Addresses Used In Bybit Hack Related To BingX and Phemex Hackers

Key Points:

• Blockchain security firm SlowMist revealed that hackers exploited smart contract vulnerabilities to steal over $1.46 billion in the Bybit hack.
• The attack was linked to the North Korean Lazarus Group, known for high-profile crypto thefts.

Blockchain security firm SlowMist has provided a comprehensive analysis of the recent cyberattack on cryptocurrency exchange Bybit, detailing how hackers exploited smart contract vulnerabilities to access the platform’s cold wallet.

The Bybit hack, which resulted in the theft of over $1.46 billion in Ethereum (ETH), is considered one of the largest cryptocurrency heists in recent years.

$1.46 Billion Bybit Hack Linked to BingX and Phemex Issues

On February 21, 2025, on-chain investigator ZachXBT identified a significant outflow of funds from Bybit. SlowMist’s analysis revealed connections between the addresses used in this hack and those linked to previous attacks on BingX and Phemex.

The stolen assets primarily include:

• 401,347 ETH (approximately $1.068 billion)
• 8,000 mETH (around $26 million)
• 90,375.5479 stETH (valued at about $260 million)
• 15,000 cmETH (roughly $43 million)

Reports indicate that the hacker initially distributed 400,000 ETH across 40 different addresses, each receiving 10,000 ETH. Transfers are still ongoing with complex forms. In response to the breach, Arkham Intelligence has shared all available data with Bybit to support further investigations.

Meanwhile, partial recoveries have been reported. The mETH Protocol successfully intercepted a withdrawal of 15,000 cmETH, securing approximately $43.5 million in a recovery address. Additionally, Tether CEO Paolo Ardoino confirmed that $181,000 USDT linked to the hack was frozen.

ZachXBT has attributed the attack to the notorious Lazarus Group, a cybercrime organization with a history of high-profile cryptocurrency thefts. Evidence, including test transactions, linked wallets, forensic analysis, and transaction timelines, points to techniques commonly associated with the group.

Lazarus Group was previously implicated in the $600 million Ronin Network hack targeting Axie Infinity. While recovering funds from their operations has been historically challenging, Chainalysis and U.S. law enforcement managed to retrieve $30 million from the Ronin breach in 2022.