Bybit Hack: $1.5B Stolen
February 21, 2025 · Ethereum · Lazarus Group
What was reported, and what we traced
ChainHint traced $1,402,292,384 out of the attacker address across 356 addresses and 833 transfers.
What happened
On February 21, 2025, Bybit suffered the largest crypto hack in history. Attackers — later attributed to North Korea's Lazarus Group — compromised Bybit's Ethereum cold wallet via a malicious multisig transaction, draining approximately $1.5 billion in ETH and stETH. The funds were immediately split across dozens of wallets and routed through mixers to obscure the trail.
How the funds moved
Initial Extraction
$1.5B drained from a Bybit cold wallet in a single malicious transaction. Funds split immediately across multiple intermediary addresses.
Layering via Mixers
ETH routed through Tornado Cash across multiple hops, as reported at the time.
Distribution
Funds dispersed across 4+ hops. The trail block below gives the first and last transfer this trace holds.
Where the funds went
Read from the transfers in ChainHint's trace, not from press reports
ChainHint's trace of the Bybit hack follows 833 transfers across 356 addresses and 6 hops, between Feb 21, 2025 and Jan 11, 2026. The first hop out of the attacker's address moved ETH ($1.1B), stETH ($240M), cmETH ($43.4M), mETH ($23.2M). 2 of the transfers are DEX swaps.
Visualized attack path
356 addresses · 833 transfers · Traced with ChainHint
Key findings
Source Wallet
Primary Mixer
Attribution
Investigate your own incident
ChainHint traced the Bybit hack in minutes.
Use the same tool for your case.