Bybit hack
The largest crypto theft on record: about $1.5B in Ether was stolen from the Bybit exchange on February 21, 2025. The FBI attributed it to North Korea (TraderTraitor/Lazarus), which compromised the Safe{Wallet} signing interface to redirect a routine cold-wallet transfer.
Also known as: Bybit, Bybit hack, TraderTraitor
Summary
On February 21, 2025, the cryptocurrency exchange Bybit lost approximately $1.5 billion — about 401,000 ETH — in what is widely described as the largest cryptocurrency theft in history. [1][2]
How it happened
Rather than breaking Bybit's own systems or the Safe{Wallet} smart contracts, the attackers carried out a supply-chain/operational-security attack: they compromised a Safe{Wallet} developer environment and injected malicious code into the wallet interface so that, when Bybit signers approved a routine transfer from cold storage, the interface displayed legitimate details while the signature actually authorized a malicious contract that drained the wallet. [1][2]
Attribution
On February 26, 2025, the FBI attributed the theft to North Korea, referring to the activity as "TraderTraitor" (part of the Lazarus Group umbrella); investigators including ZachXBT and Arkham independently linked it to the same actor. Bybit said it secured bridge financing to cover any unrecoverable losses. [1][3]
Bracketed numbers refer to the numbered sources listed below.
Sources (3)
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
