An analysis of the $1.46B Bybit hack, by far the largest crypto heist of all time, ahead of Poly Network's $611M in 2021, and possibly the biggest theft ever
On February 21st 2025, approximately $1.46 billion in cryptoassets were stolen from Bybit, a Dubai-based exchange.
Context & Ripple Effects
The analysis follows reports of suspicious outflows from Bybit and confirmation that control of a cold Ethereum wallet had been compromised. It places the loss above Poly Network’s 2021 theft, making scale—not merely the incident itself—the central development.
A subsequent attribution claim tied the breach to North Korea’s Lazarus Group, connecting the event to earlier coverage of major crypto thefts involving North Korea-linked actors. The incident therefore tests whether exchanges’ custody protections are keeping pace with the value concentrated in their wallets.
First-order effects
- Bybit faces an immediate custody-security and credibility crisis after the loss of roughly $1.46 billion in cryptoassets from a cold wallet.
- The breach resets the benchmark for a single crypto theft, overtaking Poly Network’s $611 million incident and concentrating attention on the safeguards around exchange-held assets.
Second-order effects
- Other exchanges and custody providers face pressure to reassess cold-wallet controls, approval processes, and incident-response readiness as customers compare counterparty risk.
- Security researchers, blockchain-tracing firms, and law-enforcement partners gain a more consequential role in identifying and following stolen assets after the reported Lazarus attribution.
Third-order effects
- If record-scale exchange breaches persist, crypto platforms’ ability to win mainstream trust will depend increasingly on demonstrable custody resilience rather than trading features alone.
- The episode reinforces the crypto legitimacy gap: a market built around transferable assets remains exposed when a small number of institutional wallets concentrate exceptionally large balances.
The trend: The Bybit breach is a major data point in the continuing escalation of crypto-security risk, where increasingly valuable centralized custody pools attract sophisticated attackers.