The Bybit hack: what every business that takes payments can learn
The largest crypto theft in history did not need to break the blockchain. It fooled people into approving a transaction that looked normal. That is a risk every business shares.
By the Xuru Technologies team · 27 February 2025
Key takeaways
- On 21 February 2025, attackers stole around US$1.5 billion in digital assets from exchange Bybit.
- Investigators said the attackers manipulated what signers saw when approving a routine wallet transfer.
- The FBI attributed the theft to North Korean hackers.
- For ordinary businesses, the lessons are about verifying approvals, securing suppliers and resisting social engineering.
Most businesses will never hold crypto. But most do approve payments, change bank details, give suppliers access to systems and trust what their screens show them. That is exactly where this attack worked.
What happened
According to BleepingComputer and The Register, attackers compromised the process Bybit used to move funds from cold storage, so that signers approved a transaction that secretly handed control to the thieves. The FBI attributed the theft to North Korea's "TraderTraitor" activity, also known as Lazarus Group. Bybit said customer balances were covered.
What it means for businesses
- Approvals can be spoofed. If one screen shows the details, attackers will target that screen. Independent verification matters.
- Suppliers are part of your attack surface. Tools and vendors with access to your systems can be the way in.
- Social engineering is the common thread. Fake invoices, changed bank details and urgent requests remain the most common fraud against small firms.
- Recovery plans matter. Bybit could cover losses; most small businesses cannot, so prevention is everything.
What to do now
| Control | How |
|---|---|
| Two-person approval | Large payments and bank detail changes need a second person |
| Out-of-band checks | Confirm new bank details by phone on a known number, never the one in the email |
| Least access | Give suppliers only the access they need, and remove it when work ends |
| 2-step verification | On email, banking, domain, website admin and payment accounts |
| Website security | Updates, backups and monitoring on any site that takes payments |
Our account lockout prevention checklist covers the accounts to secure first.
Frequently asked questions
Is my website at risk if I take card payments?
If you use a reputable payment provider with hosted checkout, card data usually never touches your server. Your site still needs updates and monitoring so attackers cannot alter payment pages.
What is social engineering?
Tricking people into giving access or approving actions, for example through convincing emails, calls or fake websites.
How often should we review access?
At least every quarter, and immediately when a staff member or supplier leaves.
Payments and logins you can trust.
We build and maintain websites with secure payment integrations, 2-step logins, backups and monitoring.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed