inside the bybit hack
Shortly after midday UTC on Friday, the world’s second-largest crypto exchange, Bybit, was hacked for $1.4 billion. The exchange described the hack as a “manipulation of the transfer process in our ETH Multisig Cold Wallet during a planned, routine transfer.” Over 400,000 ETH were transferred to one unidentified wallet address (0x47666fab8bd0ac7003bce3f5c3585383f09486e2) as a result.
Over 500,000 ETH, stETH, and mETH worth more than $1.4 billion at the time of the hack were drained from Bybit’s wallets.
The exploit has been linked to the Lazarus Group by on-chain investigator ZachXBT, who was awarded a $30,000 bounty for his investigations. The group is now infamous in the crypto community for some of the largest hacks on record and is allegedly linked to North Korea.
The hackers transferred the funds between 3 p.m. and 4:30 p.m., with nearly all funds leaving their primary wallets shortly after the attack. The initial hacker’s wallet now contains just over $3 million worth of ETH.
The exploiter moved the funds in batches, choosing to split the stolen ETH into 40 separate 10k transactions. All non-ETH funds, which included stETH and mETH, were sent to a single other wallet. The stETH was then sent to other addresses with the objective of losing track of the funds along the chain.
However, it appears that only four of the Level 1 counterparty wallets—those that initially received ETH from the exploiter’s address—transferred funds to other wallets, known as Level 2 counterparties, to further distribute the stolen assets. By comparing the ETH received by Level 2 counterparties ($393M) to the total amount of ETH stolen ($1.12B), we can infer that over $700M in ETH remains in Level 1 wallets. These funds likely still belong to the exploiter and have remained untouched since two hours after the hack. Kaiko provides monitoring solutions for companies looking to track these addresses.
Overall, Kaiko identified 69 wallets directly owned by the hacker, 449 wallets used to distribute the stolen funds across the blockchain, and more than 1,600 others that have indirectly interacted with the exploiter’s known wallets since Friday’s hack. As some funds remain unmoved and efforts to freeze assets continue, the number of affected wallets is expected to grow in the coming days and weeks.
Short lived sell-off
BTC and ETH prices began to decline just before the hack was officially confirmed by Bybit. In the hours following the announcement, Bitcoin dropped by 3%, while Ethereum experienced a sharper 7% fall.
Over the weekend, ETH briefly rebounded above $2.8K, fueled by Bybit’s repurchase of ETH to replenish its reserves. However, it lost some of these gains by Monday, and it is difficult to predict how the market will evolve. The hackers have become the 14th largest ETH holder—surpassing both the Ethereum Foundation and ETH’s creator, Vitalik Buterin. This concentration of funds could weigh on ETH’s outlook in the medium term and potentially impact institutional demand.
Historically, crypto hacks have had a mixed impact on Bitcoin, which often benefits from safe-haven flows. Similarly, ETH has often reacted positively, rallying in the hours after past incidents like the Ronin Network, Poly Network, and Coincheck hacks.
Both BTC and ETH saw their worst post-hack performance following last week’s Bybit breach, which coincided with a broader shift toward risk-off sentiment in global markets and historically high levels of economic policy uncertainty. Concerns over U.S. economic growth intensified last week after a wave of economic data, driving the 10-year Treasury yield to near 2025 lows on Friday as investors sought refuge in bonds.
The price tells just one part of the story; looking at tick-trades data for the ETH-USDT pair reveals that there was heavy selling pressure after the illicit transfers were identified online. However, the pressure ramped up only after Bybit’s CEO confirmed the hack had occurred, more than an hour after the hack happened : This highlights that while blockchain data is publicly available, it doesn’t guarantee that signals—even for major events—are immediately recognized by the market. The delay in reaction underscores the persistence of information asymmetry.
The cumulative volume delta for this pair alone was negative $52 million in the first hour after Zhou announced the hack. There were several large sell orders around the time of the announcement, with one individual data point showing a $500,000 sell right around 3:44 PM on Friday.
Liquidity impact and outlook
Bybit’s liquidity took a severe hit following the hack, as market makers exited en masse. Despite this, the exchange’s crisis management and communication were well received by the crypto community.
Liquidity for BTC, ETH, and altcoins began deteriorating even before Bybit officially confirmed the hack. Between 1 PM and 10 PM (UTC) on February 21, the combined 1% market depth for BTC, ETH, and the top 50 altcoins by market cap plunged 59%, dropping from $68 million to $28 million, with altcoins experiencing the steepest decline.
By Monday morning, Bybit’s share of global crypto liquidity had halved from 5% to 2.6%, though market depth showed signs of stabilization in the early hours of Monday.
The impact on trading volumes was just as significant. While hourly trade volumes briefly spiked after the hack—likely due to the sell-off affecting ETH and other assets following the official announcement—daily volume on the exchange dropped to $1.4 billion over the weekend.
In the days following the hack, withdrawals soared past $5 billion as traders rushed to exit the exchange. Bybit’s market share of trading volume dropped from over 8% to just 3.2%. For the time being, it is unclear whether any other exchange has benefited from this decline.
Rapidly repricing risk
Beyond spot markets, we also witnessed a repricing of risk in the options space. Implied volatility spiked as the news broke. The IV on near-term expiries shot above longer-dated options, which is known as an inverted term structure and typically signifies a risk event in the short term.
As we can see below, though, the market continued to reprice risk throughout the weekend, and the kinked structure reverted by Monday.
If we zoom in on today’s expiry, we can see just how sharply sophisticated traders were reacting to the event. The chart below shows the evolution of IV with regard to strike price (known as skew or smile) for this expiration. The IV smile quickly skewed left as the news developed, signifying abundant bearish sentiment, as traders were willing to pay more for downside protection.
The IV smile for the Feb 28 expiry on Friday exhibited similar behavior but has since settled back into a more typical shape. In crypto options, a smile tends to prevail as prices can often rise or fall 40%, so options on either side tend to be expensive.
These longer-dated expirations reverting to normal suggest traders in these markets expect the worst is over and done.
It wasn’t just options markets that quickly reacted to the news of the hack, though. Perpetual futures markets on Bybit experienced a major shift on Friday post-hack announcement.
Open interest, the number of outstanding contracts, for ETH perps on the exchange fell nearly 18% from 2 p.m. to 7 p.m. The dramatic plunge in open positions was slightly lower than the tariff-driven tumult at the beginning of the month; however, it took place in a much shorter space of time.
Overall, this data shows that the market wasn’t pricing in a prolonged risk event in the wake of the largest-ever hack.
Second-order effects
Ethena’s synthetic dollar, USDe, briefly depegged, falling to 0.988 against USDC and 0.982 against USDT over concerns that the protocol had significant exposure to Bybit’s ETH derivatives market. USDe uses a delta-neutral strategy that involves taking short positions in perpetual futures to hedge against ETH price fluctuations and generate yield.
However, the depeg was short-lived, as Ethena Labs efficiently managed on-chain redemptions and reassured investors that all spot assets backing USDe were held in off-exchange custody solutions. Despite the quick recovery, the event triggered approximately $19 million in liquidations of (s)USDe on AaveV3, where the asset is widely used as collateral.
As mentioned earlier, ETH liquid staking derivatives (LSDs), namely stETH and mETH, were also part of the assets stolen by the hacker from Bybit, and so they experienced notable volatility, with stETH and mETH trading at a discount relative to ETH.
LSD liquidity across both centralized and decentralized platforms is relatively poor, making secondary markets inefficient for large exits and prone to volatility.
Over the past year, the top LSDs—stETH, cbETH, rETH, mETH, and (w)BETH—have averaged just $127 million in daily trading volume. While DEXs like Curve and Uniswap have traditionally served as key secondary markets, trading has been increasing on CEXs—namely Bybit and Bitget—since November. However, LSD liquidity on CEXs remains thin, with the average 1% market depth at just $50 million—seven times lower than ETH.
Although stETH continues to trade at a discount to ETH as of Monday morning, the deviation is limited relative to previous major market events such as the FTX collapse, with no big liquidation events occurring on major DeFi protocols.
