In the early hours of February 22nd, on-chain detective Zachxbt monitored suspicious fund outflows from Bybit. Subsequent on-chain records showed that a Bybit multi-signature address transferred ETH worth $1.5 billion and used a DEX to exchange LSD assets for native ETH. Potentially affected by FUD sentiment, Ethereum briefly fell below $2,700; Bybit's native platform token MNT briefly fell below $0.9, a 24-hour drop of 7.71%.

Bybit CEO Ben Zhou quickly responded, stating that hackers had indeed controlled a specific ETH cold wallet, but the rest of the cold wallets were secure and withdrawals were normal. Ben Zhou also emphasized that Bybit has the solvency to bear this loss. BlockBeats will continue to follow up and update in real-time, with the following timeline:

Bybit CEO: I will start a live broadcast soon to answer all questions

On February 22nd, Bybit CEO Ben Zhou posted on the X platform, saying, "I will start a live broadcast soon to answer all questions!! Please stay tuned."

ZachXBT: Bybit hacker has dispersed 10,000 ETH to 39 new addresses, calling on all parties to blacklist them in time

On February 22nd, ZachXBT posted that the Bybit hacker had just dispersed 10,000 ETH to 39 new addresses. "If you are an exchange or service provider, please blacklist these addresses on all EVM chains."

Slow Mist Cosine: Bybit hacker's attack method similar to North Korean hackers

On February 22nd, Slow Mist founder Cosine posted that "although there is no clear evidence yet, the way of tampering with the Safe multi-signature and the current money laundering method are similar to North Korean hackers."

Bybit CEO: Platform withdrawals are normal, the rest of the cold and hot wallets are unaffected; Bybit has solvency to bear this loss

At 23:53, Bybit CEO Ben Zhou posted an update, saying that Bybit's hot wallets, warm wallets, and all other cold wallets were unaffected. The only one attacked by the hacker was the ETH cold wallet. All withdrawals are normal. He also emphasized, "Bybit still has solvency, even if the loss caused by this hacker attack cannot be recovered, all customer assets are still supported 1:1, and we can bear this loss."

Bybit hacker has started to disperse funds to multiple addresses

At 0:00 on February 22nd, according to Arkham's monitoring, the Bybit hacker has started to disperse funds to multiple addresses.

Bybit platform's total assets are $15.727 billion, with Ethereum assets reaching $5.18 billion

As of 23:54 on February 21st, according to Defillama data, Bybit's total platform assets are $15.727 billion, including:

· $6.263 billion in Bitcoin;

· $5.18 billion in Ethereum;

· $1.35 billion in SOL;

· $1.143 billion in TRON.

Bybit CEO: Hackers controlled a specific ETH cold wallet, but the rest of the cold wallets are secure and withdrawals are normal

At 23:44, Bybit co-founder and CEO Ben Zhou posted that "about an hour ago, Bybit's ETH multi-signature cold wallet made a transfer to our hot wallet. It appears that this transaction was disguised, with all signatories seeing the disguised interface showing the correct address and the URL coming from Safe.

However, the signing information was to change the logic of our ETH cold wallet smart contract. This resulted in the hackers controlling the specific ETH cold wallet we signed, and transferring all the ETH in the wallet to this unconfirmed address.

Rest assured, all other cold wallets are secure. All withdrawals are normal. I will continue to update as more situations arise. If there are any teams that can help us track down the stolen funds, we would be most grateful."

A Bybit multi-signature address transferred ETH worth $1.5 billion and used a DEX to exchange LSD assets for native ETH

A few minutes later, crypto KOL Finish posted that according to on-chain data, one of Bybit's multi-signature addresses had transferred ETH worth $1.5 billion to a new address. The funds reached the new address 0x47666fab8bd0ac7003bce3f5c3585383f09486e2, and then transferred to 0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e, 0xa4 is currently selling stETH and mETH to exchange for ETH.

"The address is currently using 4 different DEXs, if they are just exchanging LSD for native ETH, the transaction execution effect will be very poor (high slippage). This scale is usually done through OTC, so it's very unusual."

Zachxbt monitors suspicious fund outflows from Bybit

Around 23:27 on the evening of February 21st, the Zachxbt monitoring channel said it was monitoring suspicious funds outflows from Bybit, totaling over $1.46 billion.

Welcome to join the official BlockBeats community:

Telegram subscription group: https://t.me/theblockbeats

Telegram discussion group: https://t.me/BlockBeats_App

Twitter official account: https://twitter.com/BlockBeatsAsia