Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed
Bybit
crypto exchange · AE · Middle East · Bybit Fintech Limited
Bybit lost about 1.5B USD in ETH from a cold wallet on 21 Feb 2025, the largest crypto theft on record. Withdrawals were not suspended but were heavily delayed amid a run of over 350,000 requests; the CEO said all were processed about 12 hours later.
- First disruption
- Feb 21
- First public signal
- Feb 21 (on-chain sleuths (ZachXBT) flagged outflows from Bybit ETH cold wallet, then CEO livestream)
- Acknowledged
- Feb 21
- Restored
- Feb 22
- Duration
- not established
- DFX first recorded
- Nov 5 14:58 UTC
What was restricted
Withdrawals were delayed for hours amid more than 350,000 withdrawal requests; CEO said all withdrawals were processed by 22 Feb, about 12 hours after the hack. Total single-day outflows reported at about 5.5B USD.
Financial impact: About 1.4B to 1.5B USD stolen (confirmed theft; figure varies); reserves replenished via loans and purchases.
Cause, kept in separate layers
- What the institution said
- Attacker took control of an ETH cold wallet and moved about 401,000 ETH; withdrawals delayed by congestion, not halted
- DFX classification
- Confirmed cyber (cyber: confirmed)
- Analytical hypothesis (not established)
- Attributed to DPRK Lazarus Group by Elliptic, ZachXBT and others.
- Conflicting reports
- Restriction was a delay rather than a formal suspension; completion claim rests on CEO posts. Loss 1.4B to 1.5B USD depending on source.
Dependencies
A dependency is a documented relationship. It is not evidence that the provider was compromised.
- Downstream: Bitget: deposited 40,000 ETH to support Bybit liquidity (documented)
Evidence
- Cointelegraph · 2025-02-22
- Insurance Journal (Bloomberg) · 2025-02-24
- VnExpress International · 2025-02
- Silicon UK · 2025-02