Leaderboard
03All-time rank
Bybit
Feb 21, 2025
$1.40B
Lost
$1.40B
Recovered
$1.40B
Net loss
$0
Full100% recovered
On February 21, 2025, Lazarus Group phished Bybit's DevOps engineer and spoofed the Safe UI to trick signers into blind-signing a masked transaction that deployed a rogue hot-wallet policy. 5 billion in ETH and assets.
How the exploit worked
View reproducible PoCPhishing attack.
Lost: 1.5B
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- CEX
- Classification
- Social Engineering
- Technique
- Signer Phishing
- Attribution
- North Korea
- Chains
Ethereum
Event timeline
- Feb 21, 2025Exploit executed — $1.40B drained via signer phishing
- Attributed to North Korea
- Recovery status Full 100%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)