The Bybit Hack: What Now?
Was mid-podcast with
@DeFi_Dad last night when we heard about the $1.4B heist. Over the years at Treehouse, we've interviewed 20+ applicants with great resumes who refused to turn on their cameras, couldn’t answer basic questions about their listed universities or home countries, and immediately exited the interview when pressed about their Korean accents. As a co-founder of a DeFi protocol, I get 3-4 phishing emails/Telegram DMs attempts a week; I can’t imagine the sheer volume of attacks an institution like Bybit, managing far more assets, must fend off daily.
How Did Lazarus Pull It Off?
The North Korean-linked group compromised the front-end of the Bybit multisig into approving what seemed like a routine cold-to-warm wallet transfer—except the recipient was Lazarus. This transaction required four signers, including Bybit’s CEO
@benbybit, executed using a
@Ledger device and
@safe as the multisig solution.
Two leading possibilities:
1. A Compromise of Ledger or Safe – If either was fundamentally exploited, we’d likely see widespread attacks across exchanges, protocols, and institutions using these solutions. Since we’re not, this scenario seems unlikely.
2. A Socially Engineered Attack – The far more probable explanation. Lazarus likely infiltrated Bybit over months (or years), gathering insider knowledge of operational security, signer behavior, and transaction processes.
For an attack of this scale, the hackers had to know:
- Who the signers were – their identities, routines, and level of access.
- What devices they used – whether they frequently swapped machines or relied on a single device.
- When and how keys were rotated – whether multisig key changes were scheduled regularly or if there were gaps in security.
From there, they had to compromise those devices. Obviously, this wasn’t a random exploit. I’m sure Bybit's working around the clock with security experts to piece this together.
A Masterclass in Crisis Management
Within the first few hours,
@benbybit and team handled this exceptionally well:
1. Publicly addressed the hack within hours via a livestream, providing transparency on the situation and next steps.
2. Honored every withdrawal request, even as withdrawal volume surged 100x+ their usual.
3. Scaled operations without downtime—processing withdrawals at that scale without breaking systems is an underrated challenge.
Yes, Bybit is now effectively net short ETH as many have pointed out, but they are solvent with the revolving facility to help with liquidity, extremely well capitalized, and highly profitable (annual profits >$1.5bn according to Bitget's CEO)—more than capable of absorbing a $1.4B hit.
Put simply: If CZ himself could afford a $4B DOJ fine, Bybit as an institution can handle this.
What’s Next for Lazarus?
Laundering $1.4B in ETH is no small task. It'll take years.
They can’t convert it to the top stablecoins – Tether and Circle will freeze any blacklisted funds. Any other assets lack the liquidity and off-ramps – making an exit difficult.
Their likely moves:
1. Split funds into smaller wallets – already happening.
2. Convert to ETH first – their standard playbook, per Chainalysis report on past Lazurus hacks.
3. Swap to BTC – higher liquidity, greater scale.
4. Slowly offload through smaller, obscure exchanges – weak compliance jurisdictions.
Other, less likely tactics they could do given the scale of this hack:
- Buying illiquid tokens and washing them through DEX/CEX, coming out on the other side of the trade.
- Using DeFi pools to obscure transaction trails (privacy chains barely hold $55M in bridges; Tornado Cash liquidity is ~$500M).
The Bigger Picture
The best thing to come out of this? The industry stood with Bybit. The revolving facility for liquidity, continued market-making support, and overall confidence in Bybit’s recovery showed resilience.
A $1.4B loss is a black eye for the space, but we need Bybit to succeed for the broader industry to remain strong.
It’s clear Lazarus won't be giving anything back so Bybit will eventually have to repurchase the underlying ETH. They likely already hold significant reserves in ETH. Meanwhile, Lazarus will slowly offload ETH (over time, net neutral for the market vs Bybit's buy), rotate into BTC (short-term positive for the asset), and eventually cash out to fiat (likely RMB) so Mr Rocketman can continue to fund his rockets.
❤️ for Bybit