Timeline | Bybit Loses Over 500K ETH in Hack, $1.5 Billion Loss
On the early morning of February 22, on-chain detective Zachxbt detected a suspicious fund outflow incident on Bybit. Subsequent on-chain records showed that a multisig address controlled by Bybit transferred out $1.5 billion worth of ETH and used a DEX to convert LSD assets into native ETH. Possibly due to FUD sentiment, Ethereum briefly dropped below $2,700; Bybit's native platform token MNT briefly fell below $0.9, with a 24-hour decrease of 7.71%.
Bybit CEO Ben Zhou quickly responded, stating that indeed a hacker had control of a specific ETH cold wallet, but the rest of the cold wallets are secure and withdrawals are functioning normally. Ben Zhou also emphasized that Bybit has the ability to make payment and can bear this loss. BlockBeats will continue to monitor and provide real-time updates, as outlined in the timeline below:
Bybit CEO: Will Soon Host a Livestream to Address All Questions
On February 22, Bybit CEO Ben Zhou posted an update on Platform X stating, "I will soon start a livestream to answer all questions!! Please stay tuned."
ZachXBT: Bybit Hacker Has Distributed 10,000 ETH to 39 New Addresses, Urging All Parties to Blacklist Promptly
On February 22, ZachXBT stated that the Bybit hacker had just distributed 10,000 ETH to 39 new addresses. "If you are an exchange platform or service provider, please blacklist these addresses on all EVM chains."
SlowMist Founder: Bybit Hacker's Attack Method Similar to North Korean Hackers
On February 22, SlowMist founder COSMOS published a post saying, "Although there is no direct evidence at the moment, based on the Safe multisig approach and the current laundering method, it resembles North Korean hackers."
Bybit CEO: Platform Withdrawals Operating Normally, Other Cold and Hot Wallets Not Affected; Bybit has Payment Ability and Can Bear This Loss
On February 22, Bybit CEO Ben Zhou posted an update saying that Bybit's hot wallets, warm wallets, and all other cold wallets were not affected. The only wallet compromised was the ETH cold wallet. All withdrawals are operating normally. Additionally, it was emphasized, "Bybit still has the ability to make payments. Even if the loss from this hacker attack cannot be recovered, all client assets remain 1:1 backed, and we can bear this loss."
Bybit Hacker Starts to Disperse Funds to Multiple Addresses
On February 21, according to Arkham Monitoring, the Bybit hacker has started to disperse funds to multiple addresses.
Bybit Platform Total Assets Reach $15.727 Billion, with $5.18 Billion in Ethereum Assets
On February 21, according to Defillama data, the Bybit platform's total assets amount to $15.727 billion, including:
· $6.263 billion in Bitcoin;
· $5.18 billion in Ethereum;
· $1.35 billion in SOL;
· $1.143 billion in TRON.
Bybit CEO: Hacker Controls Specific ETH Cold Wallet, Other Cold Wallets Secure and Withdrawals Operating Normally
On February 21, Bybit Co-Founder and CEO Ben Zhou stated in a post, "Bybit's ETH multisig cold wallet made a transfer to our hot wallet approximately 1 hour ago. It appears the transaction was spoofed, with all signers seeing a spoofed interface displaying the correct address and URL coming from Safe.
However, the signature information was to alter the smart contract logic of our ETH cold wallet. This resulted in the hacker controlling our signed specific ETH cold wallet and moving all ETH in the wallet to this unconfirmed address.
Rest assured, all other cold wallets are secure. All withdrawals are functioning normally. I will continue to update as more unfolds. If there are teams that can assist us in tracking the stolen funds, it would be greatly appreciated."
Bybit Multi-Sig Address Transfers $1.5 Billion Worth of ETH and Swaps LSD Assets for Native ETH Using DEX
On February 21, crypto KOL Finish posted that, according to on-chain data, a Bybit multi-signature address transferred $1.5 billion worth of ETH to a new address. The funds reached the new address 0x47666fab8bd0ac7003bce3f5c3585383f09486e2, then were moved to 0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e, where 0xa4 is currently selling stETH and mETH in exchange for ETH.
「Currently, this address is using 4 different DEXs. If they were to simply swap the LSD for native ETH, the transaction execution would be very inefficient (high slippage). This scale of operation is typically done off-chain, so this is very unusual.」
Zachxbt Monitors Bybit for Suspected Fund Outflow
On February 21, the Zachxbt monitoring channel reported that they are currently monitoring a suspicious fund outflow from Bybit, totaling over $1.46 billion.
You may also like
Galaxy Deep Research Report: How Hyperliquid's HIP-4 Upgrade Changes the Landscape of Prediction Markets?
Binance Research: RWA Market Expected to Expand Nearly 6x from Early 2025, with Public Equities and Onchain Payments Heating Up Together
In June, Binance Research said in its monthly market report that the real-world asset (RWA) market is expected to grow by about 589% from the beginning of 2025. Bond- and money market fund-related RWA expanded by about $6.5 billion, up 83% year over year, while publicly traded equity RWAs grew by about 422%. The report also noted that monthly crypto debit card transaction volume exceeded $747 million in May, up 48.6% year to date.
Japan to Assess a Framework for Yen Stablecoins and Crypto ETFs as Asia’s Compliant Payments Narrative Heats Up
Recently, according to the original report, Japan is considering the launch of yen stablecoins and cryptocurrency ETFs. Public information remains limited at this stage, and there is still no complete policy text, regulatory draft, or clear implementation timeline, so this is better characterized as a “policy discussion” rather than formal implementation. The original wording also noted that advancing stablecoin regulation in Asia is driving XRP usage and supporting growth in the XRPL ecosystem. However, based on currently available public information, there is not enough evidence to directly establish a clear causal relationship between this round of discussion in Japan and XRP or XRPL.
ZachXBT: Humanity private key leak and abnormal surge in H token should be viewed separately
On June 9, according to related disclosures, on-chain investigator ZachXBT posted an update on Humanity’s roughly $31 million security incident, saying that after further analyzing fund flows, he currently tends to believe the project team was not involved in an “inside job” or a self-staged attack. According to him, the official explanation about the private key leak was broadly accurate, but before the token unlock, the price of H had been artificially pushed higher, and the hacker later took advantage of that market environment; therefore, the private key leak and the earlier abnormal price pumping should be regarded as two separate and independent events. This reframing has shifted the market’s understanding of the nature of the incident. Earlier discussion around Humanity had focused on whether the team directly participated in the attack or used the security incident to cover up internal operations. ZachXBT’s latest remarks shift the focus from “whether it was self-theft” to “whether there were pre-unlock market structure issues.” He also questioned whether the team may have.
Morning Report | OpenAI has submitted an S-1 registration statement draft to the U.S. SEC; Morpho completes $175 million financing
Morning Report | BitMine increased its holdings by 126,971 ETH last week; trader Eugene announced his exit from the crypto market
Wang Chuan: How can one not feel anxious after the neighbor Old Wang made thirty times profit by investing in storage stocks? (Seven) - A quarter-century cycle
Cryptocurrency CEXs are flocking to sell US stocks, and traditional brokerages are facing an "uninvited guest."
$75 billion in foreign capital has fled, and South Korean retail investors have absorbed it all using leverage
Japan’s Three Megabanks Plan Joint Stablecoin Issuance in Fiscal 2026
MUFG, SMBC, and Mizuho reportedly plan to jointly issue fiat-pegged stablecoins in fiscal 2026, signaling Japan’s growing push into bank-led digital payment infrastructure.
Humanity Discloses H Token Dual-Chain Attack Details, With Losses on Ethereum and BSC Exceeding $36 Million
Humanity said the H token attack across Ethereum and BSC caused more than $36 million in losses after leaked ProxyAdmin keys enabled malicious contract upgrades and token minting.
White House Discusses CLARITY Act With Law Enforcement Ahead of Senate Vote
The White House discussed the CLARITY Act with law enforcement ahead of a Senate vote, focusing on illicit finance risks and developer protections.
Bitcoin Trading Guide 2026: Strategies for Experienced Traders
What Is XAUT and PAXG? Why Tokenized Gold Is Booming in 2026
Will the SpaceX IPO Hurt Bitcoin? Here's What Traders Are Watching
Foreign selling in the South Korean stock market accelerates, with cumulative net sales reportedly reaching $75 billion this year
On June 9, The Kobeissi Letter, citing Goldman Sachs data, reported that global investors are selling South Korean stocks at an unusually rapid pace. In the latest trading session, foreign investors sold about $801 million worth of Kospi constituent stocks again; total foreign outflows last week reached about $10 billion, and the market has been in net foreign selling on nearly every trading day over the past month. According to the data cited in the report, foreign investors have sold about $75 billion worth of South Korean stocks so far this year. Meanwhile, South Korean retail and institutional investors together recorded roughly $69 billion in net buying over the same period, suggesting that the market’s main buying support has come from domestic capital rather than returning overseas funds. The information currently disclosed still mainly comes from The Kobeissi Letter’s retelling and Goldman Sachs data summaries, while public details on the statistical period and the specific definition of “selling” remain relatively limited.
Fortune Warns of Strategy’s Financing Structure Risks as Bitcoin Premium Narrows
Fortune warned that Strategy’s Bitcoin treasury model faces growing financing risks as MSTR’s net asset premium narrows and preferred stock dividend pressure increases.
Ferrari Challenge Le Mans: Carl Moon to Dominate in WEEX Livery
Galaxy Deep Research Report: How Hyperliquid's HIP-4 Upgrade Changes the Landscape of Prediction Markets?
Binance Research: RWA Market Expected to Expand Nearly 6x from Early 2025, with Public Equities and Onchain Payments Heating Up Together
In June, Binance Research said in its monthly market report that the real-world asset (RWA) market is expected to grow by about 589% from the beginning of 2025. Bond- and money market fund-related RWA expanded by about $6.5 billion, up 83% year over year, while publicly traded equity RWAs grew by about 422%. The report also noted that monthly crypto debit card transaction volume exceeded $747 million in May, up 48.6% year to date.
Japan to Assess a Framework for Yen Stablecoins and Crypto ETFs as Asia’s Compliant Payments Narrative Heats Up
Recently, according to the original report, Japan is considering the launch of yen stablecoins and cryptocurrency ETFs. Public information remains limited at this stage, and there is still no complete policy text, regulatory draft, or clear implementation timeline, so this is better characterized as a “policy discussion” rather than formal implementation. The original wording also noted that advancing stablecoin regulation in Asia is driving XRP usage and supporting growth in the XRPL ecosystem. However, based on currently available public information, there is not enough evidence to directly establish a clear causal relationship between this round of discussion in Japan and XRP or XRPL.
ZachXBT: Humanity private key leak and abnormal surge in H token should be viewed separately
On June 9, according to related disclosures, on-chain investigator ZachXBT posted an update on Humanity’s roughly $31 million security incident, saying that after further analyzing fund flows, he currently tends to believe the project team was not involved in an “inside job” or a self-staged attack. According to him, the official explanation about the private key leak was broadly accurate, but before the token unlock, the price of H had been artificially pushed higher, and the hacker later took advantage of that market environment; therefore, the private key leak and the earlier abnormal price pumping should be regarded as two separate and independent events. This reframing has shifted the market’s understanding of the nature of the incident. Earlier discussion around Humanity had focused on whether the team directly participated in the attack or used the security incident to cover up internal operations. ZachXBT’s latest remarks shift the focus from “whether it was self-theft” to “whether there were pre-unlock market structure issues.” He also questioned whether the team may have.
Morning Report | OpenAI has submitted an S-1 registration statement draft to the U.S. SEC; Morpho completes $175 million financing
Morning Report | BitMine increased its holdings by 126,971 ETH last week; trader Eugene announced his exit from the crypto market
