Bybit Faces $5.5 Billion Bank Run After Historic $1.5B Hack – What’s Next?

Bybit, one of the world’s leading cryptocurrency exchanges, is grappling with an unprecedented crisis after suffering a $1.5 billion hack that triggered a massive $4 billion bank run. This brings the total outflows to a staggering $5.5 billion, forcing the exchange to scramble for liquidity, secure emergency loans, and develop new withdrawal mechanisms to process user transactions.

As concerns over security escalate, Bybit CEO Ben Zhou has addressed the situation, highlighting the need for greater security measures and an alternative to Safe wallets, which played a crucial role in the crisis. Meanwhile, the source of the attack remains under investigation, with North Korea’s Lazarus Group emerging as a suspected culprit.

What to Know

• Bybit suffered a $1.5 billion hack, believed to have compromised its ether (ETH) cold wallets.
• A $4 billion bank run followed, as users rushed to withdraw funds, fearing further losses.
• Safe Wallet Shutdown Worsened the Crisis: Bybit’s $3 billion in stablecoin reserves was temporarily inaccessible after Safe paused smart wallet functionality.
• Emergency Recovery Efforts: Bybit raced to secure loans and develop new software to retrieve frozen funds and process withdrawals.
• Blockchain Rollback Considered: Industry figures suggested a rollback of the Ethereum blockchain to recover stolen funds, but it remains an unlikely option.

How Bybit’s Security Breach Led to a Liquidity Crisis

The massive hack, which drained $1.5 billion from Bybit’s ether cold wallets, sent shockwaves through the crypto industry. In an emergency X Spaces session, CEO Ben Zhou detailed how the exchange mobilized all resources to contain the crisis.

While the attack primarily targeted ETH holdings, Zhou noted that the most withdrawn asset wasn’t ETH but stablecoins, indicating that users were prioritizing capital preservation over asset preference.

The Role of Safe Wallet in the Crisis

Bybit’s reserves were sufficient to cover withdrawals, but the situation worsened when Safe—a decentralized custody provider—paused smart wallet functionality to investigate potential security vulnerabilities.

This resulted in $3 billion worth of USDT being locked in a Safe wallet, which Bybit could not immediately access. With withdrawal requests piling up, the team worked around the clock to develop new software that could manually verify and move stablecoins to fulfill withdrawal demands.

“Our security team had to manually verify transactions at a code level using an Etherscan-based system just to process withdrawals,” said Zhou.

Bybit’s Response: Securing Loans and Managing Withdrawals

To prevent a full-fledged liquidity crisis, Bybit secured emergency loans to keep operations running smoothly. The exchange also relocated a significant portion of its funds away from Safe wallets to ensure continued liquidity.

Despite the crisis, Zhou assured users that Bybit remained financially stable and was actively improving security measures.

A 50% Bank Run – But Reserves Remain Intact

Within hours of the breach, Bybit experienced a bank run of nearly 50% of its total reserves, with users withdrawing billions in assets.

According to DeFiLlama, the total tracked assets on Bybit’s wallets plunged from $16.9 billion to $11.2 billion, raising concerns about the exchange’s ability to sustain operations. However, Zhou reassured users that reserves were sufficient to cover withdrawals, emphasizing that Bybit was working on alternative wallet solutions.

Did Bybit Consider Rolling Back Ethereum?

One of the most controversial suggestions following the hack was the possibility of rolling back the Ethereum blockchain to reverse the transactions and recover the stolen funds.

Industry figures, including BitMEX co-founder Arthur Hayes, floated the idea, but the feasibility remains questionable. Zhou admitted that his team reached out to Vitalik Buterin and the Ethereum Foundation for advice but received no definitive response.

“We explored all options. Some on Twitter asked if rolling back Ethereum was possible. I don’t know if it is, but we had discussions about it,” Zhou stated.

However, a blockchain rollback would be highly contentious, requiring community consensus and potentially leading to a hard fork, which could fracture the Ethereum network. Given Ethereum’s decentralized nature and complex smart contract ecosystem, such a move is highly unlikely.

Who Was Behind the Bybit Hack?

While the exact cause of the security breach remains unknown, many suspect that North Korea’s Lazarus Group was behind the attack.

Bybit has engaged Singaporean authorities, Interpol, and blockchain analysis firms like Chainalysis to track the stolen funds.

“As long as Bybit continues tracking the stolen ether, we hope to get these funds back,” Zhou said.

The exchange is now investigating whether the breach resulted from:

1. A vulnerability in Bybit’s internal systems.
2. A compromise within Safe wallets.
3. A phishing attack targeting Bybit’s employees.

So far, Bybit has not found evidence of compromised laptops or staff credentials, leaving Safe wallets as the primary suspect.

What’s Next for Bybit?

Despite successfully stabilizing the situation, Bybit is rethinking its security infrastructure to prevent future incidents. Key steps include:

• Reducing reliance on Safe wallets and migrating funds to a new custody system.
• Enhancing security protocols to detect and respond to threats faster.
• Expanding insurance coverage to protect users against large-scale hacks.

Will Bybit Regain User Trust?

The hack has undoubtedly shaken confidence, but Bybit remains one of the top cryptocurrency exchanges, known for its high trading volume and liquidity. If the exchange successfully implements stronger security measures and compensates affected users, it may recover from this crisis stronger than before.

Will the Market Be Affected?

Bybit’s massive outflows may cause short-term volatility in ETH and stablecoin markets, but the broader crypto space remains resilient. Analysts predict that trust in centralized exchanges may decline, driving more users towards decentralized exchanges (DEXs) and self-custody solutions.

Final Thoughts

Bybit’s $5.5 billion liquidity crisis underscores the risks of centralized exchanges and the importance of robust security measures. While Bybit has secured emergency funding and restored withdrawals, the incident raises critical questions about exchange security, reliance on third-party custody solutions, and the feasibility of blockchain rollbacks.

For users, the key takeaway is to diversify holdings, use cold storage when possible, and stay vigilant against potential exchange risks. As the industry moves forward, trust, security, and transparency will define the next era of crypto trading.