Bybit Hack: SlowMist Unveils Technical Details Behind Bybit’s $1.4 Billion Hack

Blockchain security firm SlowMist has disclosed a detailed breakdown of the attack that led to Bybit’s massive Ethereum (ETH) breach, revealing how the hackers manipulated smart contract logic to gain control over the exchange’s cold wallet.According to SlowMist’s investigation, the exploit began with the deployment of a malicious implementation contract on February 19, 2025, at 7:15:23 UTC (0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516). The attacker strategically leveraged multisig ownership, using three owner signatures to replace the legitimate Safe implementation contract with the malicious one at 14:13:35 UTC on February 21, 2025 (0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882).The core of the attack relied on embedding malicious upgrade logic into STORAGE via DELEGATECALL[0x0] (0x96221423681A6d52E184D440a8eFCEbB105C7242). This backdoor allowed the hacker to execute sweepETH and sweepERC20 functions, effectively draining the targeted wallet’s ETH and ERC-20 token holdings.Bybit has assured users that its other cold wallets remain unaffected and that withdrawals are operating normally. However, industry leaders—including Binance executives Yi He and former CEO CZ—have stepped in, offering support in tracking the stolen funds and strengthening security measures.The incident underscores the persistent vulnerabilities in crypto exchange security and the growing sophistication of attacks targeting digital asset custodians.