Banking & Finance

Dubai crypto regulator Vara monitoring Bybit hack

February 24, 2025, 12:20 PM

Bybit customers withdrew more than $5bn from the Dubai-based exchange after the hack

$1.4bn hack at Bybit exchange
Exchange not yet Vara licensed
Reward of up to $140m offered

Dubai’s Virtual Assets Regulatory Authority (Vara) has said it is “actively monitoring” the fallout from a $1.4 billion hack at Bybit, a cryptocurrency exchange that has fallen victim to what it calls crypto’s largest heist.

Dubai-based Bybit said hackers exploited a smart contract – a self-executing program that automates blockchain transactions – during a routine transfer between its “cold” and “hot” wallets on February 21.

A “cold” wallet is offline for more secure storage, whereas a “hot” wallet is online storage for quicker access.

“We have been actively monitoring the situation since the hack on Bybit was confirmed,” a Vara spokesperson told AGBI.

“This remains a highly evolving matter that we will continue to closely track until it stabilises.”

Bybit is not yet licensed by Vara although it has applied, the authority’s spokesperson said. Vara only regulates the emirate of Dubai within the seven-member UAE federation.

The Bybit breach allowed hackers to seize ETH400,000, worth approximately $1.4 billion at the time.

Bybit, the world’s second-largest crypto exchange by trading volume after Binance, said in a statement on Sunday that it is offering a bounty worth 10 percent of recovered funds – or up to $140 million – to cybersecurity and blockchain analysts who help track and retrieve the stolen assets.

The attack triggered more than $5 billion in withdrawals from the exchange.

Bybit co-founder and CEO Ben Zhou sought to reassure users, saying client funds remained safe.

“Bybit is solvent even if this hack loss is not recovered,” Zhou said in a post on X. “All client assets are one-to-one backed; we can cover the loss.”

Zhou said Bybit holds $20 billion in assets, with a “cold” wallet containing nearly $3 billion in USDT, which remains secure.

USDT, also known as tether, is a so-called stablecoin that aims to be less volatile than cryptocurrencies such as ethereum and bitcoin.

Bybit is exploring a bridge loan from partners to maintain liquidity.

“We are able to use other collateral such as bitcoin and stablecoins to get a bridge loan,” Zhou said during a live stream on social media, adding that the company was in talks with multiple partners.

Withdrawals remain open, with retail clients prioritised over VIPs and institutional investors, he added. Bybit said it processed more than 350,000 withdrawal requests within 12 hours of the hack.