- Bybit launches a $140M bounty program after a $1.4B hack by Lazarus Group.
- Recovery efforts yield $43M in cmETH tokens, marking progress in Bybit’s $1.4B hack.
- Tether freezes $181K in USDT linked to Bybit’s $1.4B hack as recovery continues.
Bybit, the world’s second-largest cryptocurrency exchange by trading volume, has introduced a Recovery Bounty Program following a massive security breach on February 21, 2025. The initiative offers 10% of recovered funds, potentially up to $140 million, to ethical cybersecurity experts and blockchain analysts who assist in retrieving assets stolen in the incident. The record-breaking crypto theft in history resulted in the theft of $1.4 billion in cryptocurrencies, mostly Ether, which was lost.
Bybit reacted immediately upon discovering the hack by securing its systems and engaging with industry experts to prevent additional damage. CEO Ben Zhou of Bybit asserted that the stolen funds mainly included staked Ether (ETH) and other ERC-20 tokens stored in an Ethereum cold wallet. However, the company managed to handle over 350,000 withdrawal requests within a few hours after the massive loss while maintaining its operational capabilities for its users.
Industry Unites to Combat Lazarus Group’s Attack
Through this exchange program, the organization seeks to utilize worldwide crypto expertise to track down stolen funds. Bybit’s CEO, Ben Zhou announced the program launch while stressing his commitment to working with industry partners.
Blockchain investigators, including ZachXBT and Arkham Intelligence, linked the attack to the North Korean-affiliated Lazarus Group. This group, known for high-profile hacks like the Ronin Bridge and Harmony Horizon incidents, moved 10,000 ETH, worth $27 million, to a wallet labeled “Bybit Exploiter 54” on February 22, 2025. Analysts tracked the funds across 53 wallets revealing active laundering attempts through mixers like eXch and bridges like ChainFlip.
Crypto operators from different sectors supplied their backing. Bitget moved 40,000 ETH funds worth $105 million from its reserve accounts to strengthen Bybit’s cash flow operations. Tether froze USDT funds worth $181,000 linked to the hack, while Chainalysis, Zero Shadows and other firms offered investigation and tracking assistance. The industry shows its commitment to fighting skilled threats through joint defense operations.
Recovery Efforts Yield Early Results Amid Ongoing Challenges
Mantle’s mETH Protocol implemented recovery measures successfully by recovering 15,000 cmETH tokens worth $43 million on February 22, 2025. Recently, Bybit spent $100 million USDT to purchase 36,893 ETH at $2,711 per ETH through over-the-counter trades with Galaxy Digital and FalconX, bolstering liquidity.
Furthermore, After the crisis, Bybit received high praise when former Binance CEO Changpeng Zhao acknowledged Zhou’s transparent communication approach. Auditor Hacken also confirmed that the exchange holds bridge loans which cover losses while maintaining reserves that exceed liabilities.
However, challenges persist. The cyber attack caused a total outflow of $5.5 billion which included stolen money and mass withdrawal of user funds. Bybit remains active in investigating the cause of the breach, with a primary focus on security weaknesses in its Safe Cold Wallet system. Zhou disclosed conferring with the Ethereum Foundation about blockchain solutions, but no decision regarding rollback occurred because of the complexity and necessary community support.
