Bybit, a major cryptocurrency exchange, lost approximately $1.5 billion due to a significant security breach that occurred on February 21, 2025. This incident is widely regarded as the largest hack in cryptocurrency history. Here’s why it happened:
The loss stemmed from a sophisticated cyberattack targeting one of Bybit’s offline Ethereum (ETH) cold wallets, which are designed to securely store assets away from internet access. According to Bybit’s CEO, Ben Zhou, the attacker gained control of the wallet during a routine transfer to a "warm wallet" (used for active trading). The hackers exploited a vulnerability by manipulating the transaction process—specifically, they deceived the wallet signers through a masked user interface (UI). The UI appeared to show a legitimate transfer address, but the underlying smart contract logic was altered, allowing the attacker to redirect approximately 401,000 ETH, valued at around $1.5 billion, to an unidentified address.