The first to report suspicious activity was blockchain analyst ZachXBT, who noticed large transfers of crypto assets related to Bybit. At the time of his alert, the attacker had already converted mETH and stETH into Ether via decentralized exchanges. It was later revealed that this activity was part of an exploit that allowed the hacker to access the exchange's funds.
According to Bybit's CEO, the attack was carried out using a "masked transaction" method. This mechanism allowed the attacker to replace the address displayed in the interface with the correct one, while the real transaction contained malicious code. As a result of changing the logic of the smart contract, the hacker gained control over one of Bybit's cold wallets and withdrew the funds stored there.
The head of Bybit emphasized that only one wallet was compromised during the attack, while the exchange's other cold storages remained safe. Withdrawals for users continue as usual, and the stolen assets constitute only a part of the platform's reserves.
The incident occurred shortly after Bybit's CEO publicly criticized the Pi Network project, refusing to list it. His statement came amid criticism of the exchange, which attracted additional attention to the situation.