From my experience with Ethereum-related code wallet transfers, it doesn't exactly show the destination; it shows a lot of code. So I checked the code but I didn't check fully. Normally the destination address is not inside that multi-signing. So I signed, and after signing 30 minutes later, we got the emergency call that our Ethereum cold wallet is drained. That's what happened. I will come back to the story, but I understand there are a lot of questions. First of all, we've identified that the hack and the cold wallet that's been signed is the Ethereum cold wallet using Safe. No cold wallet is affected. Our Bitcoin, which is our major reserve, is not affected, and our Bitcoin reserve does not use the Safe mechanism. However, we do have other wallets on Ethereum, whether USDT or other ERC-20 tokens, that also use Safe. For now, we are not touching those wallets. From what we've seen so far, it's only the one we signed that's been compromised. From what we understand, there could be multiple reasons how this happened. But before we go into detail, I want to say that the maximum damage we have witnessed so far is the total amount of around 41,000 Ethereum that's been hacked. This is the affected amount.
No other amount or balances are compromised. Bybit hot wallet is not compromised, bybit warm wallet is not compromised. It is one of our Ethereum cold wallets, which we rely on Safe, that was compromised. I will get to what happened. But before that, I want to say that currently Bybit is still processing withdrawals. I will give you the latest update. We've experienced massive withdrawals since the last two hours. As of maybe 10 minutes ago, we have about 4,000 withdrawals pending. That's because we need to move liquidity into chains. Also, some of these bigger amounts are undergoing regular review by the risk team and security team. That's just a regular platform process whenever a user requests a withdrawal to a destination. Some of them we undergo these checks. But I want to reassure our community that withdrawals are still open, and I believe the majority of clients' withdrawals have already been processed. That's what's going on now.
Next, I think many clients are asking, are my money safe? Yes, I want to guarantee that Bybit is one-to-one backed. We do a monthly proof of reserve audited. All of the money is in the wallet. Even if all Bybit clients withdraw today, we can give your withdrawals with regard to the actual amount, which is around 400,000 ETH. Even the Bybit treasury can cover that. So no matter what, we will make sure all of the clients' money is safe. Your money is safe. Our withdrawals are still open, and some of the withdrawals might take a bit of time as we go through regular checks. But we are aiming at processing all withdrawals within a few hours. I want to reassure that luckily, it is a sad event, but it's only the Ethereum cold wallet that's compromised. We are able to cover this with our treasury if that's the worst-case scenario.
A lot of people are asking, if the funds are safe, why do I need to wait? We've already processed around 70% of the withdrawals, and the peak withdrawal has passed. We are processing the last bit. That's a typical processing time because we experienced almost a 100 times increase in withdrawal amount compared to our regular times. Someone is asking who will cover the loss. We will try our best to chase the fund, and we also rely on your help or our partners' help. We will seek legal and police support to recover this fund. But worst come to worst, our clients' funds are not going to suffer. We will cover it with our company treasuries.
These are some of the biggest questions clients have. If your withdrawals are still on the way or under review, please give us some time. We will get to your withdrawals within hours. All of the clients' withdrawals will be processed. It is an unfortunate event, but we are also seeing that a lot of clients and partners from all over the world are reaching out to me and my team offering help. Thank you so much for all these kind gestures. If we need your help, we will reach out. In terms of the stolen amount, we do need the security team globally to help us track where the funds are going, where the funds are flowing. Maybe we can find a way eventually to track them down, or if it goes to a centralized exchange, that can help us locate this stolen fund.
Some clients are asking, will Bybit buy the missing gap of Ethereum to cover this loss? For immediate sake, we are currently reaching out to our partners to give us a bridge loan. So currently we are not buying, and even if we want to buy, it's too big of an amount to be moving around. But we are getting help and support from our partners. We actually already secured almost 80% of the Ethereum that's been stolen as a bridge loan to give us that liquidity to help us with the liquidity crunch, so we can pass this crucial period. We are not buying ETH at the moment. We are relying on a bridge loan from our partners to help us.
Does it matter if you withdraw Bitcoin, USDT, or other tokens other than Ethereum? No, it doesn't matter. Our other tokens are not affected. Even if you withdraw ETH, we are getting a bridge loan to help satisfy withdrawals. Rest assured that we can cover this stolen amount. Bybit has always kept one-to-one backing to our clients' assets. Even if we are experiencing a bank run, which we already witnessed in the previous two hours, it is not an issue. We have enough tokens to give to the clients for withdrawals.
Let me go back to the incident. I'm getting some of the latest updates. We've also had massive inquiries on our customer support channel. Currently we have 120 people in queue waiting to be served. By the way, all of the Bybit staff are awake right now, all hands on deck. All of our support, withdrawal, risk team, compliance team, everyone is up to serve you and answer any questions. Bybit is here, and I'm here online. If you need to speak to us, you can come to us. It is a sad event that happened, but we want to make sure that our clients feel safe. We are here. Now we have 120 in the queue, but at maximum we had a few thousand. It's been reducing, and we are servicing all of them.
Currently we have about 3,500 withdrawal requests waiting in the queue, but I think we are clearing them. We also see some withdrawals have been approved but through our hot wallet there are some network congestions. Again, if you have a withdrawal request, please wait patiently. We'll get to you within a few hours. There is a bit of congestion on the network of the hot wallet. Clients are asking, does Bybit really have the money to cover the loss? Yes, I said this already. In terms of total AUM, total client assets, Bybit has about more than $20 billion. This stolen Ethereum is around 1/25th of the total AUM. We do have a lot of clients. Currently our security team is also running through all of the other cold wallets to make sure they are not affected. Again, the only cold wallet affected is the Ethereum cold wallet, which we did multi-sign tonight.
Let me go back to the story of what exactly happened. From the latest update I have gotten, the hacker managed to somehow hack the UI of all of the signers' computers. Although we saw the correct URL of the Safe wallet, maybe it was not. It could be that the Safe server was hacked and was sending this. We don't know. We are working very closely with the Safe team to uncover what happened. The latest update I got was that Safe is also pausing their side of servicing to check what exactly happened. From our side, we saw the correct UI and the correct address, and then we signed it. It could be that all of the signers' PCs were hacked and the UI was completely staged. The signing message was not to change the address or the destination or the amount of the specific transfer we approved. The hacker changed that transaction into upgrading or changing the Safe smart contract logic, so that he gained control over the whole Ethereum cold wallet and could transfer the funds out. That's our current understanding. We have the team at full speed checking exactly what happened.
These are some of the major questions people are asking. One user asked, have we received help from other exchanges and partners to block the fund if any? Yes, this really shows the strength of the industry. We've received help from pretty much all the major exchanges: Binance, MEXC, Coinbase, Gate, pretty much all the major players offering help. Deeply appreciate it. It really shows that when an incident like this happens, the industry gets together. Thank you very much. Bybit clients are asking, will Bybit at any time suspend or cancel withdrawals? We don't have the plan to suspend or cancel withdrawals at the moment. We are still receiving all withdrawal requests, and in fact 70% of them have been approved and processed. A lot of the network congestion is still there, so we are processing them as fast as we can.
Are Bybit products still working fine? Yes, all the products are still live. All Bybit services and products are not affected and are ongoing as usual. P2P is still working. A lot of clients are asking, are we going to buy Ethereum again? We are getting a bridge loan from our partners to solve the liquidity crunch, so we are not currently buying any tokens out in the market. A client asked when was the Bybit reserve last audited. I believe it was last month. We do this monthly, and it is audited. All of the Bybit reserve is audited. If you go to Google and search for Bybit proof of reserve, you'll see it.
I think I've answered most of the questions. I will go offline now to get more updates on the incident. If there are more updates, I'll open up another live stream. But before that, we'll keep this one as a record. Maybe I will get Sun, who is our head of derivatives, online to answer some of the questions I already answered. Sun can answer as well for the new joiners. Then I will get more updates on the front line. We'll see you in a bit. Thank you.
Ben's going to be busy making some decisions. Right now, I think there have been a few questions asked, and I'll try to answer them as I know. We discovered this about two hours ago. It affected our Ethereum cold wallet, so those assets have been taken. Some people asked why the cold wallet was still vulnerable. We are still investigating. One thing we always want to make clear is that our treasury can cover all the funds lost, so that's not going to be an issue. Another thing a lot of people are asking is why their withdrawal is blocked or taking so long. To be honest, it's a 100 times increase in withdrawals, and we are working through them. It is becoming a manual approval process for some. We are prioritizing retail clients first, then VIP clients, then institutions. It is going through, and you can see that on the chain.
Ben mentioned that it will be one-to-one. People have been asking if we will buy back the Ethereum that was stolen. Right now, we are working with our partners to get a bridge loan. Once we get enough, we will potentially open up the ability to withdraw Ethereum. Right now, that is not available, so you cannot withdraw Ethereum from our system. Please be patient. Do we have any clue where the hack came from? We are still investigating. If we get any more information, I'll try to alert the group. What measures are you taking to prevent this from happening again? We don't want to say this, but other exchanges have been hacked in the past. We actually have made the procedure internally quite sophisticated, and we are following the most common internal practices. We are going to have a big internal review later to see what actually happened. We are working with our security partners to find out.
There have been a lot of questions. Some products that are exclusive to Bybit, like BB Soul, had depegged but have come back. Market makers have come back. There are questions about whether Bybit is backed one-to-one. Your assets are safe. Our treasury covers all outstanding assets from our clients. But for Ethereum, we have a bridge loan. The decision on what to do to cover the ETH exposure is not yet made. We will have an internal management meeting to see the best course of action because there is a possibility we can recover some of the assets. Many of our partners at other exchanges have been very understanding. They've all given words of support. We believe we will get through this. Please be patient.
There is a question about the size of Bybit's treasury. The treasury part is what is an insurance fund, and there are a lot of assets. The proper answer is that it is owned by the partners in the firm, and they keep all their assets in the firm. I'm not sure how we will decide, but the treasury does cover it by a big margin. Bybit has been around for many years, and we have enough retained earnings to take care of this. Some institutional clients are asking about price differences versus other exchanges. This is common when withdrawals are delayed. Pricing is harder for people who do cross-exchange arbitrage. We rely on our market-making partners to ensure prices are the same across exchanges. Because of the withdrawals, some things have to be manually done. Prices will be slightly different from other exchanges for the time being. That's probably less true for derivatives because that is based on index prices elsewhere, but funding fees will also be slightly different.
Is there any chance of getting back the stolen funds? The funds taken were quite large, so we feel that you really can't change that amount of assets very easily. All liquidity for exchanging assets and for real use will always be on a centralized exchange. That's why people come to large exchanges like Bybit. How many users are affected? To be honest, everyone is affected right now. Some retail clients who are nervous have been able to withdraw their funds, but especially Ethereum holders are affected because Ethereum might not trade at the most accurate price right now. Withdrawing Ethereum right now is going to be difficult. We are getting a bridge loan to solve that. Other chains like Solana withdrawals should be okay.
There are questions about bank runs. This happens to all exchanges after a hack. There will be a withdrawal of assets, usually from smaller clients first. Our big partners usually maintain their assets here. Why do we need a bridge loan? Our reserves and treasury are very different from what was hacked. The asset hacked was Ethereum only. When we say your assets are backed one-to-one, it means our treasury has more than enough reserves to cover the Ethereum notional amount, but we don't have enough Ethereum right now. If you think Bybit needs to buy huge amounts of Ethereum, that might not be the case. We will discuss internally the best course of action. We will compensate our customers. Bybit P2P is still working.
There is a question about the ETH transfer. It is quite common for us in the treasury department to move from cold wallet to hot wallet. Our security team is still looking into the incident to see what exactly happened. I'm going to step away for two minutes to approve something.
Hi, I'm back everyone. I want to mention one thing. I have two roles at Bybit: one is head of derivatives, and the other is head of institutional sales. I know we have a lot of institutional clients contacting me right now. I'm usually in other groups, but now I'm on the live stream, so it's difficult to return all messages. People have been calling me with supportive messages, especially from our market makers and others in the industry. I deeply appreciate that. If you can, please contact the associated relationship managers at Bybit to resolve issues. We are working through them. I apologize. It's funny because I used to work at a market maker myself and have been through sleepless nights. The exchanges we partner with are all still very strong. Bybit has the trust of the industry, and many of our competitors have gone through incidents like this and survived. We definitely are the same here.
Let me see if there are any other questions. I'll rehash some of the questions that might have been asked and answer some interesting ones. One thing is that we want to reiterate that your funds are safe. Our treasury has more than enough coverage for the assets stolen. The asset stolen was Ethereum from our cold wallet. We discovered this three hours ago. We are still looking to understand what happened with our security team internal and external, and also to understand if it could have been a hack across multiple computers or the service we are using might have problems. One question people keep asking, please don't speculate on this: are we going to buy back the Ethereum? The answer now is that we are working with our partners to give a bridge loan so we could cover the withdrawals of Ethereum and fulfill the requests. Every time there is a hack, people withdraw amounts to feel safer. We understand that. It is slowly getting processed. The queue is getting shorter. We prioritize retail first, then VIPs, then institutions. You will see on chain that withdrawals are getting processed.
How will Bybit minimize market impact of the stolen tokens? To trade that amount of assets even on a large CEX is going to be difficult. We can stop them from selling, but they will have a tough time depositing their assets on a large exchange. Our exchange partners, which are often competitors, have been very helpful. When other exchanges were hacked, we were also helpful. Now they are very helpful for us. Many have reached out with nice messages.
There was a question about how you plan to change safe practices. Anytime there is an incident at Bybit, we go through a very long review process to see what we could do. Once we review this incident, we will publish and explain to everyone what the issue was. Bybit has been transparent about what happened. Unless we are giving away secrets, we will also explain the process in a way that is transparent about how we will change this.
Some people have asked about trading across exchanges. Because of the backlog and withdrawals, the pricing on our exchange can be different from other exchanges right now. That is true for spot and derivatives. There is a question about working with custody providers and whitelisted wallets for such transfers in the future. We actually do have a lot of safeguards similar to this already. We work with custody solutions right now for some of our clients to use custody solutions to trade on Bybit. This is a very interesting test to see what happens. They contacted us. Everything is safe. Our procedures will be reviewed to see the best way going forward.
Someone mentioned this seems to be a very sophisticated hack. Yes, we do use multisig hardware and it is multi-signer. We are trying to find another answer. There is an interesting question about Bybit treasury. A lot of it is the partners' assets and retained earnings of Bybit. Should we disclose it? Right now, we always disclose through proof of reserve monthly all the assets on our exchange. Through the Merkle tree proof of reserve, most of our users can see that their assets are on the exchange. I'm not sure if we are going to disclose what is in our treasury. Usually we have disclosed to certain counterparties the size of the treasury but not what is in it.
Okay team, I know I have to hop on and off every once in a while. Ben will also come back on. In my job, I need to click a few buttons to make sure our institutional clients are taken care of. I'll come back in a few minutes. I think I'll be back at 2:30. If Ben isn't back by then, I'll come back and answer questions, rehash the same answers. Thank you everyone.
Hello everyone, we are back live. Sound check, we're good. Thank you guys for staying tuned. It's been almost two hours, or actually a little more than one hour of our live stream. We still have quite a bit of people online wanting to hear the latest updates. Thanks for watching as this event unfolds. Again, I'm Ben, the CEO and co-founder of Bybit. I'm here to give you the latest update on the Ethereum cold wallet hack of Bybit. As far as we know, this could be the largest hack in the history of our industry. For those who are just joining and did not get the previous update, I will give you an overall rundown. First of all, for our users, please rest assured that your funds are safe. What happened was one of the Bybit warm wallet systems. We use hot wallet which is automated, warm wallet, and then a cold wallet. For the cold wallet, we use a multisig that requires multiple signers to sign the transaction to transfer into our warm wallet. Our Ethereum cold wallet was compromised or hacked about three to four hours ago. The reason for the hack could be a UI problem or multiple reasons. But here I want to reassure that for all users of Bybit, your money is safe. Your funds are one-to-one backed. We have monthly proof of reserves that gives you a look at where all the funds are. Bybit has overall $20 billion in client assets, and this hack accounts for about 1/25th of the overall assets. Even with this money, if we unfortunately cannot recuperate any of it, the Bybit exchange will cover it through our treasury so that all users' funds will be covered.
The second question most users care about is withdrawals. Currently, withdrawals are still open. BTC and all other withdrawals are not affected. Understand that it is our cold Ethereum cold wallet that was hacked. So we are experiencing a liquidity crunch on Ethereum withdrawal. A lot of the Ethereum that were users' funds was taken by the hacker. Overall around 400,000 Ethereum, which is about $1.5 billion. However, we are getting a bridge loan from our partners, and we are working on that. Once the bridge loan is in, all Ethereum withdrawals will be completely open. Currently we still have some pending Ethereum withdrawals, but all other withdrawals we are processing as normal. We've experienced a massive withdrawal, or you could call it a bank run, about three hours ago up until now, but we have passed the peak. Most withdrawals have been processed. If you have a large amount of Ethereum, we are getting that liquidity. We are not buying the
Liquidity, we're not buying the Ethereum of the market at the moment. We're getting a bridge loan. And as a company, a lot of our assets, the Bit treasury, is not in Ethereum, it's in Bitcoin, stablecoins, and other measures. So we will use that as a collateral to get the bridge loan of the 400,000 so that you can do the withdrawals. But rest assured that we want to be able to give all of your withdrawals if you choose to do so. Okay, so all Bybit staff is currently on deck. You have my team, my support team, my front line, everyone is on deck. So if you have questions, you can reach out. We are here to answer any questions that you might have. Okay. Again, it's a difficult time and I also want to take this chance to thank the partners and the clients that offered help. Thank you very much. As much needed and we do see a lot of the security companies helping us to trace the fund as well, so we will rely on that. The latest update is that we have filed the police report and also one of the urgent matters now is we are talking to the partners for the bridge loan and I think it's coming in very soon.
So this is part. And then for the majority of withdrawals, they have been processed. Some of the Ethereum withdrawals are pending due to this liquidity crunch, but we are processing it. But rest assured, we do have the assets to cover it. It's just that liquidity on Ethereum is not there at the moment, but we're getting it. Okay, so the reason we're doing this is we want to be fully transparent as this event unfolds and be transparent to the community and to our clients, give you the latest update, letting you know what's happening. But Bit is here to stay. We are not going to back down even after this event. And we're here to answer any of the questions. Okay. Some of the clients are asking, is my money affected? Am I going to suffer a loss? The answer is no. Bybit again is one-to-one backed. All of the clients can withdraw, will be able to withdraw. And this is where we are today. Okay.
Do we have more development on the hack? Currently no. I think our security team and multiple external helping security teams and forensic teams are helping us to discover what happened and how did this hack happen. So when we have more story on that, we will give you the update. Okay. Is USDT withdrawal suspended? No, we have actually abundant of USDT. USDT is completely open. You can still withdraw. So we are not pausing anywhere with USDT. Okay. Clients are seeing some price difference between Bybit and other exchanges. That's correct because we assume some of the clients are selling their assets and want to exchange into stablecoins or other tokens. And so I think this happens whenever a hack event happens at an exchange. But the price will be normalized after some time and we're expecting it to happen quite soon. Okay. Is this the first time that Bybit has been hacked? Yes, it's the first time and unfortunately it is one of the largest as well in the industry, if not the largest. So this is unfortunate.
Clients asking, one of the clients asking, I mentioned that the loss will be covered by the company treasury. Is that cash or coin? Yes, majority of our treasury is in tokens, but it's just not all in ETH or Ethereum. This is why we are seeing a liquidity crunch on the Ethereum tokens. But we are able to use other collateral such as Bitcoin, stablecoins to get a bridge loan and to help with the withdrawal requests. Okay. Clients are suggesting we look into multi-sig solutions. Well, one of the interesting facts is that we are currently talking to multiple partners who are willing to give us a bridge loan, but their assets are also in Safe. As you know, Safe is currently down for maintenance to check if they've been compromised or we've been compromised. And this is why some of these partners cannot give us the bridge loan even if they want to, because their money is also in Safe multisig. But we're solving this as we speak. There are multiple ways to maneuver it. We're working closely with the Safe team to solve this. Okay.
Clients asking, this seems like a sophisticated scam. And if we're considering moving to hardware wallet? Yes, I think after the full examination of the whole incident and event, we will come up with a full transparent security report on what happened, at what time, which action happened, and then what is the future amendment to our safety procedures. And also hopefully this will help no other victim will happen in this way. I don't think this is something we want to see ever happening again to anyone in the industry. Okay. Some clients are asking, can I still deposit money into Bybit? Yes, all of the features and functions and products are still working. It's just that one of our Ethereum cold wallet was compromised in a way that when we sign the transaction to transfer money from cold wallet to warm wallet, the hacker we believe replaced that message into changing the smart contract of the wallet, therefore he gained control. This wouldn't happen on Ethereum, I mean on Bitcoin, because it's not a smart contract multi-sig type of structure. Okay.
Client asking, what is the percentage of Ethereum that was stolen compared to all the ETH? I believe it was around 70%. We normally keep 60 to 70% in the cold wallet and I believe this was the amount. One of the clients suggested maybe considering diversifying the funds into multiple cold wallets so that we don't end up draining one of them. That should for sure be one of the lessons learned. Definitely one of the things we will implement. Okay. Some clients asking, this is scary, please let us know how to be, how this can be avoided again. We will come up with a full incident report and security report on what happened, how can we do better, and how can we prevent it from the future. Okay.
Okay, cool. So I think I've given the quick update. I'm going to go back and get more update from the team. I'm going to let Sun yet come up again to answer a few more questions, and then both of us will go offline to get more updates. And then if there's any update, we'll come back to you on this live stream. Thank you.
Thank you, Ben. Hi, I'm going to introduce myself again. I'm Sun, Bybit's head of derivatives and institutional sales. I think I want to correct the statement I made earlier. I said that everyone is affected. I think, yes, there's been delays and everyone might have been affected by that, but it's like what Ben reiterated earlier, it's only our ETH cold wallet that was compromised. So we are prioritizing our withdrawals with retail clients first and then going to institutional. I know there's been institutional clients who have been contacting me and I apologize I can't respond due to the flow. If you can please contact the group and we are prioritizing retail first, but we will go through the manual procedure and approve everything for institutional. So please have full confidence. I think Ben mentioned earlier there's a few things, especially with Ethereum withdrawals will take a bit longer. And I think there's a comment as I used to be a market maker, prices are slightly different and it'll probably be a little different for Ethereum for a little bit longer as market makers have a tough time moving assets out. But although I've noticed that a lot of the Bybit exclusive tokens are actually now back to regular pricing. I think BB Soul is now back to normal, before it was at a bit of a discount. So things are getting back to normal, so that's good.
Let's see if there's any new questions I could answer. There's an interesting question: what is the collateral for the bridge loan? I think Ben mentioned earlier that the Bybit treasury is mostly Bitcoin and stablecoins. If you think long-term, Bybit was a proprietary, not proprietary, a perpetual exchange initially, and most of our profits and commissions paid by our clients were in stablecoins, so our treasury is mostly in stablecoins.
How is Bybit ensuring liquidity and user front state? I think we mentioned this earlier. Your funds are safe. It's just the Ethereum assets right now from the cold wallet that's missing. And of course, we're getting the bridge loan to make sure that all of our users, starting from retail, can get access to assets. And in liquidity, the liquidity question, how is Bybit ensuring liquidity? I think our market makers have all stepped out and said they're helping. I could see that already. So other than Ethereum assets, I see many things are actually now much closer to what it is on other exchanges. This is I've experienced as a market maker a few hacks before, and every time during a hack, one of the mechanisms for making sure prices are equal across exchanges is the ability to withdraw and deposit assets. So you can deposit assets, but like we said earlier, Ethereum withdrawals are taking time. And I just want to, there's a lot of speculation on X, formerly known as Twitter, are we going to buy the Ethereum? No, we're not buying Ethereum. We're getting a bridge loan to solve the withdrawals. So we will try to work with the police and our partners to recover the assets, and we'll internally decide what we'll do later.
And I think there's other questions about Bybit reserves being audited. We do monthly proof of reserve. I think we'll internally decide maybe we'll do one a little bit faster this time, closer to this incident. And the other cold wallets are not affected. So I think I just want to reiterate this many times: it is only the Ethereum cold wallet that was hacked.
People are asking, is it safe to use now? So I think a lot of our retail customers are able to withdraw assets. I would say, to be honest here, I think everything should be back to normal except for Ethereum pricing. So I would, if you are trading Ethereum related products right now, the pricing might be a little off, but I looked around and I looked at the other assets, they are actually looking better now.
There's a question about what measures are done to find the hackers. So we have contacted the authorities and they are helping us. We work closely with many authorities and into cyber crime, and this is something we have collaborated in the past. We have a relationship with them. And there was a question about P2P trading. Like we said earlier, all the other services are working, including credit card and deposits.
There's a question about risk in accessing the Bybit site. You go to our official website which is bybit.com, that site is still the de facto site for accessing. And also your app on your Android or iOS or Apple device will still definitely be safe.
And I think I'm hearing good news that most of the delays from many of our retail customers have been lowered drastically. And like I said, for many of our institutional clients, please reach out to your relationship manager instead of me directly. We'll try to resolve the issues with withdrawals. And I think I'll be taking a break for about five minutes and I'll come right back and see if there's any new questions and I'll rehash what Ben said earlier.
Hi everyone, welcome back. I'm Sun, I am Bybit's head of derivatives and institutional sales. For those who have just tuned in, I want to sort of give a recap and also clarify some things that are out there. The clarification will be easier. I do see posts on X, formerly known as Twitter, about a comment I made earlier that everyone was affected. I believe that comment was about the experience of withdrawals being delayed, there has been a backlog. We had unprecedented volume in terms of withdrawals which we've been handling. I believe the queue is now very short, and even the backlog for our VIP clients waiting times are now in single digits. So I do want to clarify once again that right now, only our cold wallet for Ethereum was hacked, and all the other assets are safe. Retail withdrawals are proceeding normally. So please don't take this with any other type of FUD. The people that are still affected right now are some of our institutional clients because a lot of that needs manual approval. And also clients who have Ethereum assets. I think Ben mentioned earlier that with Ethereum, we're getting a bridge loan from our partners to cover the withdrawals. And I think the most important thing everyone cares about is: are your assets safe? And is everything backed up one to one? And the answer is yes. For the missing Ethereum assets, our treasury more than covers the assets, and all our clients will be able to take their assets. Your assets are safe at Bybit.
I think I want to mention that I'm looking at the markets and our prices are back in line with many other exchanges except for Ethereum, so that's very good news. All the other facilities at Bybit, including Bybit card, deposits, and most withdrawals except Ethereum, are working. Let's see if there's any questions I could answer. So there is a talk about are market makers leaving Bybit? This is a no. Actually, many of our market makers have reached out with very kind words of support. Our competitors have also reached out, many of our partners have reached out. I think due to the backlog in terms of withdrawals, it is sometimes more difficult for market makers to make markets. You need that fluidity in the withdrawals for that to happen. But I think if you could see, this has come back. The markets are priced in for many of our tokens in line with the rest of the market. And I think I'll go back to some of the more popular questions. One of the most popular questions was: are we going to buy Ethereum in the market? And Ben mentioned earlier, we're actually getting a bridge loan to fill the withdrawals from the exchange, and we do not know what we're going to do in terms of being short Ethereum versus another asset. This will be a management decision we'll talk about later. There is a possibility as we're working with authorities and potentially recovering all or partial part of the assets. So we don't want to affect Ethereum price because that's what everyone is talking about right now.
And I think this has happened almost four hours ago. If we get more information, we'll share. As everyone knows, at Bybit we believe in transparency. This time, we're not sure what happened, if it was a combination of our computers getting hacked or one of our system providers that might have had some issues. So we believe in complete transparency. Once we get more details, we will share with the community.
Hello everyone, this is Ben from Bybit. I'm the CEO and co-founder of Bybit. Sun, technical check, are we live? We all good, okay great. Yes, hello everyone, so thank you for tuning in. This is a very difficult time as all of you are aware that currently, about two hours ago, Bybit experienced a hack on our Ethereum cold wallet. So again, this is Ben, the CEO of Bybit. I'm here to give the full statement and update. I'm intending to make this live stream go a bit longer so I can answer all of our community's questions, concerns, and any issues we can address. So first of all, I want to give everyone the overall what happened. It was about two hours ago, UTC+8 time, 9:30 around 10 o'clock, which I'm actually in Singapore right now, Singapore time. We were doing a regular cold wallet transfer to our warm wallet. We typically do this type of transfer every three weeks, two to three weeks, depending on how much balance we have in the hot wallet. Whenever the hot wallet is reaching a benchmark that we believe needs to be topped up, we will deploy the cold wallet. Bybit uses Safe for our Ethereum related cold wallet as multisig, which means we use the Safe product. I'm not sure if you are aware, it's safe.global. For most of us, we all know that this app is a smart contract level cold wallet multisig. So we have multiple signers signing this transaction targeting a regular transfer from our cold wallet to the warm wallet. When we saw the transaction, it was business as usual. At least speaking for my part, I was the last signer of this transaction. When this transaction came, it was a normal URL. I double checked, it was the Safe URL from the official Safe website. We always use official website, so that was one of the safety protocols we deployed. I checked on that, I clicked on the link and checked, and then I checked the UI, the destination address to make sure that it is our warm wallet. We have a procedure to make sure that it is. All of that checked out. The initial transfer that we made was around I believe 30,000 ETH. It was not a full amount. So we saw, I saw the transaction, I'm the last signer, so I clicked on sign, and I use a Ledger as a hardware device for the last signing part. After I signed and also checked the Ledger screen, one of the issues with the Ethereum related cold wallet transfer is that it doesn't exactly show the destination, it shows a lot of code. So I checked the code, but I didn't check fully. Normally the destination address is not inside that multisig signing. So I signed. After I signed, 30 minutes later we got the emergency call that our cold Ethereum wallet was drained. So this is what happened.
I will come back to the story, but I think I understand there's a lot of questions being asked right now. First of all, we've identified that the hack and the cold wallet that's being signed is the Ethereum cold wallet and their Safe wallet. No other cold wallet is infected. Our Bitcoin, which is our major reserve, is not affected, and our Bitcoin reserve does not use the Safe mechanism. However, we do have other wallets that are on Ethereum, whether it's USDT or other ERC20 tokens, that also use Safe. For now, we are not touching those wallets, and from what we've seen so far, it's only the one we signed that has been compromised. From currently what we understand, there could be multiple reasons how this happened. But before we go into this detail, I want to say that the maximum damage that we have witnessed so far is the total amount of around 41,000 ETH that's been hacked. This is the affected amount. No other balances are compromised. Bybit's hot wallet is not compromised, Bybit's warm wallet is not compromised. It is one of our Ethereum cold wallets, the Ethereum cold wallet which we rely on Safe, that was compromised. I will get to what happened soon. Now, before we go there, I want to say that currently Bybit is still processing withdrawals. I will give you the latest update. We've experienced massive withdrawals since the last two hours, and we currently have about, as of maybe 10 minutes ago, 4,000 withdrawals pending. That's because we need to move liquidity into chains. Also, some of these bigger amounts are undergoing regular review by risk team and security team, and that's just regular platform process whenever a user requests a withdrawal to a destination. Some of them we will undergo these, but I want to rest assured our community that the withdrawal currently is still open and I believe majority of our clients, your withdrawal has already been processed.
Next, I think many clients, we'll open up the floor. I'll get to some of the questions very soon. Some of the clients are asking: is Bybit one-to-one backed? Meaning that we do a monthly proof of reserve, audited proof of reserve, meaning that all of the money is in the wallet. Meaning that if you even today all of the Bybit clients withdraw, we can give your withdrawals with regard to the actual amount which is around 400,000 ETH. Even the Bybit treasury can cover that. So no matter what, we will make sure all of the clients' money is safe. Your money is safe. Our withdrawal is still open, and some of the withdrawals might take a bit of time as we go through the regular checks, but we are aiming at processing all the withdrawals within a few hours. So I want to rest assured, luckily it is a sad event, but luckily it's only the Ethereum cold wallet that's compromised, so we are able to cover this with our treasury if that's the case worst case scenario. Okay.
Okay, so I think a lot of people are asking. Let's see what are some of the other questions the clients have. Some of the clients say, if the funds are safe, why do I need to wait? Right. Again, we've already processed around 70% of the withdrawals and the peak withdrawal has passed. We are really processing the last bit. That's a typical processing time because we've experienced almost 100 times increased withdrawal amount than our regular times. So we are processing them. Someone's asking who will cover the loss. We will try our best to change the fund and we also rely on your help or our partners' help, and then we will of course seek legal and also police support to recover this fund. But again, worst come to worst, our clients' fund is not going to suffer. We will cover it with our company treasuries. Okay. So I think these are some of the biggest questions that clients have. If your withdrawals are still on the way or under review, please give us some time. We will get to your withdrawals basically within the hours. Okay. And all of the clients' withdrawals will be processed. Okay. It is an unfortunate event, but we are also seeing that a lot of the clients and our partners from all over the world are reaching out to me and my team offering help. So thank you so much for all these kind gestures and all your help. If we need your help, we will reach out for sure. Okay. In terms of the stolen amount, we do need the security team globally. If you can help us to track where the funds are going, where the fund is flowing, and maybe we can find a way eventually to track them down or if it goes to a centralized exchange that can help us to locate this stolen fund. Okay. Some clients are asking, will Bybit buy the missing Ethereum to cover this loss? For immediate sake, we are currently reaching out to partners for a bridge loan.
But at maximum we had about a few thousand, but now it's been reducing and we are servicing all of them. Okay. Correct. So currently we have about, I'm asking the team to give me an update on the withdrawals. So as the last update, we have about 3,500 withdrawal requests that are waiting in the queue, but I think we are clearing them. Okay. We also see some of the withdrawals have been already approved, but through our hot wallet there is some network congestion. So again, if you have a withdrawal request, please wait patiently. We'll get to you within a few hours basically. There is a bit of congestion on the network also of the hot wallet. Okay. Clients asking, does Bybit really have the money to cover the client's loss? Yes, so I said this already. Yes, in terms of total AUM, total client assets, Bybit has about more than 20 billion, and this stolen Ethereum is around 1/20th to 1/25th of the total AUM. So we do have a lot of clients. And currently our security team is also running through all of the other cold wallets to make sure that it's not affected again. The only cold wallet that's been affected is the Ethereum cold wallet which we did multisign tonight. And what happened, so maybe I can go back to the story on what exactly happened. At least from the latest update that I have gotten is that the hacker managed to, either some way somehow, hack the UI of all of the signers' computers, so that although we saw it was the correct URL of the Safe wallet, maybe it was not. Or it could be, I'm just saying all the possibilities, I'm not accusing anything, it could be that the Safe server was hacked so it was sending this, but we don't know. We are actually working very closely with the Safe team to uncover what happened. The latest update I got was that Safe is also pausing their side of servicing to check what exactly happened. So we are checking on both sides. But from our side, we saw the correct UI, we saw the correct address, and then we signed it. So it could be that all of the signers' PCs were hacked and the UI was completely staged. What happened is the signing message was not to change the address or the destination or the amount of the specific transfer that we approved. The hacker changed that transaction into upgrading or changing the Safe smart contract logic so that he gained control over the whole cold wallet, that Ethereum specific Safe, so that he could transfer the funds out. So that's our current understanding. We have the team at full speed checking exactly what happened.
Okay, so these are the major questions people are asking. One of the users asking, have we received help from other exchanges and partners to help block the fund if any? Yes, I think this really shows the strength of the industry. We've received pretty much from all the major exchanges, I think Binance, MEXC, Coin, Gate, pretty much all the major players offering help. So deeply appreciate, and I think it's really shows that when an incident like this happens, the industry gets together. So thank you very much for that. Okay. Clients asking, will Bybit at any time suspend or cancel withdrawals? We don't have the plan to suspend or cancel withdrawals at the moment. We are still receiving all the withdrawal requests and in fact 70% of them have been approved and processed. A lot of the network congestion is still there, so we're processing them as fast as we could. Okay. Our Bybit products are still working fine, Bybit card, yes, so all the products are still live. All of the Bybit services and products are not affected and it is ongoing as usual. Okay. P2P still working, yes. A lot of clients asking, are we going to buy Ethereum again? If you missed that part, we are getting a bridge loan from our partners to solve the liquidity crunch, so we are not currently buying any tokens out in the market. A client asking, when was the Bybit reserve last audited? I believe it was last month. We do this monthly and it is audited. So all of the Bybit reserve is audited. If you go to Google and search for Bybit proof of reserve, you can see it. Okay. Very good. I think I've answered most of the questions. I will go offline now. I need to get more updates of the incident. If there's more update, I'll open up another live stream. But before that, we'll keep this one as a record. So maybe Sun yet, actually why not, let me get Sun yet who is our head of derivatives online to answer some of the questions I already answered. So maybe Sun can answer as well for the new joiners. Okay. And then I will get the more updates on the front line. Okay. We'll see you in a bit. Thank you.
