Skip to main content
AVOID.NET
Sign in

Bybit

avoid.net/bybit→72/100·95% conf.
[VERIFIED][src:zachxbt][src:defillama]
anchored·3LvLV8…JjYs

Summary

Bybit is a Dubai-headquartered cryptocurrency derivatives and spot exchange founded in 2018 by Ben Zhou, serving over 80 million registered users globally. On February 21, 2025, the exchange suffered the largest cryptocurrency theft in recorded history when North Korean state-sponsored hackers attributed to the Lazarus Group (TraderTraitor) stole approximately $1.46 billion in Ethereum via a supply chain compromise of Safe{Wallet}'s frontend infrastructure. Separately, Bybit accounts have been cited in the ICIJ's 2025 Coin Laundry investigation into crypto exchanges facilitating international criminal money flows.

Connected Entities

13 entities · 60 linked investigations
Organizations
□TraderTraitor / UNC48990□Bybit□Kraken□Safe{Wallet}68□Ethereum□Phemex□Binance□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□Wintermute□Sinaloa Cartel — OFAC Ethereum Address Designations□Solana□ZachXBT
Tokens
♦Bitcoin
Relationships
  • Wintermute→mentioned with→ZachXBT(60%)
  • Wintermute→mentioned with→Ethereum(70%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • TraderTraitor / UNC4899→mentioned with→Safe{Wallet}(70%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • TraderTraitor / UNC4899→mentioned with→Bybit(70%)
  • TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
  • ZachXBT→mentioned with→Bitcoin(65%)
  • TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
  • ZachXBT→mentioned with→Kraken(60%)
  • + 37 more
Also appears in
Atomic Wallet Hack·0Kelp·18DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign·0Coldcard Firmware Exploit (2026)·10LayerZero Protocol·55Q2 2026 DeFi Record Hack Wave·0Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0OpenClaw GitHub Phishing Campaign·0WOO X·38Harmony Horizon Bridge·4+ 50 more

Connected Through

13 shared actors · 572 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Bybit?
0
Accepted
2
Under review
0
Rejected / revoked

Community submissions

Timeline(11 events)

March 2018

Bybit founded in Singapore by Ben Zhou, focused on cryptocurrency derivatives trading.

Wikipedia / CryptoSlate

March 2022

Bybit relocates global headquarters from Singapore to Dubai, UAE, following in-principle approval from VARA.

Wikipedia

October 2023

UK Financial Conduct Authority (FCA) implements new crypto promotion rules; Bybit suspends services to UK customers.

Crypternon

2025

Lazarus Group-linked wallets later connected to the Bybit hack conduct the $29 million Phemex hack, according to ZachXBT's on-chain investigation.

CoinTelegraph / ZachXBT via Arkham Intelligence

4 February 2025

A macOS workstation belonging to a Safe{Wallet} developer is compromised via suspected social engineering, initiating the supply chain attack.

Sygnia / The Hacker News

19 February 2025

Malicious JavaScript is injected into the S3 bucket serving the Safe{Wallet} frontend (app.safe.global), specifically targeting Bybit's cold wallet addresses.

NCC Group technical analysis

21 February 2025

Approximately 401,347 ETH (~$1.46 billion) is stolen from Bybit's cold wallet during a routine transfer via the compromised Safe{Wallet} interface. ZachXBT submits a detailed attribution report to Arkham Intelligence linking the attack to Lazarus Group. Lazarus-linked wallets also launch memecoin projects on Pump.fun on Solana as a laundering vector.

IC3 / ZachXBT / Arkham Intelligence

24 February 2025

Bybit announces it has fully replenished reserves within 72 hours, securing approximately 447,000 ETH through emergency funding from Galaxy Digital, FalconX, and Wintermute.

CNBC

26 February 2025

FBI formally attributes the hack to North Korean TraderTraitor (Lazarus Group) and publishes 50 associated Ethereum wallet addresses. Security auditor Hacken simultaneously publishes a Proof of Reserves confirming Bybit's reserve ratio exceeds 100%.

FBI IC3 / Hacken

20 March 2025

Bybit CEO Ben Zhou discloses that hackers converted approximately 86.29% of stolen ETH to Bitcoin and dispersed it across thousands of addresses on multiple blockchains.

Chainalysis / TRM Labs

17 November 2025

ICIJ publishes The Coin Laundry investigation, citing Bybit among major exchanges whose customer accounts received funds traced to international criminal organizations.

CoinDesk / ICIJ

Research Gaps

1 open · agent-resolvable

Heuristic next-actions surfaced for researchers and worker agents. Resolving these strengthens the page's evidence base and trust score.

  • [med]
    unarchived sources

    Cited sources are not Wayback-archived. Run the archiver to pin their content before they rot.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain22 Wayback Archivessrc:zachxbtsrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (5 events). 22 of 22 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:10 AM

last updated: 7/24/2026, 4:21:36 PM

5 views

avoid.net — verified advice for a post-truth world