Bybit, February 2025: a poisoned Safe{Wallet} front-end and $1.46 B signed away

What happened

On Friday 21 February 2025, the Dubai-based cryptocurrency exchange Bybit lost roughly $1.46 billion in Ether and ERC-20 tokens from one of its Ethereum cold wallets in what Elliptic described as the largest confirmed crypto theft in history ^[8][18]. Bybit's own breakdown of the loss was 401,347 ETH ($1.12 billion), 90,375 stETH ($253.16 million), 15,000 cmETH ($44.13 million) and 8,000 mETH ($23 million) ^[13]. The FBI and CNBC rounded the figure to approximately $1.5 billion, while Verichains' preliminary report put it at 'over $1.4 billion' ^[1][2][3]. By comparison, the previous record was the $611 million taken from Poly Network in 2021, most of which was later returned ^[1][8].

The theft occurred during what Bybit described as a routine transfer from an Ethereum multisig cold wallet to a warm wallet, which began at 13:30 UTC with a 30,000 ETH tranche ^[13]. At 14:13 UTC a second multisig transaction, approved by three Bybit signers including the chief executive, was executed ^[3][13]. The signers believed they were approving an ordinary transfer; what they actually signed was an upgrade of the cold wallet's smart-contract logic to an attacker-controlled implementation, which the attackers then used to sweep the wallet ^[3][4].

The deception did not come from Bybit's own systems. Bybit's engaged forensic firms, Sygnia and Verichains, found no indication of compromise within Bybit's infrastructure ^[5]. Instead, the signers' browsers had loaded JavaScript from app.safe.global, the web front-end of the Safe{Wallet} multisig product, and that JavaScript had been modified to alter transactions for Bybit's specific wallet while displaying the original, benign transaction details ^[3][4]. Safe's own statement confirmed the attack 'was achieved through a compromised Safe{Wallet} developer machine resulting in the proposal of a disguised malicious transaction', and stated that external reviewers found no vulnerabilities in the Safe smart contracts or in the source code of its front-end and services ^[6].

Bybit's co-founder and CEO Ben Zhou posted about the incident at 15:44 UTC, stating that the attackers had 'took control of the specific ETH cold wallet' and that Bybit remained solvent with client assets backed 1:1 ^[13]. He said Bybit would cover the loss even if nothing was recovered, and CNBC reported a bridge loan from undisclosed partners ^[1][16]. Within 10 hours Bybit had processed 99.994% of more than 350,000 withdrawal requests, and by 24 February it had received $1.23 billion in ETH through bridge loans, whale deposits and over-the-counter purchases ^[13].

How they got in

The intrusion began at Safe{Wallet}, not at Bybit. According to Mandiant's preliminary report, which Safe published on X and Sygnia summarised, the earliest identified malicious activity was on 4 February 2025, when the macOS workstation of a Safe{Wallet} developer referred to as 'Developer1' was compromised, most likely through social engineering ^[4]. The first observed indicator was a Docker project named 'MC-Based-Stock-Invest-Simulator-main' initiating network traffic to the domain getstockprice[.]com; the container files sat in the developer's Downloads folder, which Mandiant read as a sign of a lure delivered directly to the victim ^[4]. Mandiant noted strong similarities in attack flow, container name, domain naming and internal file structure to earlier heists it had investigated and to SlowMist's published research on Lazarus Group social-engineering campaigns against developers ^[4].

On 5 February 2025 the developer's AWS access token was used to reach Safe{Wallet}'s AWS infrastructure ^[4]. Access came from ExpressVPN IP addresses with a user-agent string identifying Kali Linux, a distribution commonly used by red teams and threat actors ^[4]. The attackers tried and failed to register an additional MFA device on the compromised account ^[4]. Because Safe{Wallet}'s configuration required MFA re-authentication for Security Token Service sessions every 12 hours, the intruders instead relied on a hijacked, still-valid session token, likely extracted by malware on Developer1's machine, and adjusted their working hours to match the developer's schedule ^[4]. Mandiant also reported use of the open-source MythicAgents offensive framework ^[4].

Sygnia's timeline places the attackers inside Safe{Wallet}'s AWS environment from 5 February until at least 17 February, a phase it characterised as reconnaissance, noting that little else about this period had been disclosed ^[4]. Bybit's 26 February press release summarised the same chain more bluntly: 'the credentials of a Safe developer were compromised', which 'allowed the attacker to gain unauthorized access to the Safe{Wallet} infrastructure and totally deceive signers into approving a malicious transaction' ^[5]. The Block reported that it remained unclear exactly how the developer machine was breached and whether other Safe users had been at risk, and that former Binance CEO Changpeng Zhao publicly questioned how a developer machine came to have access to an account used by Bybit ^[11].

How it escalated

With access to the S3 bucket that served app.safe.global, the attackers prepared the on-chain side first ^[4]. Verichains' timeline records a malicious contract deployed at 15:39:11 UTC on 18 February 2025 at 0x9622...7242, containing the transfer logic, and a second contract with withdrawal capabilities at 0xbDd0...9516 at 18:00:35 UTC the same day ^[3]. A table in the same report gives the second contract's deployment as 19 February 2025 at 07:15:23 UTC, so the exact deployment time of the implementation contract is inconsistent within the primary source ^[3]. The attackers also created their own Safe multisig at 0x19C6...d141 and ran a test transaction simulating the real exploit before touching Bybit ^[3].

On 19 February 2025 two JavaScript bundles on app.safe.global, _app-52c9031bfa03da47.js and 6514.b556851795a4cbaa.js, were replaced with modified versions; their Last-Modified headers read 15:29:43 and 15:29:25 UTC respectively, and a Wayback Machine snapshot from 17:29:05 UTC that day captured the malicious code ^[3]. Sygnia independently confirmed that the resources were last modified on 19 February, two days before the theft, and that the malicious code originated from Safe{Wallet}'s own AWS infrastructure rather than from the signers' machines ^[4]. The payload carried hard-coded activation conditions: it checked whether the connected Safe was one of two addresses, Bybit's cold wallet 0x1db9...cf4 or the attackers' test Safe, and whether the transaction's operation field was 0, the default for a plain call ^[3][4]. For every other Safe user the code was inert, which is why it went unnoticed on a public front-end for two days ^[3].

When the conditions matched, the injected code cloned the original transaction data, then overwrote the 'to' field with the attacker's contract, changed the operation from 0 to 1 (a delegatecall), replaced the calldata with an encoded payload referencing the implementation contract, set the value to 0 and fixed safeTxGas at 45746 ^[3]. It passed the altered transaction to the Safe SDK's signTransaction or executeTransaction method, then restored the original data to the result object and the transaction object so that nothing downstream in the UI would show the tampering ^[3]. A third patch to the useGasLimit function returned a fixed gas limit of 218207 for the targeted Safe, which Verichains assessed as a way to keep the gas estimate from exposing the changed calldata ^[3]. The practical effect was that each signer's screen displayed a legitimate cold-to-warm transfer while their hardware device signed a delegatecall to an attacker contract; The Block described this as the use of 'blind signatures' to trick signers into interacting with an unfamiliar address by masking the UI ^[7][11].

At 14:13:35 UTC on 21 February 2025 the transaction was executed with signatures from three Bybit signers ^[3]. The delegatecall replaced the cold wallet's implementation with the pre-deployed malicious contract, which exposed sweepETH and sweepERC20 functions, and the attackers used those to transfer more than 400,000 ETH plus the liquid-staking tokens out of the wallet without any further multisig approval ^[3][4]. Verichains and Sygnia both found the malicious JavaScript in the Google Chrome cache on all three signers' hosts ^[3][4]. Roughly two minutes later, at about 14:15 UTC, both JavaScript files on app.safe.global were overwritten with clean versions, which Sygnia and The Block assessed as the attackers covering their tracks ^[3][4][11].

What the attackers did next

Laundering began within minutes. Elliptic observed hundreds of millions of dollars of stETH and cmETH swapped into Ether through decentralised exchanges, a step it attributes to the fact that token issuers can sometimes freeze stolen tokens whereas no central party can freeze Ether or Bitcoin ^[8]. Within two hours the stolen funds had been sent to 50 wallets holding roughly 10,000 ETH each, which were then emptied one by one over the following nine days, with the last of the original wallets drained on 3 March 2025 ^[8]. Bybit's own timeline states the funds were split across 39 addresses, so the two accounts of the initial dispersal differ ^[13]. TRM Labs tracked at least $160 million moved through illicit channels within 48 hours, more than $200 million by 23 February and more than $400 million by 26 February ^[9].

The FBI's public service announcement of 26 February 2025 stated that TraderTraitor actors had already converted some of the assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains, published a list of Ethereum addresses holding proceeds, and asked RPC node operators, exchanges, bridges, analytics firms and DeFi services to block transactions derived from them ^[2]. By 4 March Bybit's CEO reported that 83% of the stolen ETH, some 361,255 ETH worth about $900 million, had been converted to Bitcoin and spread across 6,954 wallets via THORChain; 77% of the funds remained traceable, while 20%, roughly 79,655 ETH or $200 million, had 'gone dark', largely through the swap service eXch ^[15]. THORChain processed a record $4.66 billion in swaps in the week ending 2 March, earning more than $5.5 million in fees from the flows ^[15].

eXch became the focus of public pressure. Elliptic reported that the service refused direct requests from Bybit to block the activity and earned hundreds of thousands of dollars in fees exchanging stolen funds, and the BBC put the amount funnelled through it at more than $90 million ^[8][10]. eXch's owner Johann Roberts told the BBC the service had not initially stopped the funds because of a long-running dispute with Bybit and uncertainty about whether the coins came from the hack, but said he was now co-operating ^[10]. By 10 March the BBC reported that at least $300 million had been converted into unrecoverable funds, consistent with Bybit's own 20% 'gone dark' estimate ^[10].

Freezes and recoveries were real but small relative to the loss. By 23 February Bybit reported $42.89 million frozen through coordinated action by Tether, THORChain, ChangeNOW, FixedFloat, Avalanche, CoinEx, Bitget and Circle, and mETH Protocol recovered 15,000 cmETH worth nearly $43 million ^[13]. Chainalysis separately reported helping to freeze more than $40 million ^[7]. Bybit launched a recovery bounty of 10% of recovered funds on 22 February, worth up to $140 million if everything were retrieved; on 25 February it added a 5% bounty paid upfront to exchanges, mixers and other services that freeze funds; and on 26 February it launched Lazarusbounty.com, a public platform with a leaderboard of 'good and bad actors' and a panel of investigators including ZachXBT and SlowMist's founder ^[12][16][19]. By 10 March, 20 people had shared more than $4 million in rewards for identifying $40 million of stolen funds ^[10].

The later laundering phases, as documented by Elliptic in August 2025, used professional 'laundering as a service' operators, multiple rounds of mixing with heavier use of Wasabi Wallet than in any previous DPRK-attributed hack, bridging across lesser-known chains, a Tron-based scheme involving worthless tokens and liquidity pools to obscure at least $24 million, and eventual cash-out to USDT through suspected Chinese over-the-counter brokers ^[18]. Elliptic cited a zeroShadow coalition report indicating that more than $1 billion of the funds had been laundered by then ^[18]. In July 2025 Greece's Hellenic Anti-Money Laundering Authority traced and froze a portion of the proceeds in that country's first-ever cryptocurrency seizure, using Chainalysis Reactor to connect a suspect wallet back to the primary Bybit hack addresses ^[17].

Detection and response

The malicious transaction was executed at 14:13 UTC, and Bybit's CEO made his first public post at 15:44 UTC, roughly 90 minutes later, followed by a second post at 16:07 UTC and a livestream at 17:15 UTC ^[13]. Bybit reported the case to the authorities at 21:07 UTC the same day ^[13]. ZachXBT submitted evidence linking the attack to Lazarus Group to Arkham Intelligence's bounty at 19:09 UTC, within five hours of the theft, based on test transactions, connected wallets and timing ^[13]. Bybit also moved the majority of its remaining funds out of Safe{Wallet}-administered addresses on the day of the incident ^[5].

Operationally the response held. Bybit processed about $4 billion of withdrawals in the surge that followed and announced that deposits and withdrawals had returned to normal by 08:55 UTC on 23 February ^[13]. On 24 February the auditor Hacken published an updated proof-of-reserves report stating that Bybit had restored a 1:1 ratio across 40 in-scope assets within 72 hours, after the exchange secured ETH through Galaxy Digital, FalconX and Wintermute, with support from Bitget, MEXC and DWF Labs ^[14]. CoinDesk's address analysis suggested more than $400 million of that ETH was bought over the counter and another $300 million directly from exchanges ^[15]. The Block noted that Bybit's rapid disclosure and attempts to make users whole drew praise from inside and outside the industry ^[12].

Forensics moved quickly too. Verichains' preliminary report is dated 24 February and was written on-site at Bybit's Dubai headquarters ^[3]. Bybit published the Sygnia and Verichains preliminary reports at 15:17 UTC on 26 February, five days after the theft, both identifying malicious JavaScript on Safe{Wallet}'s platform as the root cause and finding no vulnerability in Bybit's infrastructure ^[13]. Safe paused Safe{Wallet} functionality early on 22 February, and by 28 February stated it had fully rebuilt and reconfigured its infrastructure, rotated all credentials and restored the Ethereum mainnet front-end in a phased rollout with additional security measures ^[6][13].

What did not work is equally clear. Nothing on the signing path independently verified what the three signers were approving: the Safe UI was the sole rendering of the transaction, and the hardware devices signed whatever hash the compromised front-end supplied ^[3][11]. Changpeng Zhao's public questions, 'How did they fool the Ledger verification step at multiple signers? Was it blind signing?', went to that gap ^[11]. On the upstream side, Sygnia observed that Mandiant's snippets did not independently confirm the S3 modification through a forensic investigation of Safe{Wallet}'s infrastructure, and that a comprehensive investigation of activity inside Safe{Wallet}'s AWS environment remained the most significant open gap, since Lazarus is known to leave persistence that enables repeat attacks if eradication is partial ^[4]. Safe itself told users to 'exercise extreme caution and remain vigilant when signing transactions' ^[6].

Impact

The direct financial loss was approximately $1.46 billion, borne by Bybit rather than its customers; Bybit, which the Guardian reported holds about $20 billion in customer assets for more than 60 million users, covered the shortfall through loans and purchases, and the BBC later reported the stolen coins had been replenished with loans from investors ^[8][10][16]. Chainalysis calculated that the Bybit theft alone exceeded by almost $160 million the $1.34 billion that North Korea-affiliated hackers stole across 47 incidents in all of 2024 ^[7]. TRM Labs, using a higher confidence threshold, put North Korea's 2024 total at about $800 million, roughly 35% of all funds stolen that year, with individual DPRK attacks nearly five times larger than those by other actors ^[9].

Market impact was limited and short-lived: the Guardian reported Ether fell nearly 4% on the news before recovering ^[16]. The ecosystem effects were broader. Safe{Wallet} suspended and then rebuilt its front-end infrastructure, and committed to lead an industry initiative on transaction verifiability ^[6]. Intermediaries that handled the flows came under scrutiny, with eXch earning fees on stolen funds and THORChain recording its highest weekly swap volume on record during the laundering ^[8][15].

On the law-enforcement side, the FBI's 26 February PSA was unusual in naming the DPRK within five days and publishing the laundering addresses for the private sector to block ^[2]. Greece's first cryptocurrency seizure in July 2025 traced to this case ^[17]. Elliptic's assessment six months on was that more than $1 billion had nonetheless been laundered and that DPRK actors had carried out more than a dozen further thefts in 2025 with combined victim losses above $1.75 billion ^[18].

Root cause

The control that failed was transaction verification independent of the vendor's user interface. Bybit's cold-wallet signers relied on app.safe.global to show them what they were signing, and that front-end was served from an S3 bucket the attackers could write to, having compromised a Safe{Wallet} developer's laptop and reused a valid AWS session token ^[3][4]. Once the UI was under hostile control, the multisig threshold offered no protection: all three signers saw the same forged display and all three signed the same malicious hash ^[3][4]. The signing devices faithfully signed what they were given, which is what blind signing means in practice ^[11].

The second failure was third-party risk. Bybit's own infrastructure was not breached; the breach was at a supplier whose web application sat directly on the path to $1.46 billion ^[5][8]. Sygnia's analysis broke the attack into six domains, social engineering, macOS compromise, cloud compromise, application security, signing protocols and smart contracts, and concluded that, unlike regulated banking, the crypto industry lacks standardised security requirements and third-party risk assessment, so projects integrate external services without thorough security checks ^[4].

Contributing conditions on the supplier side were a developer workstation that could be compromised by a downloaded project, an AWS session token that stayed usable for up to 12 hours and could be lifted from that workstation, and a deployment pipeline in which static JavaScript could be replaced in the production bucket without triggering integrity checks for two days ^[3][4]. Safe stated the smart contracts and source code were not at fault, which is accurate and beside the point: the code that reached signers' browsers was not the code in the repository ^[6].

Lessons for Indian firms

The pattern is not foreign to India. Sygnia noted that the July 2024 theft of about $230 million from WazirX, India's largest exchange, involved a mismatch between what the Safe{Wallet}-based interface displayed and what was actually signed, and that TRM Labs attributes that theft, which it puts at $235 million, to North Korean actors ^[4][9]. Under CERT-In's directions of 28 April 2022, service providers, intermediaries and body corporates must report cyber incidents to CERT-In within 6 hours of noticing them, and virtual asset service providers and custodian wallet providers must retain KYC and transaction records for five years ^[20]. Bybit's first public statement came about 90 minutes after the theft and its formal report to authorities within seven hours, a benchmark Indian custodians should expect to meet ^[13]. For any Indian firm holding assets behind a multisig, the specific lesson is to verify transaction hashes and calldata out of band, on a hardware device or an independent tool, rather than trusting a vendor-hosted web page, and to treat wallet front-end vendors as critical suppliers subject to the same assessment as a payments processor ^[4][11].