On February 21, 2025, major crypto exchange, Bybit lost $1.4 billion in Ethereum in a hack believed to be orchestrated by North Korean group, Lazarus.
Adam Back, a prominent cypherpunk and Blockstream CEO, shared his analysis recently blaming Ethereum Virtual Machine (EVM) for its role.
He pointed to EVM’s complexity, noting that hardware wallets like Ledger struggle to verify its transactions due to low processing power, leading to blind signing.
This vulnerability, he argued, enabled hackers to drain Bybit’s cold wallet during a $100 million transfer attempt. The hack sparked debate among experts.
Bitcoin maximalists, including JAN3 CEO Samson Mow, suggested rolling back the Ethereum chain, referencing the 2016 DAO hack.
However, the Ethereum team on February 23, 2025, stated the transaction was legitimate.
Bybit’s CEO confirmed on February 23, 2025, that liquidity was restored, per their official statement.
An unexpected detail is how hardware wallets’ limitations with EVM transactions highlight broader security challenges.
Back’s mention of Ledger hardware wallets’ inability to verify EVM scripts due to low power adds a layer of complexity to the debate.
And it suggests that hardware infrastructure may need upgrades.
Back’s X post highlighted that the EVM’s intricate design, particularly its handling of Ethereum transactions, facilitated the hack.
He explained that Bybit was attempting to send $100 million worth of Ethereum from a cold wallet to a hot one. However, a blind signing mechanism was involved.
This mechanism, he argued, allowed hackers to exploit the smart contract, draining the entire $1.4 billion in ETH from Bybit’s cold wallet.
Referring to hardware wallets like Ledger, Back stated,
“HWW are far too low power to interpret and contain the information to verify EVM over-complex scripts and state.”
He further described EVM as “complex, fragile, blind-signed, un-securable” in his post, suggesting that its design inherently compromises security.
Perceived Advantages Boosting Bitcoin’s Dominance
Back’s comments also framed the hack as a boost for Bitcoin’s dominance. He noted, “Bitcoin is secure and designed clearly with security first approach.”
Meaning that Bitcoin’s simpler, more robust design offers better security compared to Ethereum’s EVM-reliant system.
Source: X
This perspective aligns with his role as a Bitcoin maximalist, emphasizing Bitcoin’s advantages in the wake of Ethereum’s vulnerabilities.
The market reaction, while not detailed in the data, can be inferred from the ongoing debate, with Bitcoin maximalists like JAN3 CEO Samson Mow adding to the discourse.
The Bybit hack reignited discussions about Ethereum’s protocol integrity. Some Bitcoin maximalists, including Samson Mow, ironically suggested rolling back the Ethereum chain to recover the lost funds, drawing parallels to the 2016 DAO hack.
That incident, where $60 million in ETH was stolen, led to a hardfork and the creation of Ethereum Classic.
However, the Ethereum team, as per their statement on February 23, 2025, clarified that the transaction draining Bybit’s wallet was legitimate under the Ethereum protocol, refusing to consider a rollback.
Bybit’s Response and Liquidity Recovery
Bybit’s CEO, in an official statement on February 23, 2025, confirmed that the exchange had fully closed the gap in ETH liquidity, addressing the immediate financial impact of the hack.
This move, while stabilizing operations, does not resolve the underlying security concerns raised by Back regarding the EVM.
