Ark Invest: Amazon Is Upgrading To Alexa+ With Generative AI, & More
Around 10:30am on February 21, Bybit Co-Founder Ben Zhou announced on X that, during a routine internal transfer among internal addresses, ~$1.5 billion in ETH tokens6 were hacked from one of the exchange’s cold wallets. On-chain forensic analysis quickly determined that Lazarus group, the North Korean, state-sponsored hacking and criminal organization, perpetrated the attack.
Ben Zhou assured users immediately that Bybit’s balance sheet could and would cover all losses. Even so, based on a foreboding sense of déjà vu, many users withdrew their funds from the platform: Bybit processed more than 300,000 user withdrawal orders7 in the first 48 hours. With the support of bridge loans from Mirana Ventures and other industry exchanges, Bybit honored every withdrawal request, reinforcing confidence in its solvency.
The crypto industry has rallied around Bybit, as stablecoin issuers, on/off-ramps, exchanges, brokers, bridges, and applications have blacklisted, frozen, or blocked funds linked to the hack. Many decentralized protocols have rushed to their DAOs (Decentralized Autonomous Organizations), proposing and passing new governance to enable the new security measures.
A week after the hack, the stolen funds now are scattered across hundreds of wallets, with more than $600 million bridged to the Bitcoin network,8 as shown below.
Source: Zhou 2025.9 For informational purposes only and should not be considered investment advice or a recommendation to buy, sell, or hold any particular security or cryptocurrency.
Bybit has announced the largest bounty in history, a 10% reward10 for the return of stolen funds, though a significant portion of the funds probably will be dormant for months or years. No one knows what percent of the stolen assets will be recovered, but everyone knows that the digital asset industry is a prime target for the Lazarus Group and North Korea’s nuclear program. We hope the incident provides both centralized and decentralized exchanges with valuable insights that will help them enhance security and operational resilience and defend against such highly sophisticated attacks.
