How the Biggest Crypto Heist in History Went Down

On the evening of February 21, Ben Zhou, CEO of the cryptocurrency exchange Bybit, sat down at his computer to approve what seemed like a standard transaction. The company was in the process of transferring a substantial amount of Ether, a widely used digital currency, from one account to another.

Half an hour later, Bybit’s chief financial officer called him. His voice was shaking as he delivered the alarming news—Bybit’s system had been breached.

“All the Ethereum is gone,” he said.

Unknowingly, when Zhou authorized the transfer, he had given hackers—allegedly backed by the North Korean government—access to the account, according to the FBI. The cybercriminals made off with $1.5 billion in cryptocurrency, making it the largest theft in the industry’s history.

The hackers exploited a fundamental vulnerability in Bybit’s security: its dependence on a widely available, free software tool. They infiltrated the exchange by manipulating a public system that was meant to protect vast sums of customer deposits. Despite the availability of more advanced security solutions, Bybit had continued to rely on this storage software, developed by a company called Safe, for years.

The breach sent shockwaves through the crypto market, triggering a steep decline in prices and shaking investor confidence at a critical moment. With the pro-crypto Trump administration in place, industry leaders were lobbying for regulatory reforms to encourage greater investment in digital assets. The timing of the hack was especially significant, as the White House had scheduled a “crypto summit” with President Trump and top industry figures for that Friday.

Security analysts were deeply concerned by what the attack revealed about Bybit’s safety measures. One cybersecurity firm, in its analysis of the breach, described the losses as “entirely preventable” and concluded that such an incident “should never have occurred.”

Safe’s storage system is widely used in the crypto world, but it is primarily suited for individual users rather than major exchanges handling billions in customer assets, explained Charles Guillemet, an executive at the French crypto security firm Ledger.

“This has to change,” he said. “It’s unacceptable in 2025.”

In the wake of the hack, Bybit scrambled to respond. Despite overseeing as much as $20 billion in customer funds, the company didn’t have enough Ether on hand to cover the $1.5 billion loss. Zhou, 38, moved quickly to stabilize operations, securing emergency loans from other firms and tapping into corporate reserves to handle the surge in withdrawal requests. On social media, he maintained a calm demeanor, stating just hours after the theft that his stress levels were “not too bad.”

As the crisis unfolded, Bitcoin—often seen as an indicator of the industry’s overall health—plummeted 20%, marking its sharpest decline since the collapse of FTX in 2022, the exchange formerly run by the disgraced mogul Sam Bankman-Fried.

In an interview this week, Zhou admitted that Bybit had received early warnings about potential issues with Safe. Three to four months before the attack, he said, the company had noticed compatibility problems between the software and one of its other security systems.

“We should have upgraded and moved away from Safe,” Zhou conceded. “We’re definitely making that a priority now.”

Rahul Rumalla, Safe’s chief product officer, responded in a statement, emphasizing that his team had since introduced new security features. He described Safe’s tools as “the treasury backbone for some of the largest organizations in the space.”

“Our goal isn’t just to fix this issue,” Rumalla stated, “but to ensure the entire industry learns from it so it doesn’t happen again.”

Bybit, founded in 2018, operates as a digital asset marketplace where traders and investors convert traditional currencies like the dollar or euro into Bitcoin and Ether. Many users treat platforms like Bybit as de facto banks, trusting them to safeguard their cryptocurrency holdings.

By some estimates, Bybit ranks as the world’s second-largest crypto exchange, processing tens of billions of dollars in transactions daily. Headquartered in Dubai, the platform does not serve U.S. customers.

On the night of February 21, Zhou was working from his home in Singapore when he and two other executives needed to sign off on a routine crypto transfer. In theory, these transactions should have been secure—Bybit’s system required multiple approvals to prevent unauthorized access.

However, unknown to them, hackers had already compromised Safe’s infrastructure. According to Bybit’s internal audit, the attackers had gained access by infiltrating a Safe developer’s computer. A person familiar with the matter revealed that this allowed them to insert malicious code, altering transaction processes.

A link sent via Safe prompted Zhou to approve the transfer. It was a trap. The moment he confirmed the transaction, control of the account shifted to the hackers, who siphoned off $1.5 billion in digital assets.

The massive outflows were immediately visible on the blockchain, the transparent ledger that records all crypto transactions. Analysts quickly traced the funds to the Lazarus Group, a notorious cybercrime syndicate linked to the North Korean government.

As soon as he learned what had happened, Zhou rushed to Bybit’s Singapore office to oversee the response. He publicly disclosed the hack on social media and initiated the company’s highest-level crisis protocol, known internally as P-1, which immediately alerted all key executives.

At around 1 a.m., Zhou went live on X (formerly Twitter), sipping a can of Red Bull. He reassured customers that Bybit remained solvent.

“Even if we never recover the stolen funds, all client assets are fully backed on a one-to-one basis,” he posted. “We can cover the loss.”

Despite his reassurances, panic spread. Within hours, nearly half of Bybit’s deposited digital assets—roughly $10 billion—had been withdrawn, sending the crypto market into freefall.

In an effort to mitigate the damage, other industry players stepped in to assist. Gracy Chen, CEO of rival exchange Bitget, lent Bybit 40,000 Ether—about $100 million—without requiring collateral or interest.

“We never doubted their ability to repay us,” Chen said.

Throughout the ordeal, Zhou continued providing real-time updates on X. At one point, he posted a screenshot from his health-tracking app, noting that his stress levels remained surprisingly stable.

“Too focused on leading all the meetings—forgot to stress,” he joked. “I think it’ll hit me later when I truly process what losing $1.5 billion means.”

Following the theft, the North Korean hackers quickly dispersed the stolen assets across a network of crypto wallets in an effort to obscure their tracks—a tactic they had used in previous heists.

“Lazarus Group is operating on an entirely different level,” venture investor Haseeb Qureshi commented on X.

Security specialists pointed to Bybit’s security lapses as a key factor in the breach. To approve the ill-fated transaction, Zhou had used a hardware device developed by Ledger, a leading crypto security firm. However, the device wasn’t fully integrated with Safe, preventing him from thoroughly verifying the transaction details before approval—a risky oversight in the crypto space.

“Safe just doesn’t provide the level of security controls necessary for frequent operational transfers,” explained Riad Wahby, a professor of computer engineering at Carnegie Mellon University and co-founder of the cybersecurity firm Cubist.

Reflecting on the breach, Zhou admitted regret over not acting sooner to strengthen Bybit’s defenses.

“There are a lot of things I wish I had done differently,” he said. “I should have paid more attention to this.”

Despite the crisis, Bybit managed to process all withdrawal requests within 12 hours. Shortly after, Zhou announced another major crypto transfer on X—this time, a legitimate one.

“This is a planned maneuver, FYI,” he wrote. “We are not hacked this time.”