Cryptocurrency exchange Bybit has successfully replaced $1.4bn worth of Ethereum stolen in last week's unprecedented cyber attack. The exchange executed a series of rapid purchases across multiple venues to restore its reserves.
Chief executive Ben Zhou confirmed the full restoration of client assets on Saturday. "We have fully closed the ETH gap," Zhou stated on X, formerly Twitter. He announced that an independently audited proof-of-reserve report would soon verify the exchange's 1:1 asset backing through Merkle tree verification.
Blockchain analytics firm Lookonchain has tracked substantial ethereum inflows to Bybit-linked addresses. The exchange secured 446,870 ether through a combination of loans, large-scale deposits, and direct purchases. This represents nearly 88% of the funds stolen by North Korea's Lazarus Group on Wednesday.
Detailed transaction records show a Bybit-associated wallet purchased 157,660 ether, valued at $437.8m, from institutional counterparties. The buyers included Galaxy Digital, FalconX, and Wintermute in over-the-counter deals.
A second wallet address, identified by researchers at Arkham Intelligence as likely controlled by Bybit, acquired an additional $304m worth of ether. These purchases were executed across both centralized and decentralized exchanges, including interactions with Binance and MEXC hot wallets.
The first significant purchase was recorded on Thursday at 4:44 pm UTC. The rapid response came as Bybit faced withdrawal pressure, with customers pulling out $5.3bn on Thursday alone.
Despite the turbulence, proof-of-reserve auditor Hacken reports that Bybit's reserves continue to exceed its liabilities. The platform maintains $10.9bn in total assets, according to DeFiLlama's tracking data.
The hack represents the largest cryptocurrency theft in history. It accounts for more than 60% of all digital assets stolen in 2024 to date. The incident briefly rattled markets, with ether's price dropping 7% from $2,831 to $2,629 in seven hours following the attack. The cryptocurrency has since rebounded to $2,765.
This disruption triggered intense market monitoring, as traders assessed the broader implications for cryptocurrency security. Zhou's announcement appears aimed at restoring confidence in the exchange's operational resilience.
The rapid recovery demonstrates the crypto industry's growing capacity to respond to large-scale security breaches. However, questions remain about the long-term implications of North Korean state-backed actors successfully executing such significant attacks.