Bybit CEO guarantees client funds are safe following record $1.5bn crypto hack

Company pledges that all withdrawals will be processed amid what is believed to be the industry's costliest breach

Bybit says it will seek legal support to recover the stolen funds and has promised that its clients are 'not going to suffer'. AFP

The chief executive of Dubai-based cryptocurrency exchange Bybit has guaranteed that client funds are safe and available for withdrawal, despite the company suffering a sophisticated hack that is believed to be the largest in crypto history.

Bybit was hit by a cyber attack on Friday, in which 401,000 Ethereum worth more than $1.5 billion was stolen.

The brazen crime was carried out through a "manipulation of the transfer process, during a planned routine transfer" on one of its cold wallets, the company said.

A cold wallet is cryptocurrency storage that is not connected to the internet, shielding it from the possibility of theft or hacks.

Ben Zhou, who is also co-founder of the exchange, said in a livestream that Bybit has secured a bridge loan from its partners, which has enabled it to secure nearly 80 per cent of the stolen Ethereum.

"We are not buying Ethereum, we are relying on a bridge loan; even if we want to buy it's too big of an amount to be moving around," Mr Zhou said.

Crypto scams see sharp rise amid fears of missing out

02:55

"We are getting help and support from our partners [to] help us with the liquidity crunch so we can pass this crucial period."

He added that none of Bybit's other cold wallets were affected.

"Luckily it was only our Ethereum cold wallet that was compromised so we are able to cover this with our treasury, if that is the worst case scenario," Mr Zhou said.

"Even the Bybit treasury [that was hacked], we can cover that, so no matter what we will make sure the clients' money is safe."

Other tokens such as Bitcoin, Bybit's major reserve, and USDT are unaffected.

Client withdrawals remain active, although Mr Zhou admitted that some transactions may take some time as Bybit goes through "regular checks, but we are aiming at processing all the withdrawals". As of his stream, 70 per cent of withdrawals have been processed.

Bybit will seek "legal and police support to recover these funds but if worse comes to worst our clients' funds are not going to suffer; we will cover it with our company treasury", Mr Zhou said.

"Even if we are experiencing a bank run, it's not an issue, we have enough tokens to clients for withdrawals."

The National has reached out to Bybit for further comment.

The cryptocurrency industry has struggled with a spate of challenges and, increasingly, has become a target for cyber criminals who want to cash in on the lucrative sector that continues to grow in adoption.

Notably, regulators have attempted to establish some control over the industry amid questions over how the sector operates and the opportunity for cyber thieves to exploit it.

About $2.2 billion was stolen from crypto platforms in 2024, latest data from blockchain company Chainalysis shows.

Bybit is the latest to fall victim and is very noteworthy: the value of crypto stolen from the company more than doubled the $625 million lost by Ronin Network in 2022.

Other hacks above the half-billion mark include Poly Network's $611 million in 2021, Binance BNB Bridge's $569 million in 2022 and Coincheck's $532 million in 2018.

The first major crypto hack was the 2011 attack on Mt Gox, in which it lost $473 million, while FTX, whose founder Sam Bankman-Fried was in 2024 sentenced to 25 years in prison for its collapse, lost $477 million in 2022 – a day after it filed for bankruptcy.

Crypto exchange Bitget, meanwhile, said that its security and research team is helping Bybit in "tracking these activities" related to Friday's hack.

"If we make any significant findings, we will share an analysis of this incident and what industry can do to avoid similar issues," Bitget chief executive Gracy Chen said on Saturday.