sources [2].
Timeline
- Bybit releases preliminary forensic update confirming its infrastructure was not breached[1]
Technical details
Source-Supported Details
Where sources name a specific threat actor, that attribution is retained in tags; otherwise no independent attribution is made. Monetary amounts and token details follow the verified source text without adding unverified figures [1].
Source excerpt: "The forensic review into the targeted attack by the Lazarus Group concluded that the credentials of a Safe developer were compromised. This allowed the attacker to gain unauthorized access to the Safe(Wallet) infrastructure and totally deceive signers into approving a malicious transaction." [1].
References
Official / primary1
- [1]
“The forensic review into the targeted attack by the Lazarus Group concluded that the credentials of a Safe developer were compromised. This allowed the attacker to gain unauthorized access to the Safe(Wallet) infrastructure and totally deceive signers into approving a malicious transaction.”
Media1
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.