$1.4 billion ETH was stolen in a terrifying night. What impact does the Bybit security incident have on Ethereum and the crypto industry?

Author: Frank, PANews

Crypto exchanges have experienced another major security incident, after the Bybit exchange was stolen. On the evening of February 21, 2025, the chain detective ZachXBT issued an alert on the X platform, saying that abnormal fund outflows from the Bybit exchange-related addresses were detected, involving an amount of up to $1.46 billion. Security teams such as SlowMist and PeckShield confirmed that the incident was caused by hackers controlling Bybit's ETH multi-signature cold wallet through UI deception attacks and stealing 491,000 ETH (about $1.4 billion based on the price of the day). After the news was exposed, the market quickly fell into panic: users ran to withdraw money, ETH prices plummeted 8%, and the entire network contract liquidated more than $400 million - an FTX-style collapse seemed to be imminent.

Fortunately, Bybit officials acted quickly and explained the hacking incident, saying that an ETH cold wallet was stolen, and other types of assets were not affected, and they guaranteed that there was sufficient funds to meet users' withdrawal needs. In addition, Bitget, Binance and other exchanges transferred more than $4 billion in funds to cope with the crisis, and the theft was temporarily calmed. After a day of diving, the price of Ethereum returned to above $2,700.

The ripples of the incident have not yet subsided, and the hacker theft has once again sounded the alarm for the industry, especially as the FTX incident is coming to an end and the repayment is about to begin. As the main asset stolen this time, what far-reaching impact will the Ethereum ecosystem have? Perhaps this is something the industry needs to think about further.

The cross-chain bridge funding pool is limited, and hackers may find it difficult to sell coins in a short period of time

The market was the first to be affected and was the most affected. Before the news came out, the price of ETH rose to $2,845. Under the catalysis of market panic, the price of ETH fell by 8% in a short period of time, and the entire network was liquidated for more than $400 million. Thanks to Bybit's quick response and the liquidity assistance of Bitget, Binance and other exchanges, the price of ETH recovered within 24 hours and the market panic was temporarily alleviated.

However, most of the funds stolen by hackers have not been sold. After a period of time, hackers urgently need to launder these funds through on-chain methods and exchange them for other currencies. Therefore, ETH's on-chain digestion capacity is still a certain test.

In addition, according to the analysis of several security companies, the initiator of this attack is a North Korean hacker group. If this inference is true, then the possibility of recovering the funds is very slim.

According to data from artemis, the outflow of funds on the ETH chain in the past seven days was only $196 million, and the inflow was about $149 million. If the hacker chooses to transfer these funds to other chains in a short period of time, the outflow of funds on the ETH chain may increase by about ten times in a short period of time. The reality that the depth of the ETH chain will be under pressure in the future is inevitable.

The liquidity pools of most cross-chain bridges cannot bear such a large amount of funds alone. For example, the Chainflip cross-chain bridge used by hackers to transfer funds on February 22, the total liquidity in its liquidity pool was about 17 million US dollars. Other cross-chain bridges also seem to be unable to bear such a large amount of funds.

On the other hand, the ETH ecosystem may be the most decentralized public chain besides Bitcoin. Hackers may not choose to transfer funds to the ecosystem of other public chains. From this perspective, hackers may still focus on mixing coins in the short term and will not conduct large-scale fund conversions on the chain. Therefore, the in-depth test of the chain may not be completed overnight, and the impact on the market will be limited if it is gradually digested.

Reflecting on the “complexity premium” of smart contracts, should Ethereum move towards simplification?

In addition to the market impact, Ethereum's technical route may also be affected and undergo some changes. Looking back at a similar hacker attack in 2024, the hacker also stole ETH tokens during the theft of WazirX.

The reason is that, on the one hand, ETH is the second largest token in terms of market value after BTC, and its market depth will not collapse due to one or two attacks, making it a value-preserving asset for hackers. On the other hand, it is also related to Ethereum's complex smart contract functions. Compared with other new public chains such as Solana, Ethereum's Turing completeness gives smart contracts unlimited possibilities, but also leads to complex contract interaction levels (such as multi-signature wallets relying on multiple proxy calls of Safe contracts), and the attack surface is far greater than Bitcoin's UTXO model or Solana's native account model.

Therefore, as more and more security attacks occur on Ethereum, Ethereum’s next technical route may be to consider how to simplify smart contracts or add technical changes confirmed by biometrics or similar hardware devices at the application level of multi-signature wallets.

From an ecological perspective, projects in the Ethereum ecosystem that use hardware to improve security may have some opportunities. Including the Safe used in this incident, in the future, it may be mandatory to introduce "secondary semantic verification" (such as visual verification of transaction content signatures), similar to the physical confirmation mechanism of hardware wallets.

Of course, the above potential changes exist on the premise that the Ethereum ecosystem will take this incident as a wake-up call. After all, in the state of poor data performance, security has become the last moat of the Ethereum ecosystem. If security is lost, the market may be more disappointed with the Ethereum ecosystem.

The industry's wake-up call: It's time to build a hacker firewall

Of course, this incident has a more far-reaching potential impact on the entire crypto industry ecosystem. For example, the asset management methods of exchanges may need more reforms.

Or will this give rise to the exchange insurance business? The previous FTX crash has made all exchanges pay attention to asset transparency and disclose their asset sizes. From a certain perspective, the widespread implementation of this measure has become an important reason why Bybit has not repeated the same mistakes today. On the other hand, another reason why this hacking incident did not cause a large-scale run is that multiple exchanges and industry institutions lent a hand in time and quickly stabilized market sentiment.

Judging from the previous FTX crash, the last straw that broke the camel's back was the bank run. Fortunately, Bybit received assistance from its peers, but in any case, this assistance is essentially a human factor after weighing the pros and cons. If another exchange encounters the same crisis in the future, if it does not receive assistance from its peers after evaluation, will it bring the market into the FTX cycle again? Therefore, perhaps exchanges or third parties have more motivation to promote the development of exchange insurance business after this incident.

In addition, cryptocurrencies have long suffered from North Korean hackers. In order to avoid similar incidents, on the one hand, the industry has further strengthened its security level. On the other hand, whether the crypto world will launch a wave of anti-hacker firewalls has also become a topic worthy of attention for the entire industry. For example, each project party will establish a unified firewall to prevent the flow of hacker funds? Of course, this process will be much more complicated, and how to complete such a move without sacrificing the degree of decentralization may become the main topic of discussion. Just as CZ suggested that Bybit stop withdrawing coins after the incident, it also caused a lot of controversy.

However, the establishment of a hacker firewall may not be to prevent another exchange from collapsing, but to protect those users who are frequently harassed by hackers but no one pays attention to them. After all, they are unable to get the entire network to cooperate in stopping hackers, and each attack has a greater impact on retail investors.

Although the Bybit incident did not eventually evolve into a systemic collapse, the cold wallet interaction vulnerabilities, cross-chain bridge liquidity bottlenecks, and the temporary nature of the industry mutual assistance mechanism it exposed have sounded the alarm for the Ethereum ecosystem and even the entire crypto industry - only by building an attack-resistant underlying architecture and an institutionalized risk buffer mechanism can the crisis be truly transformed into an evolutionary driving force.