Bybit restores nearly half of Ether reserves following $295M OTC purchase

Cryptocurrency firm Bybit has restored nearly half of its Ether (ETH) reserves after a massive crypto hack that rattled the global Web3 industry.

Recently, the exchange suffered a breach involving over $1.5 billion worth of liquid-staked Ether, Mantle Staked ETH, and other ERC-20 tokens, marking the largest crypto theft in history.

Within just two days of the attack, Bybit replenished nearly 50% of its Ether reserves, according to data from CryptoQuant.

Bybit recovers reserves as industry rallies to support the exchange

As of 8:52 am UTC, Bybit held over 201,600 Ether (ETH), recovering more than 45% of its pre-hack reserves. Before the $1.5 billion breach on February 21, the exchange had 439,000 ETH, temporarily plummeting to just 61,000 ETH.

A significant portion of Bybit’s replenished reserves comes from spot purchases. Since the exploit, the exchange has acquired 106,498 ETH—worth approximately $295 million—through over-the-counter (OTC) trades, according to a February 23 post by crypto intelligence platform Lookonchain.

Crypto industry leaders and exchanges also rushed to assist Bybit with emergency transfers, including 50,000 Ether from Binance, 40,000 Ether from Bitget, and 10,000 Ether from Du Jun, co-founder of HTX Group, among others.

Bybit’s ability to restore its reserves while continuing to process user withdrawals signals strong trust in the exchange, especially after enduring the largest hack in crypto and financial history.

Within just 10 hours of the exploit, Bybit handled over 350,000 withdrawal requests, successfully completing 99.9% of them by 1:45 am UTC, according to a February 22 post by co-founder and CEO Ben Zhou.

The crypto industry has provided Bybit with $390 million worth of Ether in emergency loans and transfers to help stabilize its reserves. Since the hack, the exchange has received a total of 145,000 ETH, including $127 million from Binance-based whales and over $53 million from a single whale wallet, according to a February 22 post by Lookonchain.

Still, DefiLlama data shows that Bybit’s total asset value dropped by more than $5.3 billion within a day of the incident despite the support, including the $1.4 billion lost in the hack.

Despite the hack and the decline in assets, Bybit’s exchange reserves still surpass its liabilities, according to its independent proof-of-reserve (PoR) auditor, Hacken. In a February 21 post on X, Hacken confirmed:

Today’s hack was massive—a tough hit for the industry. But here’s the bottom line: Bybit’s reserves still exceed its liabilities. As their independent PoR auditor, we’ve confirmed that user funds remain fully backed.

~ Hacken

Investigators link North Korean Lazarus Group to Bybit hack

Blockchain security analysts, including Arkham Intelligence and on-chain investigator ZachXBT, have linked the Bybit hack to the North Korean state-backed Lazarus Group—the same entity suspected in the $600 million Ronin network breach.

Meir Dolev, co-founder and CTO of Cyvers noted that the attack bore similarities to the $230 million WazirX hack and the $58 million Radiant Capital exploit. He explained that Bybit’s Ethereum multisig cold wallet was compromised through a deceptive transaction, which tricked signers into unknowingly approving a malicious smart contract logic change.

According to Dolev, the hacker then took control of the wallet and drained funds to an unknown address.

Cryptopolitan Academy: How to Write a Web3 Resume That Lands Interviews - FREE Cheat Sheet