The CEO of Bybit has revealed that the crypto exchange has all but closed its $1.4 billion Ethereum (ETH) deficit, caused by one of the largest hacks in crypto history.
Bybit CEO Ben Zhou acknowledged the findings of on-chain analytics platform Lookonchain in a tweet, stating that, “Latest update: Bybit has already fully closed the ETH gap.”
According to Lookonchain, the exchange acquired a total of 446,870 ETH—worth approximately $1.23 billion—through a combination of loans, whale deposits, and direct purchases, allowing the platform to replenish nearly 88% of funds stolen in last week’s hack.
Last Friday, the crypto market was rocked by the news that North Korean state-sponsored Lazarus hacking group had exploited a vulnerability in Bybit’s Ethereum cold wallet, draining $1.4 billion worth of ETH and stETH.
CoinGecko data shows that Ethereum dipped by 3.3% in the past 24 hours to $2,707, while Bybit’s total assets currently stand at $10.81 billion, per data from DeFiLlama.
In his tweet, Zhou also assured users that a new proof-of-reserves report would be released soon, demonstrating that Bybit has fully restored its client assets with a 1:1 backing using Merkle tree, a data structure used by blockchains to store transaction data.
On Sunday, Lookonchain tracked a wallet linked to Bybit, identified as “0x2E45…1b77,” which purchased 157,660 ETH for $437 million in over-the-counter transactions. The first purchase was made on February 22.
The funds came through multiple channels, including significant purchases from crypto investment firms Galaxy Digital, FalconX, and Wintermute.
The platform also pointed to the involvement of another wallet, “0xd7CF…A995,” which purchased an additional 304,000 ETH, contributing to the exchange’s efforts to close the deficit.
This wallet had transactions linked to centralized and decentralized exchanges such as Binance and MEXC, making it clear that Bybit relied on OTC deals and leveraged other trading channels to recover the stolen funds.
Lazarus Group’s attack severely impacted the exchange’s reserves, with Bybit seeing massive withdrawals that topped $5.3 billion within a day.
The Bybit team quickly moved to reassure the market that the exchange had the necessary funds to cover the loss, as its reserves exceeded its liabilities.
Following the attack, Lazarus Group moved the stolen funds across various decentralized exchanges and privacy protocols, making it harder to trace the assets.
The stolen funds were split across multiple addresses and funneled through different platforms to obscure the trail.
Blockchain intelligence firm Elliptic tracked over $140 million of the stolen funds as they were converted into Bitcoin, further complicating recovery efforts.
In its public statements, Bybit praised the efforts of industry partners, including Tether, Circle, and THORChain, for their prompt response in freezing over $42.89 million of the stolen funds.
“Respect to their teams for their timely responses,” the company tweeted on Sunday, adding that the firms had “helped us monitor and block the blacklisted addresses.”
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
