Bybit Hack Post-Mortem: Months of Planning, $1.5 Billion Gone, and a Clever Ethereum Trick

The Bybit hack wasn't a smash-and-grab. According to Binance's post-incident analysis, the attackers spent months quietly positioning themselves before making their move — and when they did, they exploited a relatively obscure Ethereum mechanism that made containment far harder than it should have been.

The attack hit multiple chains simultaneously. Hot wallets on Solana and Optimism haemorrhaged roughly 970,500 SOL and 44.2 million OP tokens to attacker-controlled addresses. Then came the main event: 18,270 BTC moved out of a Binance hot wallet in a single transfer.

The clever part — and the part that caused the most headaches — involved EIP-7702, an Ethereum feature that lets an account hand partial execution rights to a smart contract without exposing its private key. It's a legitimate mechanism, designed for flexibility. The attackers weaponised it by using the signing service to grant an attacker-controlled smart contract delegation rights over a Binance hot wallet. Once that authorisation existed on-chain, it operated completely independently of Binance's normal systems.

Binance's internal alerts flagged the large transfers and the team moved quickly: withdrawals suspended, partners coordinated to freeze affected tokens, unauthorised permissions targeted for revocation. All told, $2.85 billion in assets were frozen. Not bad for a rapid response.

But freezing withdrawals wasn't enough to stop everything. The malicious on-chain authorisations kept working regardless. The attackers had submitted 50 signing transactions to manipulate account nonces and cement their delegation setup — meaning even with Binance's infrastructure locked down, assets could still move.

Revoking those authorisations turned out to be its own problem. The hot wallet used Multi-Party Computation, which distributes key material across multiple parties rather than holding a single private key. That's normally a security feature. Here, it meant there was no quick way to unilaterally revoke the malicious EIP-7702 delegations. The team had to develop a bespoke revocation procedure on the fly, which burned additional time while the clock was ticking.

The incident is a fairly stark illustration of how on-chain delegation mechanisms can outpace an exchange's ability to respond. Shutting down your own infrastructure doesn't help much when the attacker has already baked their access directly into the blockchain.