Key findings
- In two selected incident case studies, full-day OKX spot returns trailed BTC by −0.5855 percentage points for ETH (Bybit incident, 21 February 2025) and −2.8325 points for SUI (Cetus incident, 22 May 2025). Evidence →
- Exchange custody breaches, application-layer exploits and underlying blockchain consensus failures involve distinct risk channels. Evidence →
- Freezing funds, governance votes to move assets and completed user reimbursement are separate recovery stages that should be reported distinctly. Evidence →
| Case / UTC day | Observed asset | Asset (%) | BTC (%) | Difference (pp) |
|---|---|---|---|---|
| Bybit · 2025-02-21 | ETH | −2.7573 | −2.1717 | −0.5855 |
| Cetus · 2025-05-22 | SUI | −0.9545 | 1.8780 | −2.8325 |
A first alert is a claim with a timestamp
An unusual transfer, a protocol pause and a confirmed exploit are not identical observations. A first alert can precede an explanation of the affected contracts, signing process or accounts. A collector’s first-seen time records when that collector obtained the claim, not necessarily when the attack began or when the public first learned of it.
As evidence develops, preserve earlier claims and their status instead of silently replacing the initial story. An official response strengthens attribution of what the project or venue says; independent traces and subsequent investigation are still needed to evaluate that statement. Many publishers repeating one post do not create many independent confirmations.
Bybit: custody loss and the underlying network are different objects
Bybit’s published timeline describes the 21 February 2025 incident affecting an Ethereum cold-wallet transfer. An exchange custody incident involving ETH is not evidence, by itself, that the Ethereum consensus protocol was compromised. Possible market channels include withdrawal concerns, balance-sheet uncertainty and changes in perceived counterparty risk. Establishing their individual contributions would need additional data.
On that full UTC day, ETH fell 2.7573% in the OKX spot archive and BTC fell 2.1717%, a difference of −0.5855 percentage points. Those prices include trading before and after the incident and other market information. They are market context for a selected case, not a measurement of the loss caused by the hack.
Cetus: protocol, network and recovery claims
Sui Foundation’s 27 May 2025 account describes a community vote concerning funds frozen after the Cetus incident. A freeze, approval to move funds, transfer into a controlled wallet and payment to affected users are separate recovery stages. A recovery plan or loan arrangement should not be reported as proof that every user has already been repaid.
For 22 May 2025, SUI’s full UTC-day spot return is −0.9545%, while BTC rises 1.8780%, leaving a difference of −2.8325 points. SUI is the network asset, not the Cetus application token or a direct claim on affected pool balances. This observation cannot measure CETUS-token losses, victim recovery or the share of SUI’s move attributable to the incident.
How the price panel and evidence record should be read
Both price rows use complete hourly observations on OKX spot, quoted in USDT, from the previous UTC day’s final close to the incident date’s final close, with BTC matched to the same timestamps. Missing hours are not filled. The two cases were deliberately chosen to illustrate exchange and application incidents; they are not a representative distribution of all crypto exploits.
A useful incident record separately tracks the affected system, the assets observed, the dated claim, the evidence behind it, estimated losses and later recoveries. An estimate can change with token prices or accounting scope. Evidence coverage describes how well a claim is documented; it does not assign a probability that the claim is true or predict a price reversal after confirmation.
How do crypto hacks affect token prices?
Possible channels include custody concerns, liquidity disruption and uncertainty over losses or recovery. The two selected cases provide daily market context, not a universal price-impact estimate or proof that the underlying blockchain was compromised.
Do frozen crypto funds count as recovered user money?
Not automatically. Freezing, authorization to move funds, transfer into a controlled wallet and payment to users are distinct stages. Report the documented stage and date instead of treating a recovery plan as completed reimbursement.
Limitations
Two purposively selected cases, full-day returns and dated participant accounts. No comprehensive exploit census, precise first-publication reconstruction, causal drawdown distribution or recovery-success rate is estimated. Official statements may be revised and are not independent verification.