Recommended Free Tools
Bybit restored the ETH needed to cover its customer-asset shortfall after the February 21, 2025 theft, but that was not the same as recovering the cryptocurrency from the attackers. The latest recovery breakdown identified here, from CEO Ben Zhou on April 21, 2025, said 68.57% of the stolen funds remained traceable, 27.59% had gone dark and 3.84% had been frozen. Those figures describe the stolen assets—not Bybit’s customer reserves.
What happened in the Bybit incident?
On February 21, 2025, attackers stole approximately $1.4 billion in ETH-related assets from a specific Bybit ETH cold wallet. The wallet’s signing process involved Safe{Wallet}; Bybit’s preliminary forensic account attributed the incident to malicious JavaScript associated with a compromised Safe{Wallet} developer environment. Bybit said its own infrastructure was not compromised and that other cold wallets were unaffected. That distinction does not mean Bybit was untouched: a wallet controlled by the exchange was exploited. Bybit’s incident timeline and its security statement describe the company’s account of the event.
As an Amazon Associate I earn from qualifying purchases.
The FBI later described the theft as approximately $1.5 billion in virtual assets. Its higher figure is a later valuation or scope estimate, not a second incident; dollar values for crypto assets depend on valuation time and what assets are counted. The FBI attributed the theft to North Korean actors tracked as TraderTraitor and linked to the Lazarus Group. It said the assets were rapidly converted into Bitcoin and other virtual assets and dispersed across thousands of addresses and multiple blockchains. These are government and blockchain-investigation attributions, not identification of every wallet movement with a named individual. The FBI advisory and Chainalysis’ analysis provide further context.
What did Ben Zhou promise about customers’ money?
In the immediate aftermath, CEO Ben Zhou said Bybit was solvent, withdrawals would continue, and customer assets would remain fully backed even if the stolen funds were never recovered. These assurances addressed Bybit’s ability to meet customer liabilities; they were not a promise that the original coins would be retrieved from the attackers. Bybit reported that deposits and withdrawals had returned to normal by February 23. The company’s statements are recorded in its incident timeline.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
How did Bybit replace the missing ETH?
Bybit said it covered the ETH deficit with a combination of bridge loans, deposits from large holders, over-the-counter purchases and support from industry partners. It reported receiving approximately $1.23 billion in ETH. Independent on-chain analysis cited by Cointelegraph estimated that Bybit acquired roughly 446,870 ETH, worth about $1.23 billion at the time. These were replacement assets sourced for the exchange—not evidence that the attackers returned the stolen coins. Cointelegraph’s account of the on-chain analysis gives the estimate; Bybit’s timeline describes its funding sources.
What did Hacken’s proof-of-reserves report establish?
In a report announced on February 24, 2025, Hacken found that Bybit restored a 1:1 ratio for in-scope customer assets within 72 hours. The review covered 40 asset types; the reported collateral ratios for BTC, ETH, SOL, USDT and USDC exceeded 100%. The process included proof-of-liabilities and ownership checks and Merkle-proof validation. Bybit’s announcement of Hacken’s report sets out those findings.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
A proof-of-reserves review is evidence about specified assets and liabilities at the review’s scope and point in time. It is not a comprehensive audit of every corporate liability, governance process, custody risk or future solvency scenario. “Fully backed” in this report should therefore be read as a finding about the assets and liabilities included in the review, not a guarantee that all exchange risks disappeared.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow much of the stolen cryptocurrency was frozen or recovered?
Bybit said approximately $42.89 million in exploited funds had been frozen by February 23 through cooperation among exchanges, stablecoin issuers, bridges and security firms. A frozen asset is not necessarily already returned: further technical, counterparty or legal steps may be needed. On April 21, Zhou reported that 68.57% of the stolen funds remained traceable, 27.59% had gone dark and 3.84% had been frozen. The percentages are attributed to Zhou’s update as summarized in a contemporaneous report; they are not an independent audit or a live measure of recovery.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
“Traceable” means investigators could follow blockchain addresses or flows. It does not establish that funds can be seized. “Frozen” means a counterparty has restricted movement of identified assets, not necessarily that Bybit has received them. The evidence cited here does not support saying that Bybit recovered the full $1.4 billion from the hackers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What was the recovery bounty?
Bybit announced a bounty on February 22, 2025 offering up to 10% of recovered funds, potentially as much as $140 million if the full reported theft were recovered. The program targeted security researchers, blockchain analysts, exchanges and other industry participants. Under the described arrangement, a 10% pool could be divided between those who traced funds and the entity that froze them; rewards depended on verifiable recovery or freezing activity, not simply publishing wallet addresses. The maximum was a potential reward, not a report of money already paid. See Bybit’s bounty announcement, its suspicious-wallet API announcement and TechCrunch’s explanation of the split.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
How to interpret claims about Bybit’s recovery
| Term | What it means | What it does not mean |
|---|---|---|
| Reserves replenished | Bybit sourced replacement assets to cover the ETH shortfall. | The attackers returned the original assets. |
| Customer assets backed 1:1 | Hacken found in-scope customer assets were covered at the report’s stated scope and time. | Every exchange risk was eliminated. |
| Funds traceable | Investigators could follow blockchain movements. | The funds had been seized or returned. |
| Funds frozen | A counterparty restricted movement of identified assets. | The assets had necessarily been transferred back to Bybit. |
| Funds recovered | Assets were actually regained or made available. | All related wallets or stolen assets had been identified. |
When a headline says “recovered,” check whether it refers to customer coverage or the original stolen coins, and note the date and evidence behind the figure. A company statement, a reserve review, blockchain tracing and an FBI attribution answer different questions; they should not be treated as interchangeable proof.
Free tools Windows power users keep installed
One-click scans. No signup required.
What does the incident mean for Bybit users?
Bybit said withdrawals continued, and its subsequent reserve announcement reported 1:1 backing for the assets in Hacken’s review. The available evidence cited here does not establish a customer balance haircut from the incident. Those facts do not amount to a blanket assurance about Bybit’s future solvency or security. Proof of reserves can help assess specified customer-asset coverage, but it does not prevent a signing-interface compromise or address every operational, custody and counterparty risk.
For anyone weighing exchange custody against self-custody, the incident is a reminder that terms such as “cold wallet” and “multisig” do not by themselves guarantee safe transaction signing. Self-custody changes who controls access and recovery: a user may reduce reliance on an exchange but assumes responsibility for keys and transaction approvals. Neither approach eliminates phishing, malware, malicious interfaces or user error.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
