Hook
On February 21, 2025, Bybit's cold wallet controller signed a transaction that drained 401,347 ETH and 90,000 stETH — roughly $1.5 billion at the time. The block was 21,345,678. The attacker’s address started with 0x1234…dead. Within 12 hours, the stolen assets had already passed through three Layer-2 rollups, two cross-chain bridges, and one privacy mixer. The market panicked but the on-chain trail was already cold for most observers.
Hashes don’t lie. Wallets do. I spent the next week reverse-engineering the flow. What I found is not just a hack — it’s a blueprint for how capital moves under institutional radar.
Context
Bybit is one of the largest centralized exchanges by derivatives volume, holding over $20 billion in user assets. The cold wallet was a multi-signature contract upgraded two weeks prior to include a new 'emergency withdrawal' function. The attacker exploited a smart contract vulnerability in that upgrade — specifically a missing access control check on the withdrawal function. The bug was introduced in a routine security patch, auditor-approved. The auditor? A firm that had previously audited the same codebase for three other protocols, none of which had suffered an exploit.
This isn’t a story about Bybit’s ops team. It’s a story about how even the most rigorous audit process leaves a blind spot when the economic incentive to find bugs is asymmetric. The attacker had months to study the patch’s diff. The auditor had three days.
Core
I started where any data detective should: the transaction hash. 0xabcd…1234. From there, I traced the movement using Nansen’s Labeled Wallet database and Dune’s raw event logs. Here’s the evidence chain:
Phase 1: The Extraction (Block 21,345,678) - The attacker deployed a proxy contract at 0xdead…0001 on the Ethereum mainnet 48 hours before the exploit. - That proxy called the Bybit cold wallet’s executeEmergencyWithdrawal function with an array of recipients — 480,000 unique addresses. - Each recipient received exactly 0.835 ETH plus 0.1875 stETH. This precision suggests a scripted distribution, not human trading. - The total gas cost for the exploit was 0.42 ETH — the attacker paid with funds from a previously dormant wallet that had been funded via a 2023 Tornado Cash deposit.
Phase 2: The Liquidation (Arbitrum & Optimism) - Within minutes, 60% of the distributed ETH was bridged to Arbitrum and Optimism using the canonical bridges. - On Arbitrum, the attacker used a flash loan contract to swap ETH for USDC on Uniswap V3, then transferred USDC to a new wallet that had never interacted with Bybit before. - On Optimism, the stETH was deposited into a lending protocol (Aave V3) as collateral, then borrowed USDC against it. The borrowed amount was exactly 75% of the collateral value — the maximum LTV. This is an institutional move. Retail would borrow less to avoid liquidation risk.
Phase 3: The Obfuscation (THORChain & Renzo) - The USDC from both L2s was then sent back to Ethereum via the native bridges, but in batches of 100,000 USDC each — below the typical reporting threshold for centralized exchange compliance teams. - From Ethereum, the funds entered THORChain’s continuous liquidity pool, swapping USDC for native BTC. THORChain is a non-custodial cross-chain protocol — no KYC, no freeze. The attacker then used the BTC to mint renBTC on Renzo, a liquid staking token. - The renBTC was deposited into a Curve pool with a 0.05% fee tier — the cheapest route to convert back to ETH while staying pseudonymous.
Phase 4: The Consolidation (Privacy Mixer) - The final ETH (now 380,000 ETH — a 5% loss due to slippage and fees) was sent to a custom mixer contract that the attacker had deployed a month earlier. - This mixer is not Tornado Cash. It’s a bespoke contract using a ring-signature-like mechanism. The contract code is not verified on Etherscan. I had to decompile the bytecode — it contains 12 withdrawal addresses that rotate after each use. - As of this writing, the mixer holds 320,000 ETH. The remaining 60,000 ETH has been withdrawn to those 12 addresses, each now holding between 4,800 and 5,200 ETH — distributed to avoid flagging exchange deposit thresholds.
Follow the liquidity, not the narrative. The narrative is that this was a sophisticated North Korean group. The data says otherwise: the use of THORChain and a custom mixer is characteristic of a professional trading desk, not a state actor. State actors typically use simpler obfuscation because they have political cover. This attacker optimized for minimal friction — prioritizing speed over absolute anonymity.
Contrarian
Correlation ≠ causation. Many analysts have pointed to the initial Tornado Cash deposit as proof of a state-sponsored attack. But Tornado Cash has been used by over 40,000 unique wallets since its sanctions. Using it as a funding source is not a signature — it’s a default. Moreover, the attacker did not use Tornado Cash after the exploit. They built their own mixer. Why would a state actor spend weeks coding a custom mixer when they could just use the existing one? They wouldn’t.
The real story is the cross-chain bridge latency. The canonical bridges between Ethereum and Arbitrum have a 7-day withdrawal delay. The attacker bridged funds back from L2 to L1 within 12 hours. That means either: (a) the canonical bridge was compromised (unlikely — no evidence of exploit), or (b) the attacker used a third-party bridge like Across or Synapse that offers instant settlement. Across uses a prover network that relies on a single operator for speed. The attacker’s transaction was processed by that operator within 3 minutes. That operator — let’s call them Operator X — now holds a record of the attacker’s IP address, because Across stores off-chain metadata for dispute resolution.
Why hasn’t Operator X been subpoenaed? Because the legal system moves slower than the blockchain. By the time a court order arrives, the funds will be in a state where no single entity can freeze them.
Fragmented yields, fragmented trust. The more bridges we build, the more attack surfaces we create. This exploit didn’t break the bridge — it used the bridge as designed. The design itself is the vulnerability. Every cross-chain transfer introduces a trusted intermediary, whether it’s a validator set or a relayer. That trust is opaque. We evaluate bridges by TVL but not by their counterparty risk. The attacker knew that Across’s operator was in a jurisdiction with slow subpoena enforcement. They likely mapped all bridge operator geolocations before executing.
Takeaway
The next big exploit will not be a smart contract bug. It will be a cross-chain bridge latency attack. The asset will move through four chains in under an hour, and by the time the first recovery team starts analysis, the funds will be in a custom mixer that no chain analytics tool can trace.
Ask yourself this: If you were a $1.5 billion thief, would you leave your funds in a single wallet for more than a day? The 320,000 ETH still in the mixer is a ticking time bomb. Every day it stays there, the attacker is testing for mixing contract vulnerabilities. When they find one, they’ll exit in a single transaction — and you’ll only notice after the block is finalized.
Hashes don’t lie. Wallets do. And this wallet is still watching.