Bybit

On February 21, 2025, roughly 401,346 ETH plus staking-derivative tokens (stETH, cmETH, mETH) were drained from a Bybit cold wallet managed through the Safe{Wallet} multisig interface on Ethereum. Estimates of the total loss vary between about $1.43 billion (Bybit's own tally) and $1.5 billion in most press coverage, reflecting ETH's price movement during the theft and which derivative tokens are counted. It remains the largest single crypto theft on record, larger than all 47 hacks tracked across 2024 combined (Rekt News). The FBI and independent investigators attributed the attack to North Korea's Lazarus Group, tracked under the aliases TraderTraitor, Jade Sleet, Slow Pisces and UNC4899 (The Hacker News).

How the attack worked

Our database labels the technique "Safe Multisig wallet Phishing Exploit," but the forensic firms that investigated the breach, Sygnia and Verichains (as reported by DFNS), and Safe's own confirmation (via The Hacker News) describe something more specific than phishing: nobody clicked a spoofed link or typed a seed phrase into a clone site. This was a supply-chain compromise of Safe's own infrastructure:

• Attackers used social engineering to compromise the workstation of a Safe{Wallet} front-end developer, and through it obtained the AWS credentials behind the app.safe.global web app.
• On February 19 they replaced the app's production JavaScript bundle with a modified version. The payload was narrowly targeted: it activated only when a transaction from Bybit's specific cold-wallet address was being prepared, leaving every other Safe user's session untouched — which is why the tampering went unnoticed.
• On February 21, three Bybit signers opened the Safe UI to approve what looked like a routine ETH transfer to a hot wallet and connected their Ledger hardware devices. The screen showed a correct-looking recipient address and the genuine domain — but the payload actually sent to the hardware wallets for signing was a different call: a delegatecall to an attacker-controlled contract.
• That delegatecall overwrote the storage slot in Safe's proxy contract that points to the logic contract governing the wallet — silently swapping the wallet's trusted code for the attacker's, without moving any funds yet.
• With the implementation hijacked, the attackers then called a sweep function inside their own logic that transferred all held ETH and derivative tokens to addresses they controlled — no further multisig signatures required.

The exploited weakness was not the Safe contract code itself (audited, and it behaved exactly as written) nor Bybit's multisig setup — it was trust in what the front end displayed before signing on a hardware device: a textbook "blind signing" failure.

What happened afterward

Bybit CEO Ben Zhou said the exchange remained solvent, covering client losses through bridge loans and its own treasury, and launched a recovery bounty of up to $140 million (10% of any funds recovered). Within days, roughly $40 million of the stolen assets was frozen through cooperation with exchanges and Tether (Chainalysis). That proved to be a small fraction of the total: TRM Labs data cited in early 2026 put cumulative recovery or freezing at under 5% of the stolen sum, after Lazarus Group laundered nearly the entire haul within about ten days, chain-hopping through bridges, DEXs and no-KYC swap services and converting ETH into BTC and DAI. No arrests followed — the attack is attributed to a state actor. Bybit continued operating without disruption to customers; Safe commissioned independent forensic reviews from Sygnia and Verichains and announced hardening of its infrastructure.

What this means

• The exposed surface isn't the multisig contract itself but any cold-storage workflow where a transaction is assembled by a web front end and then "blind-signed" on a hardware device — the failure point sits between the UI and the signature, not in on-chain logic.
• The advance warning sign was organizational, not technical: Bybit's signers verified only the human-readable fields the UI rendered (address, amount), not the raw calldata or the call/delegatecall flag actually sent to the hardware device for signing.
• The incident accelerated industry adoption of "clear signing" — decoding and displaying full transaction structure on the hardware wallet's own screen, independent of what any website renders.
• A single compromised developer laptop was enough to bypass an audited smart contract and a three-signer multisig, which points to a broader lesson: the protected perimeter for high-value custody has to include CI/CD pipelines and developer endpoints, not just the contracts themselves.