Crypto hacks and price impact: Bybit and Cetus case studies

A first alert is a claim with a timestamp

An unusual transfer, a protocol pause and a confirmed exploit are not identical observations. A first alert can precede an explanation of the affected contracts, signing process or accounts. A collector’s first-seen time records when that collector obtained the claim, not necessarily when the attack began or when the public first learned of it.

As evidence develops, preserve earlier claims and their status instead of silently replacing the initial story. An official response strengthens attribution of what the project or venue says; independent traces and subsequent investigation are still needed to evaluate that statement. Many publishers repeating one post do not create many independent confirmations.

Bybit: custody loss and the underlying network are different objects

Bybit’s published timeline describes the 21 February 2025 incident affecting an Ethereum cold-wallet transfer. An exchange custody incident involving ETH is not evidence, by itself, that the Ethereum consensus protocol was compromised. Possible market channels include withdrawal concerns, balance-sheet uncertainty and changes in perceived counterparty risk. Establishing their individual contributions would need additional data.

On that full UTC day, ETH fell 2.7573% in the OKX spot archive and BTC fell 2.1717%, a difference of −0.5855 percentage points. Those prices include trading before and after the incident and other market information. They are market context for a selected case, not a measurement of the loss caused by the hack.

Cetus: protocol, network and recovery claims

Sui Foundation’s 27 May 2025 account describes a community vote concerning funds frozen after the Cetus incident. A freeze, approval to move funds, transfer into a controlled wallet and payment to affected users are separate recovery stages. A recovery plan or loan arrangement should not be reported as proof that every user has already been repaid.

For 22 May 2025, SUI’s full UTC-day spot return is −0.9545%, while BTC rises 1.8780%, leaving a difference of −2.8325 points. SUI is the network asset, not the Cetus application token or a direct claim on affected pool balances. This observation cannot measure CETUS-token losses, victim recovery or the share of SUI’s move attributable to the incident.

How the price panel and evidence record should be read

Both price rows use complete hourly observations on OKX spot, quoted in USDT, from the previous UTC day’s final close to the incident date’s final close, with BTC matched to the same timestamps. Missing hours are not filled. The two cases were deliberately chosen to illustrate exchange and application incidents; they are not a representative distribution of all crypto exploits.

A useful incident record separately tracks the affected system, the assets observed, the dated claim, the evidence behind it, estimated losses and later recoveries. An estimate can change with token prices or accounting scope. Evidence coverage describes how well a claim is documented; it does not assign a probability that the claim is true or predict a price reversal after confirmation.

How do crypto hacks affect token prices?

Possible channels include custody concerns, liquidity disruption and uncertainty over losses or recovery. The two selected cases provide daily market context, not a universal price-impact estimate or proof that the underlying blockchain was compromised.

Do frozen crypto funds count as recovered user money?

Not automatically. Freezing, authorization to move funds, transfer into a controlled wallet and payment to users are distinct stages. Report the documented stage and date instead of treating a recovery plan as completed reimbursement.

Limitations

Two purposively selected cases, full-day returns and dated participant accounts. No comprehensive exploit census, precise first-publication reconstruction, causal drawdown distribution or recovery-success rate is estimated. Official statements may be revised and are not independent verification.

Sources and data access

• Bybit: incident timeline and FAQs
• Sui Foundation: Cetus incident response and community vote
• OKX historical candle documentation

Cited sources document external facts or data formats; they do not endorse our findings. The public snapshot contains the table and methods. Source-file fingerprints are included for recalculated datasets. Full archived raw files are not distributed here; fingerprints identify the files used, rather than independently proving the results.

Aggregate data snapshot (JSON) · Markdown · Methods and limitations

Live prior 30-day hourly baseline — separate from the historical study

Only the current watch list is shown, up to 12 assets. Missing or stale estimates remain unavailable. Venue and quote currency are kept separate; beta needs matching BTC data. Hourly statistics are not minute-move probabilities.

Observation cutoff (UTC): 20/10/2026, 14:58

Related research