Bybit CEO: ETH Gap Closed Post $1.4B Hack, Exchange to Publish POR Audit

Bybit CEO Ben Zhou announced Monday that the exchange has fully restored its Ethereum holdings. It follows a major security breach that resulted in a $1.5b loss in liquid-staked Ether (ETH) and MegaETH (mETH).

To reassure users, Zhou said an audited proof-of-reserves (PoR) report will be released soon. It is meant to verify that Bybit’s client assets are fully backed on a 1:1 basis.

Zhou pointed to an X post from blockchain analytics firm Lookonchain, which detailed how Bybit replenished its Ethereum reserves.

After the attack, Bybit obtained about 446,870 ETH ($1.23b). The exchange used a mix of loans, large investor deposits and direct ETH purchases to replenish its holdings.

Latest Update: Bybit has already fully closed the ETH gap, new audited POR report will be published very soon to show that Bybit is again Back to 100% 1:1 on client assets through merkle tree, Stay tuned. https://t.co/QLa1vOujM6

— Ben Zhou (@benbybit) February 24, 2025

Funds Recouped Through OTC, CEX and DEX Transactions

The largest source of replenishment came from an over-the-counter (OTC) transaction, contributing 157,660 ETH ($437.8m). The second-largest influx, totaling 109,033 ETH ($304.1m), was sourced from centralized and decentralized exchanges, according to Lookonchain.

Further funding included 47,800 ETH ($127.5m) from unidentified institutions or whales through loans. Crypto exchange Bitget also extended a 40,000 ETH ($106m) loan to Bybit. Additionally, another address, possibly engaged in OTC trading, supplied 22,609 ETH ($61.8m).

Smaller but significant deposits came from different sources. An unknown sender provided 20,000 ETH ($53.7m), while MEXC transferred 12,653 ETH ($33.8m). Mirana Ventures and Fenbushi Capital each added 10,000 ETH, worth $27.9m and $27m, respectively.

Bybit also moved 4,416 ETH ($12.1m) from other crypto exchanges. Some individual investors contributed smaller amounts, including a 2,499 ETH ($7m) transfer and 2,200 ETH ($6m) from DWF Labs.

Bybit Restores Liquidity and Targets Stolen Fund Recovery Efforts

These inflows have helped Bybit stabilize its liquidity and operations after the breach, according to Zhou.

Meanwhile, the CEO reaffirmed the company’s commitment to tracking and recovering the stolen funds, which have been linked to the notorious North Korean Lazarus Group.

During a routine transfer to a warm wallet, the attack targeted Bybit’s Ethereum multisignature cold wallet used for daily trading. Hackers exploited a phishing vulnerability, manipulating the signing interface Bybit’s security team used to approve the transaction.

Bybit’s upcoming audit is expected to provide transparency and restore confidence among its users.