Bybit Hack: $1.5B Stolen
February 21, 2025 · Ethereum · Lazarus Group
What was reported, and what we traced
ChainHint traced $1,405,761,732 out of the attacker address across 440 addresses and 683 transfers.
What happened
On February 21, 2025, Bybit suffered the largest crypto hack in history. Attackers — later attributed to North Korea's Lazarus Group — compromised Bybit's Ethereum cold wallet via a malicious multisig transaction, draining approximately $1.5 billion in ETH and stETH. The funds were immediately split across dozens of wallets and routed through mixers to obscure the trail.
How the funds moved
Initial Extraction
$1.5B drained from a Bybit cold wallet in a single malicious transaction. Funds split immediately across multiple intermediary addresses.
Layering via Mixers
ETH routed through Tornado Cash across multiple hops. Transactions batched in 100, 1,000 and 10,000 ETH denominations.
Distribution
Funds dispersed to 262+ addresses across 4+ hops. Approximately 20% of funds reached addresses flagged by Chainalysis sanctions. Trail extends to March 2025 and remains active.
Where the funds went
Read from the transfers in ChainHint's trace, not from press reports
ChainHint's trace of the Bybit hack follows 683 transfers across 440 addresses and 5 hops, between Feb 21, 2025 and Mar 3, 2025. The first hop out of the attacker's address moved ETH ($1.1B), stETH ($240M), cmETH ($43.4M), mETH ($23.2M). 18 of the transfers are DEX swaps.
Visualized attack path
440 addresses · 683 transfers · Traced with ChainHint
Key findings
Source Wallet
Primary Mixer
Deepest Trace
Attribution
Investigate your own incident
ChainHint traced the Bybit hack in seconds.
Use the same tool for your case.