{"slug":"crypto-security-exploits-and-evidence-evolution","reviewed":"2026-10-20","observationPeriod":"2025-02-21/2025-05-27","kind":"empirical","sourceFingerprints":[{"label":"ETH OKX spot USDT hourly archive","sha256":"90a4f4bda9cb9419f7f4b17d964ecb3de68cc9bab9960494bfe605b08ce49881"},{"label":"SUI OKX spot USDT hourly archive","sha256":"97ef3b34cc5699ffe1de7857c0c5a02779b29cb83835aa0c1ac9cef64ed8c6b2"},{"label":"BTC OKX spot USDT hourly archive","sha256":"0c0f771524ac6ee31682afebee3e206ccc4293f082108d2f808bb164d63e28ab"}],"title":["Crypto hacks and price impact: Bybit and Cetus case studies","加密黑客事件如何影响币价？Bybit、Cetus 与资金追回"],"summary":["Review the Bybit hack and Cetus exploit using dated official accounts and ETH, SUI and BTC prices. Separate incident losses, frozen funds and completed recovery.","结合官方有日期说明与 ETH、SUI、BTC 历史行情，辨析 Bybit 黑客事件和 Cetus 攻击，区分损失、冻结资金及完成追回。"],"relatedCoins":["ethereum","sui","bitcoin"],"relatedTopics":["security"],"table":{"caption":["Two selected incidents; related-asset OKX spot returns over the full UTC day","两个选定安全案例；相关资产 OKX 现货完整 UTC 日收益"],"columns":[["Case / UTC day","案例 / UTC 日期"],["Observed asset","观察资产"],["Asset (%)","资产（%）"],["BTC (%)","BTC（%）"],["Difference (pp)","差值（百分点）"]],"rows":[["Bybit · 2025-02-21","ETH","−2.7573","−2.1717","−0.5855"],["Cetus · 2025-05-22","SUI","−0.9545","1.8780","−2.8325"]]},"figures":[],"methods":[{"heading":["A first alert is a claim with a timestamp","首次警报是带时间的待核查主张"],"paragraphs":[["An unusual transfer, a protocol pause and a confirmed exploit are not identical observations. A first alert can precede an explanation of the affected contracts, signing process or accounts. A collector’s first-seen time records when that collector obtained the claim, not necessarily when the attack began or when the public first learned of it.","异常转账、协议暂停和已确认攻击，不是同一种观测。首次警报可能早于对受影响合约、签名流程或账户的解释。采集器首次发现时间记录其取得主张的时刻，不一定是攻击开始或公众首次得知的时刻。"],["As evidence develops, preserve earlier claims and their status instead of silently replacing the initial story. An official response strengthens attribution of what the project or venue says; independent traces and subsequent investigation are still needed to evaluate that statement. Many publishers repeating one post do not create many independent confirmations.","证据变化时，应保留早期主张及其当时状态，避免悄悄替换最初叙事。官方回应增强的是“该项目或交易所这样表述”的归属证据，判断表述仍需独立链上记录与后续调查。多家媒体重复一篇帖子，也不会产生多次独立确认。"]]},{"heading":["Bybit: custody loss and the underlying network are different objects","Bybit：托管损失与底层网络是不同对象"],"paragraphs":[["Bybit’s published timeline describes the 21 February 2025 incident affecting an Ethereum cold-wallet transfer. An exchange custody incident involving ETH is not evidence, by itself, that the Ethereum consensus protocol was compromised. Possible market channels include withdrawal concerns, balance-sheet uncertainty and changes in perceived counterparty risk. Establishing their individual contributions would need additional data.","Bybit 公布的时间线描述了 2025 年 2 月 21 日涉及以太坊冷钱包转账的事件。交易所托管环节发生 ETH 损失，本身不能证明以太坊共识协议被攻破。可能的市场传导包括提现担忧、资产负债表不确定性及对手方风险认知变化，但识别各项贡献还需要额外数据。"],["On that full UTC day, ETH fell 2.7573% in the OKX spot archive and BTC fell 2.1717%, a difference of −0.5855 percentage points. Those prices include trading before and after the incident and other market information. They are market context for a selected case, not a measurement of the loss caused by the hack.","在该完整 UTC 日，OKX 现货归档中 ETH 下跌 2.7573%，BTC 下跌 2.1717%，差值为 −0.5855 个百分点。价格包含事件前后交易和其他市场信息，属于选定案例的行情背景，不是黑客事件造成损失的测量。"]]},{"heading":["Cetus: protocol, network and recovery claims","Cetus：应用协议、网络与追回主张"],"paragraphs":[["Sui Foundation’s 27 May 2025 account describes a community vote concerning funds frozen after the Cetus incident. A freeze, approval to move funds, transfer into a controlled wallet and payment to affected users are separate recovery stages. A recovery plan or loan arrangement should not be reported as proof that every user has already been repaid.","Sui Foundation 在 2025 年 5 月 27 日的说明，描述了对 Cetus 事件后被冻结资金进行处理的社区投票。冻结、批准移动资金、转入受控钱包和向受影响用户付款，是不同追回阶段。追回计划或贷款安排，不能报道成所有用户已经获赔的证明。"],["For 22 May 2025, SUI’s full UTC-day spot return is −0.9545%, while BTC rises 1.8780%, leaving a difference of −2.8325 points. SUI is the network asset, not the Cetus application token or a direct claim on affected pool balances. This observation cannot measure CETUS-token losses, victim recovery or the share of SUI’s move attributable to the incident.","2025 年 5 月 22 日，SUI 完整 UTC 日现货收益为 −0.9545%，BTC 上涨 1.8780%，差值为 −2.8325 个百分点。SUI 是网络资产，不是 Cetus 应用代币，也不是受影响资金池余额的直接请求权。该观测不能测量 CETUS 代币损失、受害者获偿或 SUI 涨跌中由事件解释的比例。"]]},{"heading":["How the price panel and evidence record should be read","如何阅读行情表与证据记录"],"paragraphs":[["Both price rows use complete hourly observations on OKX spot, quoted in USDT, from the previous UTC day’s final close to the incident date’s final close, with BTC matched to the same timestamps. Missing hours are not filled. The two cases were deliberately chosen to illustrate exchange and application incidents; they are not a representative distribution of all crypto exploits.","两行价格均使用 OKX 现货、USDT 计价的完整小时观测，从前一 UTC 日最后收盘到事件日最后收盘，并以相同时间戳配对 BTC。缺失小时不填补。两个案例是为说明交易所与应用事件而选取，不代表全部加密攻击的分布。"],["A useful incident record separately tracks the affected system, the assets observed, the dated claim, the evidence behind it, estimated losses and later recoveries. An estimate can change with token prices or accounting scope. Evidence coverage describes how well a claim is documented; it does not assign a probability that the claim is true or predict a price reversal after confirmation.","有用的事件记录应分别追踪受影响系统、观察资产、有日期的主张、支持证据、估计损失与后续追回。估计值可能随币价或核算范围变化。来源覆盖说明主张被记录的充分程度，不赋予其为真的概率，也不预测确认后价格反转。"]]},{"heading":["How do crypto hacks affect token prices?","加密黑客攻击会怎样影响代币价格？"],"paragraphs":[["Possible channels include custody concerns, liquidity disruption and uncertainty over losses or recovery. The two selected cases provide daily market context, not a universal price-impact estimate or proof that the underlying blockchain was compromised.","可能通过托管担忧、流动性中断，以及损失和追回的不确定性传导。两个选定案例提供全天行情背景，不能估计普遍价格冲击，也不能证明底层区块链被攻破。"]]},{"heading":["Do frozen crypto funds count as recovered user money?","被冻结的加密资金能算作用户已经追回的钱吗？"],"paragraphs":[["Not automatically. Freezing, authorization to move funds, transfer into a controlled wallet and payment to users are distinct stages. Report the documented stage and date instead of treating a recovery plan as completed reimbursement.","不能自动这样计算。冻结、批准移动、转入受控钱包和向用户付款是不同阶段。应报告有文件支持的阶段与日期，不能把追回计划当成已经完成赔付。"]]}],"limitations":["Two purposively selected cases, full-day returns and dated participant accounts. No comprehensive exploit census, precise first-publication reconstruction, causal drawdown distribution or recovery-success rate is estimated. Official statements may be revised and are not independent verification.","两个有目的选取的案例、全天收益与有日期的参与方说明。本文不估计全量攻击统计、精确首次公开时序、因果回撤分布或追回成功率。官方说明可能修订，也不等于独立核验。"],"sources":[{"title":["Bybit: incident timeline and FAQs","Bybit：事件时间线与问答"],"url":"https://www.bybit.com/en/learn/this-week-in-bybit/bybit-security-incident-timeline"},{"title":["Sui Foundation: Cetus incident response and community vote","Sui Foundation：Cetus 事件回应与社区投票"],"url":"https://www.sui.io/blog/cetus-incident-response-onchain-community-vote"},{"title":["OKX historical candle documentation","OKX 历史 K 线文档"],"url":"https://www.okx.com/docs-v5/en/#rest-api-market-data-get-candlesticks-history"}]}