All You Need to Know About Bybit’s Hacking Incident

On February 21, 2025, Bybit, one of the world’s largest cryptocurrency exchanges, suffered a significant security breach during a cold-to-warm wallet transfer. The attack exploited a vulnerability in custody operations, allowing hackers to drain 401,000 ETH (valued at approximately $1.5 billion).

This theft triggered a 4% dip in Ethereum’s price, followed by a surge in withdrawal requests as Bybit users feared for their funds’ safety. The breach also raised concerns about custody security, compliance effectiveness, and transaction monitoring in the crypto space.

Global Efforts to Track and Recover the Stolen Funds

As the hack unfolded, authorities, blockchain forensic firms, and security teams mobilized to trace and recover the stolen assets. Using advanced on-chain analytics and wallet clustering, investigators began mapping how the stolen ETH was being laundered.

Blockchain forensic techniques quickly flagged suspicious wallet movements, revealing that the hackers were attempting to obfuscate transactions through multiple chains and mixing services. At this stage, Know Your Transaction (KYT) solutions became a vital tool in tracking the flow of stolen funds in real time.

Who Was Behind the Attack?

Blockchain forensic analysts and intelligence agencies quickly linked the hack to the North Korean cybercrime group, Lazarus Group. Known for their sophisticated cyberattacks on financial institutions and crypto platforms, Lazarus has been responsible for multiple high-profile crypto heists, including the Ronin Bridge and Harmony Horizon Bridge attacks.

Key Indicators Pointing to Lazarus Group:
✓ Use of Chain Hopping & Mixers: The stolen ETH was swiftly routed through Tornado Cash and other coin-mixing services to obscure its origins.
✓ Ties to Previously Compromised Wallets: Some wallet addresses linked to this attack had previous activity tied to state-sponsored hacking campaigns.
✓ North Korean Crypto Laundering Tactics: Funds were partially funneled through decentralized exchanges (DEXs) and over-the-counter (OTC) traders, aligning with Lazarus’s known laundering techniques.

As authorities, blockchain forensic firms, and security teams mobilized to trace and recover the stolen assets, KYT (Know Your Transaction) solutions and mETH Protocol’s security mechanisms played a vital role in tracking and partially reclaiming the hacked funds.

In the wake of the attack, the entire community including mETH Protocol, a liquid staking and restaking solution, identified and froze portions of the stolen ETH that had been moved into its ecosystem, was able to help recover $43 million.

But how was Bybit able to recover funds?

KYT (Know Your Transaction): A Critical Tool in Tracking Misappropriated Funds

KYT has emerged as one of the pivotal technologies helping to recover funds timely. Unlike KYC (Know Your Customer), which focuses on user identity verification, KYT analyzes transaction patterns to flag suspicious activity, such as:

• Suspicious large-volume transfers

• Detection and identification of  blacklisted and sanctioned wallet addresses

• Use of mixing services like Tornado Cash to obfuscate stolen funds

Following the Bybit hack, transaction tracking tools known as KYT solution have been instrumental in tracing stolen Ethereum, helping law enforcement map out laundering patterns and follow the hacker’s financial trail.

Key features of KYT in Fund Recovery:

• Real-time transaction analysis to detect anomalies.

• Risk scoring of wallet addresses interacting with stolen funds.

• Cross-chain tracking to follow assets as they are swapped between networks to evade detection.

How KYT and Blockchain Forensics Work Together in the Bybit Hack

Fund recovery efforts involve a combination of forensic tracking, KYT analytics, and legal action. The process includes:

1. Transaction Monitoring & On-Chain Surveillance

• Bybit and forensic teams use KYT-powered tracking to trace stolen ETH.

• KYT identifies fund mixing and suspicious cross-chain transfers.

• Secure HTTPS encryption ensures forensic investigations remain tamper-proof.

2. Blacklisting and Freezing Stolen Funds

• Exchanges, protocols, and regulatory agencies blacklist wallets associated with stolen assets.

• Institutional custody solutions (e.g., ChainUp) use time-locked withdrawals to prevent unauthorized mass exits.

3. Legal and Regulatory Action

• Bybit has filed reports with global financial crime units, requesting international freezing orders.

4. Cross-Chain Movement Tracking

• Hackers attempt to move ETH to Binance Smart Chain, Solana, and other networks.

• ChainUp’s AI-powered KYT solution continuously tracks these cross-chain transactions, preventing laundering.

The Role of ChainUp in Bybit's Recovery Efforts

How Can Victims Recover the Funds?

ChainUp’s KYT team are among those actively collaborating with Bybit and regulators to recover the stolen funds by enhancing real-time monitoring of the stolen Ethereum. Their solution offers:

• Advanced on-chain forensic tools that allow exchanges to trace assets across multiple blockchains.

• AI-driven insights that detect laundering behaviors, such as fund mixing or cross-chain transfers.

• Seamless reporting to law enforcement for faster response and action.

Additional Custody Security Features That Could Have Helped Prevent the Attack:

✓ Private Key Sharding & Encrypted Storage to prevent centralized key theft

✓ Time-locked withdrawals requiring extended approval windows

✓ Hash comparison for front-end validation to stop fraudulent transactions

Conclusion: Why KYT is Crucial for Crypto Exchanges

The Bybit hack is a stark reminder that even the largest exchanges need robust KYT systems to monitor transactions and prevent large-scale theft. 

However, KYT alone isn’t enough. Exchanges must also enforce:

✓ Time-locked withdrawals with strict multi-signature controls to prevent instant unauthorized transfers
✓ Front-end validation (hash comparison) to ensure all transactions match security policies
✓ Private key sharding to remove single points of failure in wallet approvals

KYT is not just a regulatory tool—it’s a critical component for protecting user assets and maintaining trust in the digital asset space. Exchanges looking to enhance their compliance and security posture should integrate both real-time KYT monitoring and institutional-grade custody security to safeguard their operations.

As part of our commitment to the crypto community and to aid in the recovery of stolen funds, ChainUp Custody and Know-Your-Transaction (KYT) platform Trustformer have integrated Bybit's blacklisted address API, ensuring that all clients utilizing its custody services will receive comprehensive support in preventing deposits of the stolen assets. We are able to provide a data feed of illicit addresses linked to this exploit, available via API or CSV.