
- Bybit restores stolen 400,000 ETH after the February breach, securing liquidity through loans and large deposits, with an upcoming PoR report to verify reserves.
- Bybit secures $1.23B in ETH following $1.4B hack, using OTC transactions and bridge loans to restore reserves and ensure 1:1 backing for client assets.
Bybit CEO Ben Zhou confirmed on Monday that the exchange has closed the Ethereum (ETH) reserve shortfall following a breach in February. The announcement comes after the hack, which saw the loss of over 400,000 ETH, valued at approximately $1.4 billion. Zhou reassured users that the exchange’s reserves are now fully restored and that an audited proof-of-reserves (PoR) report will be published soon to verify that Bybit’s client assets are completely backed on a 1:1 basis.
Latest Update: Bybit has already fully closed the ETH gap, new audited POR report will be published very soon to show that Bybit is again Back to 100% 1:1 on client assets through merkle tree, Stay tuned. https://t.co/QLa1vOujM6
— Ben Zhou (@benbybit) February 24, 2025

In the wake of the attack, Bybit quickly restored its stolen ETH reserves. According to blockchain analytics firm Lookonchain, Bybit acquired approximately 446,870 ETH, worth around $1.23 billion, through a combination of loans, large investor deposits, and direct ETH purchases. This effort was key in restoring the exchange’s liquidity and operational stability.
Zhou stated that a new PoR report would be available soon, confirming the full recovery of Bybit’s reserves. The report will utilize a Merkle tree, which ensures the data’s integrity and provides users with transparency about the exchange’s backing of client assets.
The Hack: A Major Exploit
The breach, as reported by ETHNEWS, occurred on February 21 and involved a complex attack on Bybit’s Ethereum multi-signature cold wallet. Hackers exploited a phishing vulnerability, manipulating the multi-signature approval process with a fake user interface. This enabled them to steal over 400,000 ETH, raising concerns about Bybit’s ability to meet user withdrawal requests and maintain liquidity.

The attack marked one of the largest security breaches in crypto history. Following the fraud, Bybit experienced a large outflow of assets, with over $6.1 billion withdrawn from the platform over the weekend. The exchange’s total assets under management fell from $16.9 billion to $10.8 billion, leading to fears of a liquidity crisis.
However, as noted in our previous post, Bybit has reaffirmed its ongoing efforts to track and recover the stolen ETH, which has been traced to the Lazarus Group, a hacking collective believed to be connected to North Korea. The exchange continues to work with authorities to track the stolen funds and return them to their rightful owners.
Emergency Liquidity Secured
To address the shortfall and prevent a bank-run-like collapse, Bybit turned to emergency liquidity sources. Zhou referred to these as “bridge loans” from partners within the crypto industry, aimed at providing the short-term liquidity needed to stabilize operations. Bybit also restocked its ETH reserves through OTC transactions and centralized and decentralized exchanges.
The largest contribution came from an OTC transaction, which added 157,660 ETH ($437.8 million) to Bybit’s reserves. Additional deposits came from CEX and DEX platforms, contributing 109,033 ETH ($304.1 million). Bybit also received loans from institutions, including a 47,800 ETH loan ($127.5 million) and a 40,000 ETH loan ($106 million) from crypto exchange Bitget.
The post Bybit CEO Confirms ETH Reserve Shortfall Closed – Audited POR Report Incoming appeared first on ETHNews.