Bybit Fully Covered $1.4B Ether Gap after the Hack; Handled $6.1B in Withdrawals

Bybit, the cryptocurrency exchange hacked last Friday, withstood an outflow of over $6.1 billion over the weekend. However, the exchange’s CEO announced that the platform replaced the $1.4 billion worth of Ether stolen in the attack.

According to DeFiLlama, the total amount of customers’ assets held by Bybit was around $16.9 billion, which dropped to $10.8 billion as of press time. The withdrawal pressure came as hackers managed to drain roughly 70 per cent of the exchange’s clients’ Ether in the attack.

Assurance of Equal Reserves

Bybit’s CEO, Ben Zhou, posted on X (formerly Twitter) that his exchange “has already fully closed the ETH gap,” adding that “Bybit is again back to 100% 1:1 on client assets through Merkle tree.” He further noted that Bybit would soon publish an audited proof-of-reserves report.

Zhou’s confirmation came after blockchain analytics firm Lookonchain estimated that Bybit received 446,870 Ether, worth around $1.23 billion, which was about 88 per cent of the stolen amount, from loans, whale deposits, and purchases.

Out of the total, the hacked exchange bought 157,660 Ether, worth about $437.8 million, from crypto investment firms Galaxy Digital, FalconX, and Wintermute through over-the-counter transactions. The exchange bought another $304 million of Ether from centralised and decentralised exchanges.

Latest Update: Bybit has already fully closed the ETH gap, new audited POR report will be published very soon to show that Bybit is again Back to 100% 1:1 on client assets through merkle tree, Stay tuned. https://t.co/QLa1vOujM6

— Ben Zhou (@benbybit) February 24, 2025

The Largest Crypto Heist

The attack on Bybit has resulted in the biggest heist from any crypto exchange to date. On-chain analysts linked the attack to North Korea’s notorious Lazarus Group. Bybit also launched a bounty program with $140 million to gather leads on the massive cyberattack.

Although the exchange did not publicly pinpoint the vulnerability that led to the attack, its CEO said, “We know the cause is definitely around the Safe cold wallet. Whether it’s a problem with our laptops or on Safe’s side, we don’t know.”

Safe is a decentralised custody protocol that offers smart contract wallets for managing digital assets. Some exchanges have integrated Safe, enabling users to retain control of their funds while using multi-signature functionality to improve the security of their cold wallets.

Following the Bybit attack, Safe temporarily shut down its smart wallet functionalities, which increased the hacked exchange’s concerns over mounting withdrawal requests. However, it coordinated with Safe and other platforms to establish a smooth process and honour the withdrawal requests.