Bybit Closes $1.4B ETH Gap After Lazarus Hack, Thanks to United Crypto Community Efforts

Leading cryptocurrency exchange Bybit faced one of the most significant security breaches in recent history, with hackers stealing approximately 401,346 ETH (worth around $1.4 billion) on February 21, 2025. However, through rapid industry-wide collaboration and a series of coordinated efforts, Bybit has managed to recover a substantial portion of the stolen funds and stabilize its platform.

The Hack and Immediate Response

Following the breach, the crypto industry mobilized to track and freeze illicitly obtained assets. Several key players took immediate action:

• Tether (USDT): Flagged and froze 181,000 USDT linked to the hacker’s address.
• THORChain: Implemented security measures to prevent unauthorized transactions.
• ChangeNOW: Froze 34 ETH suspected of being part of the stolen funds.
• FixedFloat: Froze 120,000 USDC and USDT in an effort to mitigate further losses.

In total, $42.89 million was frozen within a single day, highlighting the efficiency of the cryptocurrency community in responding to security threats.

mETH Protocol’s Role in Fund Recovery

One of the most crucial elements of Bybit’s recovery came through the mETH Protocol team, which successfully recovered 15,000 cmETH tokens valued at approximately $43 million. Their quick action played a pivotal role in reducing the financial impact of the hack.

Bybit's Strategy to Close the Gap

Bybit CEO Ben Zhou announced that the exchange has fully replaced the $1.4 billion worth of Ether stolen in the attack. A new audited Proof of Reserves (PoR) report will be published soon, verifying that Bybit’s client assets are back at a 1:1 ratio through a Merkle tree verification system.

To restore its financial stability, Bybit secured approximately 446,870 ETH ($1.23 billion) through a combination of loans, whale deposits, and strategic ETH purchases. This move significantly narrowed the gap caused by the attack.

According to Lookonchain, Bybit-linked wallet “0x2E45...1b77” purchased 157,660 ETH ($437.8 million) from crypto investment firms Galaxy Digital, FalconX, and Wintermute via over-the-counter (OTC) deals.

Additionally, another $304 million worth of ETH was purchased using wallet “0xd7CF...A995” through centralized and decentralized exchanges. These transactions were tracked using Arkham Intelligence, showing interactions with Binance and MEXC hot wallets.

Proactive Security Measures and Industry Collaboration

Bybit and its partners have taken additional steps to enhance security and prevent future breaches:

• The pump.fun team helped block and remove a Solana-based token linked to potential hacker groups.
• Bybit reinforced security awareness by warning users about scammers impersonating Bybit employees.
• The exchange encouraged users to verify official communication channels to avoid phishing attacks.

Conclusion: A Resilient Recovery

Despite suffering one of the largest cryptocurrency exchange hacks in history, Bybit’s rapid coordination with blockchain security firms, liquidity providers, and industry stakeholders has allowed it to recover much of the stolen assets. The freezing of millions in stolen funds, strategic ETH acquisitions, and upcoming Proof of Reserves audit have helped rebuild trust within the crypto community.

The $1.4 billion hack was the largest in crypto history, accounting for over 60% of all crypto funds stolen in 2024. Bybit’s ability to bounce back from this crisis underscores the growing sophistication of security measures within the industry. Moving forward, exchanges must continue prioritizing security, collaboration, and transparency to maintain user confidence in the evolving crypto landscape.