Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #1[disputed][awaiting moderator]in the timeline

   “Bybit founded in Singapore by Ben Zhou, focused on cryptocurrency derivatives trading.”

   reviewerBybit was founded in Singapore in March 2018The timeline entry misstates the founding location as Singapore; both the page's own cited Wikipedia source and independent reporting place the founding in Shanghai, China, with Singapore only becoming the base after a 2021 relocation.
   Proposed correction (not yet applied)

   Bybit founded in Shanghai, China by Ben Zhou, focused on cryptocurrency derivatives trading.
   citeden.wikipedia.org/wiki/Bybit
2. #2[disputed][awaiting moderator]in section: Attribution — North Korea Lazarus Group (TraderTraitor)

   “The same investigation linked the Bybit attacker wallets to the approximately $73 million Phemex hack that occurred in January 2025.”

   reviewerThe Phemex hack linked to the same attacker wallets was approximately $73 millionThis section's $73 million figure contradicts the page's own cited CoinTelegraph source, which gives $29 million — the same figure the page itself uses in timeline[3]. The page is internally inconsistent and the higher figure is unsupported by its own citation (separate, unrelated reporting put the overall January 2025 Phemex hack total at $69–$85 million, but that total is not what ZachXBT's wallet-linkage reporting attributes to the Bybit attackers).
   Proposed correction (not yet applied)

   The same investigation linked the Bybit attacker wallets to the approximately $29 million Phemex hack that occurred in January 2025.
   citedcointelegraph.com/news/bybit-hackers-sol…in-scams-zachxbt
3. #3[disputed][awaiting moderator]in section: Attribution — North Korea Lazarus Group (TraderTraitor)

   “The FBI published 50 Ethereum wallet addresses connected to the theft and requested that RPC node operators, exchanges, and blockchain analytics firms block related transactions.”

   reviewerThe FBI published 50 Ethereum wallet addresses connected to the theftMinor but checkable numeric error against the primary cited government source.
   Proposed correction (not yet applied)

   The FBI published 51 Ethereum wallet addresses connected to the theft and requested that RPC node operators, exchanges, and blockchain analytics firms block related transactions.
   citedwww.ic3.gov/psa/2025/psa250226

No source the reviewer could reach confirms or contradicts the claim.

1. #7[unverifiable][awaiting moderator]in section: Exchange Response and Solvency

   “Critically, Bybit did not impose a withdrawal freeze at any point during or after the incident, though the exchange acknowledged processing delays of several hours for some users amid a surge of over $4 billion in withdrawal requests within the first 12 hours.”

   reviewerBybit saw a surge of over $4 billion in withdrawal requests within the first 12 hoursThe no-withdrawal-freeze claim is corroborated elsewhere, but the specific $4 billion/12-hour figure could not be confirmed from any accessible source.
   citedwww.cnbc.com/2025/02/24/bybit-replenishe…illion-hack.html
2. #8[unverifiable][awaiting moderator]in section: Exchange Response and Solvency

   “CEO Ben Zhou publicly addressed users within approximately 30 minutes of the breach via a live-streamed Q&A, providing daily updates.”

   reviewerBen Zhou publicly addressed users within approximately 30 minutes of the breach via a live-streamed Q&AThe livestream and daily-updates practice are corroborated, but the precise 30-minute response time could not be independently confirmed.
   citedwww.cnbc.com/2025/02/24/bybit-replenishe…illion-hack.htmlfinance.yahoo.com/news/bybit-ceo-declare…s-075657067.html

The claim was accurate when written but events since have overtaken it.

1. #4[stale][awaiting moderator]in section: Regulatory Status and Jurisdiction Restrictions

   “The exchange remains blocked or restricted in multiple jurisdictions, including the United States, Canada, mainland China, Hong Kong, and France.”

   reviewerBybit remains blocked or restricted in FranceBybit did suspend/exit French services in 2024–2025 and was blacklisted by the AMF, but by the time of this report (with the May 2025 Austrian MiCAR license covering the EEA and removal from the AMF blacklist in Feb 2025), France is serviced through Bybit EU rather than being a currently blocked jurisdiction. The claim is stale and contradicted by the page's own cited source.
   Proposed correction (not yet applied)

   The exchange remains blocked or restricted in multiple jurisdictions, including the United States, Canada, mainland China, and Hong Kong; French users, who lost access to Bybit's global platform in January 2025, are now served through the MiCAR-licensed Bybit EU entity following Bybit's removal from the French AMF's blacklist in February 2025.
   citedwww.datawallet.com/crypto/bybit-restricted-countries

The cited evidence supports part of the claim but not all of it.

1. #5[partially supported][awaiting moderator]in section: Attribution — North Korea Lazarus Group (TraderTraitor)

   “By March 20, 2025, Bybit CEO Ben Zhou disclosed that hackers had converted approximately 86.29% of the stolen ETH into Bitcoin and dispersed it across thousands of addresses.”

   reviewerBy March 20, 2025, Ben Zhou disclosed hackers had converted approximately 86.29% of stolen ETH to BitcoinThe underlying figure appears accurate based on independent reporting of Zhou's own March 20, 2025 statement, but none of the sources actually cited for this section substantiate it; the claim is correct but miscited.
   citedwww.trmlabs.com/resources/blog/the-bybit…-largest-exploitwww.chainalysis.com/blog/bybit-exchange-…o-security-dprk/
2. #6[partially supported][awaiting moderator]in section: Attribution — North Korea Lazarus Group (TraderTraitor)

   “one address bridged $1.08 million in USDC from the stolen ETH to Solana and launched a token called QinShihuang, which recorded over $26 million in trading volume”

   reviewerA Lazarus-linked wallet bridged $1.08 million in USDC to Solana and launched a token called QinShihuang with over $26 million in trading volumeThe specific token name and $26M figure are accurate per other reporting (Forklog, Cryptopotato) but are not found in any of the three sources the page cites for this paragraph.
   citedcointelegraph.com/news/bybit-hackers-sol…in-scams-zachxbtthecoinomist.com/personalities/zachxbt-j…eally-behind-it/

The cited evidence supports the claim as written.

1. #9[confirmed][no action needed]in section: Exchange Response and Solvency

   “Within 72 hours of the hack, Bybit replenished nearly 447,000 ETH through emergency arrangements with trading firms including Galaxy Digital, FalconX, and Wintermute.”

   reviewerWithin 72 hours of the hack, Bybit replenished nearly 447,000 ETH via Galaxy Digital, FalconX, and WintermuteFigure and counterparties corroborated within rounding by independent on-chain reporting.
   citedwww.cnbc.com/2025/02/24/bybit-replenishe…illion-hack.html
2. #10[confirmed][no action needed]in section: Exchange Response and Solvency

   “On February 26, 2025 — five days after the hack — security auditor Hacken published a Proof of Reserves verification confirming Bybit's reserve ratio exceeded 100%, indicating that user liabilities were fully backed.”

   reviewerOn February 26, 2025, Hacken published a Proof of Reserves verification confirming Bybit's reserve ratio exceeded 100%Matches the cited source.
   citedhacken.io/case-studies/bybit-proof-of-reserves/
3. #11[confirmed][no action needed]in section: Exchange Response and Solvency

   “Ben Zhou also launched a bounty program offering up to $140 million for information leading to the tracing or freezing of stolen funds.”

   reviewerBen Zhou launched a bounty program offering up to $140 millionConfirmed by multiple independent outlets.
   citedfinance.yahoo.com/news/bybit-ceo-declare…s-075657067.html
4. #12[confirmed][no action needed]in section: Overview and Background

   “Bybit was originally incorporated in the British Virgin Islands, but that entity was dissolved in July 2023.”

   reviewerBybit was originally incorporated in the BVI and that entity was dissolved in July 2023Confirmed against the BVI regulator's own statement; the same claim also appears, consistently, in sections[5].
   citeden.wikipedia.org/wiki/Bybit
5. #13[confirmed][no action needed]in section: ICIJ Coin Laundry Investigation — Criminal Money Flow Allegations

   “In November 2025, the International Consortium of Investigative Journalists (ICIJ) published The Coin Laundry, a 10-month investigation by more than 100 journalists from 37 news organizations across 35 countries.”

   reviewerICIJ's Coin Laundry was a 10-month investigation by more than 100 journalists from 37 news organizations across 35 countriesMatches the cited primary source closely.
   citedwww.icij.org/investigations/coin-laundry…-cryptocurrency/
6. #14[confirmed][no action needed]in section: ICIJ Coin Laundry Investigation — Criminal Money Flow Allegations

   “The ICIJ did not provide granular transaction data specific to Bybit, and the investigation does not allege that Bybit itself operated these accounts or was complicit in the criminal activity.”

   reviewerScam-linked funds were sent to accounts at Bybit and other named exchanges, without allegation of Bybit complicityAccurately and carefully characterizes a limited citation rather than overstating it.
   citedprotos.com/binance-okx-htx-bybit-kraken-…icij-scam-probe/
7. #15[confirmed][no action needed]in section: Regulatory Status and Jurisdiction Restrictions

   “In May 2025, Bybit obtained a full EU MiCAR license in Austria, and in October 2025, it received a UAE Securities and Commodities Authority (SCA) license.”

   reviewerIn May 2025 Bybit obtained a full EU MiCAR license in Austria, and in October 2025 a UAE SCA licenseBoth licensing claims independently confirmed with matching months.
   citedbrokerchooser.com/safety/bybit-broker-safe-or-scam
8. #16[confirmed][no action needed]in section: Regulatory Status and Jurisdiction Restrictions

   “In October 2023, the UK’s Financial Conduct Authority (FCA) imposed new rules on crypto promotions, which led Bybit to suspend services to UK customers; Bybit subsequently relaunched UK services in December 2025 under FCA-compliant arrangements.”

   reviewerUK FCA rules in October 2023 led Bybit to suspend UK services; Bybit relaunched UK services in December 2025Confirmed, though the page could note Bybit relies on a third-party FCA-authorized firm (Archax) rather than holding its own UK license.
   citedcrypternon.com/en/bybit-uk-ban/
9. #17[confirmed][no action needed]in section: Industry and Policy Implications

   “A 2024 United Nations Panel of Experts report estimated that DPRK-linked groups stole over $3 billion in cryptocurrency between 2017 and 2023, a figure that does not include the 2025 Bybit theft.”

   reviewerA 2024 UN Panel of Experts report estimated DPRK-linked groups stole over $3 billion in cryptocurrency between 2017 and 2023Matches independent reporting on the UN report.
   citedwww.csis.org/analysis/bybit-heist-and-fu…rypto-regulation
10. #18[confirmed][no action needed]in section: Overview and Background

    “Bybit was founded in March 2018 by Ben Zhou, an entrepreneur with a prior background as General Manager for Greater China at forex broker XM (2010–2017).”

    reviewerBybit founded in March 2018 by Ben Zhou, formerly XM Greater China General Manager (2010-2017)Confirmed against cited source.
    citedcryptoslate.com/people/ben-zhou/
11. #19[confirmed][no action needed]in the summary

    “North Korean state-sponsored hackers attributed to the Lazarus Group (TraderTraitor) stole approximately $1.46 billion in Ethereum via a supply chain compromise of Safe{Wallet}'s frontend infrastructure.”

    reviewerFebruary 21, 2025 hack: ~401,347 ETH (~$1.46 billion) stolen via Safe{Wallet} compromiseWidely corroborated across primary (FBI) and technical (Sygnia) sources; the $1.46B figure is within the commonly reported $1.4-1.5B range given ETH price fluctuation.
    citedwww.ic3.gov/psa/2025/psa250226thehackernews.com/2025/02/bybit-hack-tra…llet-supply.html
12. #20[confirmed][no action needed]in section: February 2025 Hack — $1.46 Billion Ethereum Theft

    “The attack was a sophisticated supply chain compromise: a macOS workstation belonging to a Safe{Wallet} developer was compromised on or around February 4, 2025, via a suspected social engineering vector involving a malicious Docker project that initiated outbound traffic to the domain getstockprice[.]com.”

    reviewerThe attack chain: macOS workstation compromised ~Feb 4, 2025 via a malicious Docker project contacting getstockprice[.]com; tampered JS last modified Feb 19, 2025Confirmed via Sygnia (one of six sources cited for this section); NCC Group's report (also cited) does not itself contain these specific details, so not every citation in the source list independently supports every sentence, but the underlying claim is well-documented in the broader cited set.
    citedwww.sygnia.co/blog/sygnia-investigation-bybit-hack/www.nccgroup.com/research/in-depth-techn…-the-bybit-hack/
13. #21[confirmed][no action needed]in the summary

    “serving over 80 million registered users globally”

    reviewerBybit reported over 80 million registered users as of late 2025Matches the company's self-reported figure; no independent third-party verification of exact user count exists, which is typical for exchange user-count claims industry-wide.
    citeden.wikipedia.org/wiki/Bybit