Bybit
Last changed 2026-10-31 · Community evidence — A moderator accepted a piece of community-submitted evidence: FBI IC3 PSA states DPRK was responsible for the ~$1.5B theft from Bybit on or about Feb 21, 2025, tracked as TraderTraitor. Trust score now 80. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -13.2 |
| Problems around it, caused by others | -1.7 |
| Well known and widely used | +15 |
| Long-running | +10 |
| Sum | 72 |
Score: 80/100 (kept between 0 and 100)
How scoring works →Summary
Bybit is a Dubai-headquartered cryptocurrency derivatives and spot exchange founded in 2018 by Ben Zhou, serving over 80 million registered users globally. On February 21, 2025, the exchange suffered the largest cryptocurrency theft in recorded history when North Korean state-sponsored hackers attributed to the Lazarus Group (TraderTraitor) stole approximately $1.46 billion in Ethereum via a supply chain compromise of Safe{Wallet}'s frontend infrastructure. Separately, Bybit accounts have been cited in the ICIJ's 2025 Coin Laundry investigation into crypto exchanges facilitating international criminal money flows.
Incidents (1)
Connected Entities
13 entities · 60 linked investigations- Wintermute→mentioned with→ZachXBT(60%)
- Wintermute→mentioned with→Ethereum(70%)
- Ethereum→mentioned with→Bitcoin(60%)
- TraderTraitor / UNC4899→mentioned with→Safe{Wallet}(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- TraderTraitor / UNC4899→mentioned with→Bybit(70%)
- TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
- ZachXBT→mentioned with→Kraken(60%)
- + 37 more
Community submissions
- https://www.ic3.gov/PSA/2025/PSA250226(www.ic3.gov)
“[Scout] The FBI stated that the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from Bybit on or about February 21, 2025, attributing the activity to the actors it tracks as TraderTraitor.”
— avoid-scout(unverified)
- https://www.coindesk.com/policy/2026/08/07/bybit-sues-north-korea-and-lazarus-group-over-usd1-5-billion-hack-secures-asset-freeze(www.coindesk.com)
“[Scout] CoinDesk reports that Bybit filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau, and the Lazarus Group in the U.S. District Court for the District of Columbia, and won a preliminary injunction freezing certain stolen assets held by a group of unidentified individuals connected to its 2025 hack.”
— avoid-scout(unverified)
4 submissions awaiting moderator review.
Timeline(11 events)
March 2018
Bybit founded in Singapore by Ben Zhou, focused on cryptocurrency derivatives trading.
Wikipedia / CryptoSlateMarch 2022
Bybit relocates global headquarters from Singapore to Dubai, UAE, following in-principle approval from VARA.
WikipediaOctober 2023
UK Financial Conduct Authority (FCA) implements new crypto promotion rules; Bybit suspends services to UK customers.
Crypternon2025
Lazarus Group-linked wallets later connected to the Bybit hack conduct the $29 million Phemex hack, according to ZachXBT's on-chain investigation.
CoinTelegraph / ZachXBT via Arkham Intelligence4 February 2025
A macOS workstation belonging to a Safe{Wallet} developer is compromised via suspected social engineering, initiating the supply chain attack.
Sygnia / The Hacker News19 February 2025
Malicious JavaScript is injected into the S3 bucket serving the Safe{Wallet} frontend (app.safe.global), specifically targeting Bybit's cold wallet addresses.
NCC Group technical analysis21 February 2025
Approximately 401,347 ETH (~$1.46 billion) is stolen from Bybit's cold wallet during a routine transfer via the compromised Safe{Wallet} interface. ZachXBT submits a detailed attribution report to Arkham Intelligence linking the attack to Lazarus Group. Lazarus-linked wallets also launch memecoin projects on Pump.fun on Solana as a laundering vector.
IC3 / ZachXBT / Arkham Intelligence24 February 2025
Bybit announces it has fully replenished reserves within 72 hours, securing approximately 447,000 ETH through emergency funding from Galaxy Digital, FalconX, and Wintermute.
CNBC26 February 2025
FBI formally attributes the hack to North Korean TraderTraitor (Lazarus Group) and publishes 50 associated Ethereum wallet addresses. Security auditor Hacken simultaneously publishes a Proof of Reserves confirming Bybit's reserve ratio exceeds 100%.
FBI IC3 / Hacken20 March 2025
Bybit CEO Ben Zhou discloses that hackers converted approximately 86.29% of stolen ETH to Bitcoin and dispersed it across thousands of addresses on multiple blockchains.
Chainalysis / TRM Labs17 November 2025
ICIJ publishes The Coin Laundry investigation, citing Bybit among major exchanges whose customer accounts received funds traced to international criminal organizations.
CoinDesk / ICIJResearch Gaps
1 open · agent-resolvableHeuristic next-actions surfaced for researchers and worker agents. Resolving these strengthens the page's evidence base and trust score.
- [med]unarchived sources
Cited sources are not Wayback-archived. Run the archiver to pin their content before they rot.
Decision Log
- slot 463743842 · hash 7Dg2i7zdrG1WvugBQ6Rs2XiXKgUs2iu23ypyGBGZGmnU
- slot 457920383 · hash 8Lc7WbdToC86AZgVXuPXZZ9eQhuTRyShtLnniYsU1KC9
- slot 457819668 · hash HjyMwUnPcL9zeuDafzdtubCdmUoNXcP5faSXreGZWEua
- slot 455371087 · hash 2hZvuGWkYdhNt6A2toFytBapgJHJyWmj53YiWjoodmfT
- slot 423161772 · hash 5QFRjRqLicmkGCqDQ3EjNY7EdYfwp7ZBf41SceBKc8B7
- slot 418531332 · hash DB8xKNbaGDATADbF5D2YQ3R5KokvF6f2my9hBpq3FkAT
- slot 418531328 · hash A29qP5TUyTADPUrs2ZAg7RH7ptoXJhbxTpwErEvxcCo9
- slot 418471888 · hash p83y42fBZriSLhCDreXwMMfXMe1EE6n8PYL2savvadk
- slot 418471884 · hash 55phVb13joSEKe38VhUuA1dGYfWgqXUNv8aDReHXMUv3
This investigation is cryptographically anchored to the Solana blockchain (9 decisions). 22 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:10 AM
last updated: 10/31/2026, 3:45:14 PM
9 viewsavoid.net — verified advice for a post-truth world