Bybit: about $1.46B hack on Ethereum

. Reported by public sources (confirmed by SlowMist). Amounts are as reported; the trace below shows what the chain says.

On 2025-02-21 at 14:15 UTC, according to SlowMist, a Bybit cold wallet on Ethereum was drained of about $1.5B in ETH and staked ETH. KadenaTrace's automatic trace shows roughly $1.42B moved out of the exploiter address 0x47666F…86E2, including $258.7M swapped on Swap and $23.3M swapped on Uniswap, with about $1.3M still held in traced wallets. The trace also records smaller bridged amounts, including $747,288 through SpokePoolVerifier and $272,385 through THORChain to Bitcoin. Funds were moved through several hops of intermediate wallets, and the records below are KadenaTrace's own observations. The status is watching: the funds' movements are being recorded as KT-4, and no recovery or freezing of funds is reported in the material available.

Amount: about $1.46B (reported). Networks: Ethereum.

What is known

Reported
By SlowMist.
Confirmed
Confirmed by SlowMist. The amount is as reported.
Recorded on Kadena
As KT-4: each move of the funds is written to a public contract.
Attacker address
1 address attributed by the reports.
Exchange deposits
None seen so far.
Frozen
No freeze read on chain.
Returned
No return of funds recorded here.
Trace coverage
The coverage of this trace was not recorded (traced before Oct 31, 2026); totals are lower bounds until the next refresh.

Addresses attributed to the attacker

Where the funds went

From the trace so far: at least $1.3M still held; $747K bridged via SpokePoolVerifier; $272K bridged via THORChain to Bitcoin. A deposit at an exchange is not a freeze or a recovery.

$1.42B followed across 3385 addresses so far from 0x47666F…9486E2.

Recorded on Kadena as KT-4: every move of the funds is written to a public contract.

Sources

Timeline

  1. 0.0237 ETH moved to 1inch (hop 10) transaction
  2. 0.0136 ETH moved to Aggregation Router V5 (hop 10) transaction
  3. 0.7328 ETH moved to Uniswap (hop 10) transaction
  4. 0.1522 ETH moved to Uniswap (hop 10) transaction
  5. 0.0452 ETH moved to Uniswap (hop 10) transaction
  6. 0.9636 ETH moved to 0xc02aaa…6cc2 (hop 9) transaction
  7. 142.1322 USDT moved to Bybit (hop 7) transaction
  8. 2,251.998 USDC moved to 0xfa103c…cdef (hop 8) transaction
  9. 0.028 WBTC moved to Swap (hop 8) transaction
  10. 0.9613 WETH moved to Swap (hop 8) transaction
  11. 0.028 WBTC moved to Swap (hop 8) transaction
  12. 0.0326 ETH moved to Swap (hop 8) transaction
  13. 0.028 WBTC moved to Swap (hop 8) transaction
  14. 0.0292 ETH moved to Swap (hop 8) transaction
  15. 0.028 WBTC moved to Curve (hop 8) transaction
  16. 0.9613 WETH moved to Swap (hop 8) transaction
  17. 0.9613 WETH moved to Swap (hop 8) transaction
  18. 0.7506 WETH moved to Swap (hop 8) transaction
  19. 0.9613 WETH moved to SushiSwap (hop 8) transaction
  20. 0.9613 WETH moved to Swap (hop 8) transaction
  21. 0.9613 WETH moved to Swap (hop 8) transaction
  22. 0.0182 ETH moved to Swap (hop 8) transaction
  23. 0.9613 WETH moved to Swap (hop 8) transaction
  24. 0.0546 ETH moved to Swap (hop 8) transaction
  25. 0.6432 WETH moved to Swap (hop 8) transaction

Read: Tracing stolen crypto across chains and bridges.

Facts about addresses and transactions, never about people. Trace a wallet · Check an address · All live incidents