$1.5 Billion Stolen, Largest Hack in Crypto History, Was Multi-Sig Also Compromised?

By: blockbeats|2025/02/22 01:45:02

Bybit Hacked for $1.5 Billion, Potentially the Largest Crypto Hack in History, Surpassing 2022's Axie Hack Record. The recent hack has caused significant panic in the market, with ETH experiencing a short but sharp price fluctuation, although not to the extent of the FTX run on bank in the past.

Ironically, many investors had just recovered partial compensation from FTX's bankruptcy settlement. "After 2.5 years, finally received compensation from FTX and deposited it into Bybit, only to have Bybit's hot wallet hacked the next day," became the most widely circulated dark joke overnight, casting a shadow over the crypto industry once again.

Late Night Hack

On February 21 at 23:00, crypto influencer Finish posted that according to on-chain data, a multi-sig address belonging to Bybit transferred $1.5 billion worth of ETH to a new address.

src=

The funds landed at the new address 0x47666fab8bd0ac7003bce3f5c3585383f09486e2, then moved to 0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e, where 0xa4 is currently selling stETH and mETH for ETH.

"The address is currently using 4 different DEXs. If they just convert sETH back to native ETH, the slippage would be massive. This scale of conversion is typically done OTC, so this is very unusual."

Half an hour later, Bybit CEO Ben Zhou stated that the ETH multi-sig cold wallet faced a sophisticated attack, with the smart contract logic tampered with, allowing the hacker to control a specific wallet and move all ETH. He mentioned that other cold wallets are secure, withdrawals are functioning normally, and efforts are being made to track the stolen funds. He also said, "We will go live very soon to address all questions! Stay tuned."

The Largest Hack in History?

According to EmberCN monitoring, Bybit's ETH multisig cold wallet was hacked, with 514,000 ETH stolen, valued at 1.429 billion USD. The hacker has already dispersed 490,000 ETH to 49 addresses (10,000 ETH per address). "Additionally, 15,000 cmETH is currently being unstaked by the hacker (with an 8-hour unbonding period, it's unknown whether this can be intercepted)."

Based on CoinMarketCap data, Bybit had $16.2 billion in reserves before the hack, with the stolen $1.4 billion assets accounting for 8.64%. This may be the largest amount ever stolen in crypto history, accounting for 16% of all previous crypto hacks. The previous largest cryptocurrency theft in history was the Ronin Network (Axie Infinity) hack on March 29, 2022. The hacker stole approximately $620 to $625 million in cryptocurrency, including 173,600 ETH and $25.5 million USDC.

Following the news of the Bybit hack, ETH plummeted to the $2600 range.

Only the ETH cold wallet was targeted by the hacker; Bybit's hot wallet, warm wallet, and all other cold wallets were unaffected. According to community feedback, all withdrawals are processing normally within 20 minutes.

Some community members also inquired ChatGPT and Grok about Bybit's annual revenue and profit estimates. Both came up with similar calculations: annual revenue around $20 billion and annual profit around $6 billion.

"Bybit still has the ability to pay, and even if the losses from this hack cannot be recovered, all customer assets remain 1:1 backed, and we can cover this loss." These words from Bybit's co-founder added a sense of credibility.

Was the Hack Due to the Multisig Wallet Being Safe?

On February 22, SlowMist founder Cao Yun published a post stating that the Bybit hacking technique is similar to that of North Korean hackers, "Although there is no clear evidence at the moment, from the Safe multi-signature technique and the current money laundering technique, it looks like North Korean hackers."

At the same time, the founder of DefiLlama pointed out that the attack method is similar to the WazirX hack related to North Korea. Stay vigilant.

At 23:44, in an announcement by Bybit's co-founder and CEO Ben Zhou, it was revealed: "Bybit's ETH multi-signature cold wallet was transferred to our hot wallet about 1 hour ago. It appears that this transaction was disguised, all signers saw a fake interface showing the correct address and the URL was from Safe."

However, the signature information was to change the logic of their ETH cold wallet's smart contract. This allowed the hacker to control their signed specific ETH cold wallet and transfer all the ETH in the wallet to this unconfirmed address.

Further investigation by SlowMist revealed more details of the vulnerability:

1) A malicious implementation contract was deployed on UTC 2025-02-19 7:15:23:
https://etherscan.io/address/0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516…
2) On UTC 2025-02-21 14:13:35, the attacker utilized a three-owner signature transaction to replace Safe's implementation contract with a malicious contract:
https://etherscan.io/tx/0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882…
3) The attacker then used the backdoor functions "sweepETH" and "sweepERC20" in the malicious contract to steal from the hot wallet.

This technique bears some similarities to the Radiant Capital hack in October 2024:

At that time, a security vulnerability at Radiant Capital resulted in the theft of around $50 million. The attackers used malware to infect at least three core developers' devices, all long-trusted DAO contributors who used hardware wallets for transactions. The hackers manipulated the front end interface of Safe{Wallet} (i.e., Gnosis Safe), causing the victims to mistakenly believe they were signing off on legitimate transactions when, in fact, malicious transactions were being executed in the background.

The attack involved implanting highly sophisticated malware on the developers' devices, inadvertently leading them to approve the hackers' malicious operations when signing transactions. The Safe{Wallet} front end did not display any anomalies, making the victims unaware of the transaction tampering. The hackers exploited common transaction failures (such as gas fee fluctuations, sync delays, etc.) to induce developers to resign multiple times, thereby obtaining multiple valid malicious signatures. Despite simulations and audits of the transactions using tools like Tenderly, the malware's manipulation of the developers' devices caused all checks to return normal results, delaying the timely detection of the attack.

Related Reading: "Radiant Capital Post-Mortem"

All fingers seem to point to the Safe multisig wallet.

Safe is the most widely used multisignature wallet in the Ethereum ecosystem, primarily used by large holders. During Safe's token distribution earlier this year, almost all of the top 100 airdrop addresses belonged to project teams or institutions, including OP, Polymarket, Drukula, Worldcoin, Lido, and more. Related Reading: "A Comprehensive Overview of Safe's Trading, Tokenomics, and Ecosystem"

Initially, Safe's audience consisted more of DAOs and cryptocurrency projects. However, as the crypto industry entered the next stage, traditional finance, institutions, family funds, and old money began to enter the market. An increasing number of traditional institutions, such as the Dung Wang family, are also starting to use the multisig wallet Safe.

The design of Safe has greatly improved the security of fund management. Through a multi-signature mechanism, funds are stored in a smart contract address, and a transaction can only be executed when the preset number of signatures is met (e.g., 3/10). This mechanism effectively reduces the risk of a single point of failure; even if a signature address's private key is leaked, an attacker would find it challenging to obtain enough signatures to complete a transaction.

Currently, the Safe security team has stated, "There is no evidence of the official Safe frontend being compromised. However, as a precautionary measure, Safe{Wallet} has temporarily suspended certain functions." They are closely collaborating with Bybit for an ongoing investigation.

Some community members have initiated mockery of Safe: multi-signature is just a decoration for "closing the eyes and stealing the bell." At the same time, many industry practitioners have expressed reflection and concerns about the industry: "If even multi-signature wallets are not secure, then who will take this industry seriously?"｜

The investigation into the current event is still ongoing, and the rhythm BlockBeats will continue to follow up.

What is XRP: XRP is a digital asset built for fast, low-cost international payments. It runs on the XRP Ledger and is used by Ripple for its On-Demand Liquidity (ODL) service. Unlike Bitcoin, XRP settles transactions in 3-5 seconds with near-zero fees.Why is XRP Dropping: XRP is not actively dropping, but it is struggling to rise. On the monthly chart, XRP has seen six consecutive months of decline. Currently, the price faces an additional supply wall at $1.45. About 1.24 billion XRP were bought in that range, and those holders sell when the price approaches, creating selling pressure that prevents a recovery.Will XRP Go Up: Potentially yes. XRP is trading near $1.43 and showing its best weekly performance since September 2025. If the price breaks above the $1.45 resistance, analysts expect a move toward $1.90, supported by strong institutional demand.Is XRP a Good Investment: The answer is not simple. Short-term traders may see opportunity in the coming volatility spike. Long-term investors face a bigger question that depends on one key regulatory event. However, the data reveals a surprising signal that most retail buyers are missing right now. To understand whether XRP is a smart buy or a trap at $1.43, you will need to read the full analysis below.What is XRP? A Digital Asset for Global Settlement

Before analyzing the charts, it is crucial to understand the asset in question. What is XRP? Unlike Bitcoin, which was designed as a decentralized digital gold, XRP operates on the XRP Ledger (XRPL). It was created to facilitate fast, low-cost international payments. Traditional bank transfers take days and incur high fees. XRP transactions settle in 3-5 seconds, costing fractions of a penny.

Ripple, the company associated with XRP, uses this asset for its "On-Demand Liquidity" (ODL) service. Banks and financial institutions use ODL to source liquidity during cross-border transactions without pre-funding accounts. This utility is the primary driver for institutional interest. Recently, the network hit a milestone of over 8 million active wallets, signaling growing usage despite recent price stagnation . Furthermore, Ripple is proactively preparing for the future, releasing a four-stage roadmap to make the XRPL "quantum-resistant," aiming to secure the ledger against future quantum computing threats by 2028 .

XRP Price Analysis: The Battle for $1.45

The XRP price trend over the last month tells a story of exhaustion followed by cautious recovery. On the monthly chart, XRP experienced six consecutive months of decline. However, April shows signs of a bottoming process. Weekly charts reinforce this view: after four weeks of lower closes, the last two weeks have seen small rebounds.

According to data from April 22, 2026, XRP is trading at approximately $1.44. Over the last seven days, XRP has outperformed both Bitcoin and Ethereum, rising 6.7% while the broader market rose only 3.2%. Spot trading volume surged 23% to $3.79 billion, and derivative markets saw $40 billion in futures volume on a single day.

Despite this, the price remains 60% below its July 2025 high of $3.65. The current technical picture shows a "low volatility grind" higher. The 20-day EMA is at $1.3924, and the 50-day EMA is at $1.4119, both acting as support . However, the immediate hurdle is the $1.45 resistance level. This price point has rejected every rally attempt in 2026.

Why is XRP Dropping? And Will XRP Go Up?

The primary reason for the recent "drop" (or lack of upward momentum) is not active selling, but rather the "supply wall." Data indicates that roughly 1.24 billion XRP tokens were purchased by investors in the $1.45 to $1.47 range. These investors have been waiting months to "break even." Every time the price approaches $1.45, these holders sell to exit their positions, creating a massive wall that retail buying cannot easily absorb.

However, the underlying momentum is shifting. Analysts suggest a xrp volatility spike imminent because the absorption capacity of buyers is increasing. Historically, when exchange reserves are high but the price refuses to drop significantly, it signals that buyers are absorbing the supply. The price has held above $1.39 despite the overhang, which is a sign of relative strength.

So, will XRP go up? Yes, potentially. But it needs a catalyst, if the price closes a daily candle above $1.45. If that happens, the next targets are $1.60 to $1.65, and eventually $1.90 .

XRP Exchange Netflow and XRP ETF Netflow: A Tale of Two Markets

The current market dynamic is best understood by looking at two opposing data streams: XRP Exchange netflow and XRP ETF flows.

Exchange Dynamics (Retail / Whales):

Data shows a complex pattern of "large inflows and increasing reserves." Recently, a Ripple-associated wallet moved 75 million XRP (approx. $108 million) to Coinbase. This initially looks like a dump, but context matters. These transfers are likely to provide liquidity for Ripple’s ODL business, not necessarily spot market selling. However, the result is that exchange reserves have climbed to 2.76 billion XRP .

The Good News: While reserves are high, the rate of increase is slowing. Specifically, "whale" transfers to exchanges have dropped 98% from their April 11 peak. The Binance reserve has slightly decreased from 27.7 to 27.6 billion. The aggressive selling from large holders appears to have stopped.

Institutional Dynamics (ETF):

While whales were sending coins to exchanges, institutions were buying XRP ETF products. XRP ETF net flow is strongly positive.

US-listed XRP ETFs recorded four consecutive days of inflows totaling $38.86 million recently .The weekly inflow for mid-April hit $119.6 million, a multi-month high .Cumulative net inflows stand at $12.8 billion, with Assets Under Management (AUM) at roughly $10.8 billion.Analyzing the Divergence: Why Both Flows Are Positive

It seems contradictory that exchange reserves are high (suggesting selling) while ETFs are buying (suggesting buying). However, this phenomenon reveals the current market structure.

Different Investor Profiles: The exchange inflows likely come from short-term traders, market makers, or Ripple itself providing ODL liquidity. These are "hot" coins ready to be sold. The ETF inflows represent "sticky" capital. Institutions buying ETFs are typically long-term holders (LTHs) or asset managers who do not day-trade. They are removing liquidity from the spot market by buying through custodians.The "De-risking" Trade: Sophisticated funds might be engaging in basis trading. They buy the ETF (taking a long position) while simultaneously shorting XRP futures or selling spot inventory to capture the funding rate. This keeps the price stable while volume increases.Absorption: The most likely scenario is that the market is simply absorbing the excess supply. The fact that the price is stable ($1.43) and not collapsing to $1.20 despite 2.76 billion coins sitting on exchanges is a massive win for the bulls. The ETF inflows are acting as a sponge, soaking up the selling pressure from the ODL wallets.The Regulatory Catalyst: The SEC and the CLARITY Act

Fundamentally, the recent price action cannot be separated from regulation. For years, the primary answer was the SEC lawsuit. That narrative is dying.

Ripple CEO Brad Garlinghouse recently praised SEC Chair Paul Atkins as "a breath of fresh air and sanity" . This regulatory thaw is critical. The SEC is reportedly considering dropping the long-standing lawsuit, and five XRP ETF applications are awaiting review.

The major catalyst on the horizon is the CLARITY Act. A Senate markup is expected before the end of April. Standard Chartered analysts project that if the bill advances, it could unlock $4 to $8 billion in institutional flows . Polymarket gives the bill a 60-66% chance of passing in 2026. If the CLARITY Act classifies XRP as a non-security (commodity), the institutional floodgates will open, likely overwhelming the $1.45 supply wall instantly.

Is XRP a Good Investment in 2026?

Given all this data, is XRP a good investment? The answer depends entirely on your risk tolerance and time horizon.

The Bull Case (Why it is a good investment): The risk/reward ratio is asymmetrical to the upside. The price is near multi-year lows relative to its utility. Whale selling has stopped, ETF demand is rising, and the network is expanding (8 million wallets, quantum resistance roadmap). If the CLARITY Act passes, XRP could realistically trade between $1.60 and $1.80 in the short term, with a potential run to $3.00+ if the lawsuit is officially dropped.The Risk Case (Why it is NOT a good investment): There is a clear resistance wall at $1.45. If the CLARITY Act fails or is delayed past May (due to midterm election dynamics), the "buy the rumor, sell the news" dynamic could reverse. If the price fails to break $1.45 and loses support at $1.33, a drop back to $1.15 is technically possible .

Verdict: XRP is a speculative buy for traders looking for a volatility spike. It is a hold for current investors. For new investors, it is only a good investment if you believe in regulatory clarity within the next 30 days. Technically, waiting for a confirmed break above $1.55 (to avoid the fakeout) is safer than buying at $1.43.

FAQ

Q: Will XRP go up if the CLARITY Act passes?

A: Yes, historically. Analysts predict that if the CLARITY Act passes, signaling that XRP is a commodity, it would remove the regulatory overhang. This could trigger a surge in institutional buying, pushing the price from the current $1.43 range to test the $1.80 - $2.00 resistance levels quickly.

Q: Why is XRP dropping when Bitcoin is going up?

A: XRP has specific supply dynamics. Unlike Bitcoin, which has a fixed supply issuance, XRP faces periodic sell-pressure from Ripple's treasury wallets used to fund ODL (liquidity) services. Additionally, the $1.45 "break-even" wall causes XRP to drop relative to BTC when short-term traders exit.

Q: Is a volatility spike imminent for XRP?

A: Yes. The Bollinger Bands on the daily chart are squeezing. The price is stuck between support at $1.33 and resistance at $1.45. Historically, when XRP volume surges 23% in a week (as it did on April 21), it precedes a violent move. The direction depends on whether the $1.45 resistance breaks.

Q: What is the XRP ETF netflow status?

A: As of late April 2026, XRP ETFs are seeing positive netflows. The US ETFs recorded a single week inflow of $119.6 million in mid-April. Cumulative inflows are strong at $12.8 billion, indicating that institutions are accumulating during this dip, which is a long-term bullish signal for price stabilization.

Q: Is XRP a good investment for beginners?

A: XRP is less volatile than "meme coins" but more volatile than Bitcoin. For beginners, it is a moderate-risk investment. Its value is tied to real utility (bank payments). However, beginners should wait to see if the price can close a weekly candle above $1.55 before entering, to avoid buying into the current resistance wall.

Disclaimer: None of the information in this article constitutes, or is intended to constitute, investment advice. Trading cryptocurrencies carries a high level of risk and may not be suitable for all investors. Always do your own research.

About WEEX

Founded in 2018, WEEX has developed into a global crypto exchange with over 6.2 million users across more than 150 countries. The platform emphasizes security, liquidity, and usability, providing over 1,200 spot trading pairs and offering up to 400x leverage in crypto futures trading. In addition to the traditional spot and derivatives markets, WEEX is expanding rapidly in the AI era — delivering real-time AI news, empowering users with AI trading tools, and exploring innovative trade-to-earn models that make intelligent trading more accessible to everyone. Its 1,000 BTC Protection Fund further strengthens asset safety and transparency, while features such as copy trading and advanced trading tools allow users to follow professional traders and experience a more efficient, intelligent trading journey.

Follow WEEX on social media

X: @WEEX_Official

Instagram: @WEEX Exchange

Tiktok: @weex_global

Youtube: @WEEX_Official

Discord: WEEX Community

Telegram: WeexGlobal Group

FC Barcelona vs Celta Vigo: Can Anyone Stop Barcelona at Home?

FC Barcelona vs Celta Vigo lineups, standings, and stats for April 22, 2026. FC Barcelona need a win to stay on track for the La Liga title. Full preview inside.

Carl Moon & WEEX Head to Mugello: The Crypto Trader's Ferrari Challenge

Forget the sidelines. WEEX is hitting the 300km/h mark at Mugello this weekend. Witness Carl Moon’s transformation from a supermarket cashier to a Ferrari racer, and discover why the world’s fastest trading floor belongs on the world’s most technical track at the official Ferrari Challenge.

How to Become a Pro Crypto Trader: WEEX Interview with Ferrari Racer Carl Moon

Ferrari racer Carl Moon on mastering crypto trading: 80/20 rule, AI tools, Bitcoin at $95K, and risk lessons from the track.

Morning Report | Amazon increases investment in Anthropic up to $25 billion; SEC plans to introduce an "innovation exemption" mechanism to support compliant on-chain trading of tokenized securities

Overview of Important Market Events on April 21

Jeff Hoffman, founder of Booking.com: How Web3 and AI are reshaping the trillion-dollar social travel market

The most valuable platforms will not only be aggregators of suppliers, but they will also have networks of relationships around payments, loyalty, and community.

Top 12 Cryptocurrencies to Invest in April 2026

Key Takeaways: Bitcoin remains the dominant player with a $1.42 trillion market cap. Hyperliquid’s HYPE token gains traction,…

18 Best Crypto & Bitcoin Casinos in March 2026

Key Takeaways: Cryptocurrencies offer faster, cheaper, and more private payment options in online casinos. Top crypto casinos include…

Full Post-Mortem of the KelpDAO Incident: Why Did Aave, Which Was Not Compromised, End Up in Crisis Situation?

Key Takeaways: The KelpDAO incident exposed vulnerabilities in collateral pricing and cross-chain bridge operations, affecting Aave’s liquidity. rsETH…

Is MicroStrategy’s STRC Bitcoin’s Savior or Destroyer?

Key Takeaways: MicroStrategy’s STRC offers an annualized yield of 11.5%, driving significant Bitcoin buying pressure. Michael Saylor’s financial…

Ceasefire Expiration and Market Response: Bitcoin Defies Market Trends

Key Takeaways: The current ceasefire agreement is anticipated to expire on Wednesday in Washington, with low likelihood of…

Oil Price Dilemma: More Than a Price Hike

Key Takeaways: Global oil market has surpassed its breaking point, not solving with price hikes but facing significant…

On the Day Aave Launched rsETH, Spark Strategically Exited

Key Takeaways: Aave enabled rsETH lending at a 93% LTV, while Spark withdrew due to low utilization by…

Nasdaq Breaks Record and Crypto Transactions Surge

Key Takeaways: Nasdaq’s rise to a new intraday high indicates strong market momentum. A significant transfer of 35,000…

Powell: Fed Requires a Brand New Inflation Blueprint

Key Takeaways: Powell aims for transformative policy overhauls within the Fed if appointed. Past inflation response mistakes during…

Without Cook’s Apple, Can it Still Grow in the AI Era?

Key Takeaways: John Ternus acts more like a systematic integrator within Apple rather than a solo visionary. Apple’s…

Iran Stock Market and Crypto Developments in Focus

Key Takeaways: The Iranian stock market is set to reopen in 10 to 12 days, excluding companies impacted…

Gate founder Dr. Han: The crypto winter drives structural reshaping, and everything on-chain will become a new paradigm in finance

Is XRP a Good Investment in 2026? Why Is It Stuck at $1.45

TL; DR