Bybit key compromise on 2025-02-21 ($1.5B reported)

Key compromise on Ethereum, 21 Feb 2025. Reported loss $1.5B. Last verified 26 Oct 2026.

critical
Reported loss
$1.5B
as reported by the sources
Recovered
$42.9M
as reported
Status
Unknown
updated 26 Oct 2026
Date
Ethereum

Summary

The FBI attributed the theft of about $1.5 billion in virtual assets from the exchange Bybit on 2025-02-21 to North Korean actors it calls TraderTraitor. Bybit said one Ethereum cold wallet lost 401,347 ETH plus staked ETH tokens after its Safe signing interface was spoofed, and reported $42.89 million of the funds frozen.

Protocol
Bybit
Type
Key compromise
Reported loss
$1,500,000,000 · as stated: 401,347 ETH plus 90,375 stETH, 15,000 cmETH and 8,000 mETH source: ic3.gov ↗
Recovered
$42,890,000 · as stated: $42.89 million frozen
curated history · updated 2026-10-26 15:28 UTC

Facts and where they come from

Approved facts and their primary sources
FactValueSource
DateFebruary 21, 2025ic3.gov ↗
Amount (USD)$1.5 billionic3.gov ↗
Amount401,347 ETH, 90,375 stETH, 15,000 cmETH, 8,000 mETH ($1.46 billion)bybit.com ↗
Recovered (USD)$42.89 million frozenbybit.com ↗
Causephishing that spoofed the Safe multisig UIbybit.com ↗
Cause forensicscredentials of a Safe developer were compromisedbybit.com ↗

Fund movements

51 listed addressesno data yet · source: Blockmetric Research

Addresses an official source lists for this incident, and what they moved since we track them (no history before an address was listed with us). A wallet that received funds is not labelled.

No priced moves of these addresses recorded since they were listed with us.

39 more listed addresses

Primary sources

Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-10-26.

Get the next one first

How we report incidents

LiveHyperliquid markets 5sOperationalHyperliquid positions & whales 3sOperationalLiquidation heatmap & levels 10sOperationalLighter markets & liquidations 15sOperationalLighter positions & heatmap 4sOperationalLighter RH positions & heatmap 5sOperationalBinance markets 2sOperationalBybit markets 24sOperationalBinance liquidations 15sOperationalBybit liquidations 15sOperationaldYdX positions & heatmap 3sOperationalGMX positions & heatmap 15sOperationalLong/short & open interest history 47sOperationalOrder books & trade flow 5sOperationalOn-chain transfers 3sOperationalSecurity monitor 52sOperationalBlockmetric Sentiment 8mOperationalOfficial news 1mOperationalAlert delivery 4sOperational10:20:05 UTCData: Blockmetric Research · Binance · Bybit