Bybit ETH Cold Wallet Hacked: CEO Explains “Musked” Attack

Massive Crypto Breach Hits Bybit

Singapore-based centralized crypto exchange Bybit has confirmed a major security breach. Early estimates indicate that hackers have stolen over $1 billion worth of Ethereum (ETH), along with significant amounts of other tokens. The investigation is ongoing.

CEO Ben Zhou Explains Attack

Bybit’s co-founder and CEO, Ben Zhou, took to X (formerly Twitter) to explain the breach:

“Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from Safe. However, the signing message was to change the smart contract logic of our ETH cold wallet.
This resulted in the hacker taking control of the specific ETH cold wallet we signed and transferring all ETH in the cold wallet to this unidentified address. Please rest assured that all other cold wallets are secure. All withdrawals are NORMAL.”

Understanding the “Musked” Attack

The term “musked” refers to a type of cyber attack where a transaction is manipulated or disguised, often through a deceptive UI or phishing scheme. In this case, Bybit’s signers were tricked into approving a malicious action—modifying the smart contract logic of the exchange’s ETH cold wallet. This allowed the hacker to gain control and move the funds to an unknown address.

Bybit Announces System Maintenance

In response to the incident, Bybit announced that it will conduct scheduled maintenance on its live servers, lasting from today into tomorrow.

Ongoing Investigation

This remains a developing story. More details will be shared as The Block continues to investigate the situation.

Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change…

— Ben Zhou (@benbybit) February 21, 2025