On February 21, 2025, Bybit's Ethereum cold wallet was drained of approximately 401,346 ETH plus various staked-ETH derivatives in a single execution, totaling $1.46B at the time of the breach and instantly setting the record for the largest single crypto theft in history. The attack did not compromise the underlying Safe (formerly Gnosis Safe) multisig contract or its private keys; instead, the attackers injected malicious JavaScript into the Safe web interface served from a compromised AWS S3 bucket controlled by the Safe team, modifying the transaction payload presented to signers so that what appeared on-screen as a routine ETH-to-ETH internal transfer was in reality a delegatecall to attacker-controlled logic that rewrote the Safe's implementation slot. Attribution to the Lazarus Group was confirmed within days by the FBI, Chainalysis, Elliptic and independent investigator ZachXBT, building on wallet-clustering and laundering-pattern overlaps with prior DPRK-linked thefts. Bybit covered all customer losses from corporate treasury within a week and remained operational throughout, but the incident has reshaped industry assumptions about hardware-wallet UX, the trust model of self-custody front ends, and the assumed safety of audited multisigs whose surface area extends to the browser.
Timeline of events
At 14:13 UTC on February 21, 2025, a routine warm-to-cold wallet rebalancing operation was initiated by Bybit's treasury team. Three approved signers, working from geographically separated locations and using Ledger and Trezor hardware wallets, opened the Safe web interface to authorize the transfer of approximately 401,000 ETH from the cold wallet to a destination address that had been pre-whitelisted in the operations runbook. Each signer reviewed what their browser displayed: a destination address matching the runbook, a value field denominated in ETH, and a payload field that the interface rendered as empty. Each signer then confirmed on their hardware wallet, where the device displayed a transaction hash but, critically, did not decode the underlying calldata into a human-readable diff. Within ninety seconds of the third signature, the transaction was relayed and mined in block 21,895,238. The Safe's storage slot 0 - which holds the implementation address that the proxy contract delegatecalls into - was overwritten to point at an attacker-controlled contract. A follow-up transaction four blocks later invoked that new implementation, which contained a single function: sweep all ETH and ERC-20 balances to a fresh address. Bybit CEO Ben Zhou tweeted public confirmation of the breach at 17:44 UTC, less than four hours after the on-chain execution, an unusually fast disclosure cadence that limited the social-engineering follow-on attacks the Lazarus playbook normally relies on. By 22:00 UTC, the stolen ETH had begun fanning out across more than fifty intermediate addresses in the classic peel-chain pattern.
Attack mechanism
The technical mechanism is now well-documented through forensic work by Verichains, SlowMist, and the Safe team itself. The attackers compromised an AWS S3 bucket belonging to Safe.global that hosted the static JavaScript bundle served by the Safe transaction-builder UI. Specifically, the attackers obtained credentials - believed to be via a compromised Safe developer's machine, itself the product of a months-long social-engineering campaign in which a Lazarus operator posed as a recruiter offering a frontend-engineering contract - and pushed a modified bundle that contained conditional logic targeting only two Ethereum addresses: Bybit's cold wallet and a similar wallet at a second exchange that was not exploited. For all other users, the bundle behaved identically to the legitimate version. For Bybit's signers, the bundle silently rewrote the transaction object before submission to the hardware wallet, swapping the innocuous transfer payload for a delegatecall to an attacker-deployed contract that contained the storage-slot-rewriting logic. The hardware wallets dutifully signed what they were given. Because the Safe proxy pattern routes all logic through the implementation address stored at slot 0, overwriting that slot grants total control: the proxy continues to hold the funds but now executes attacker code. This is sometimes called a delegatecall implementation hijack and is a known risk vector, but it had never been weaponized at this scale. The hardware wallets did not display human-readable calldata because Safe transactions, particularly with custom guards and modules, are routinely too complex for the device's small screen, and the signers had been trained to verify the destination and value rather than the full payload - a training assumption that the attack precisely inverted.
Root cause analysis
There are three distinct root causes, each of which would have been sufficient to prevent the loss had it been addressed. First, the Safe team's static-asset deployment pipeline lacked subresource integrity verification and reproducible-build attestation, so a compromise of S3 credentials translated directly into compromise of the executing JavaScript with no further bypass required. Second, Bybit's signing protocol relied on visual verification of the rendered UI rather than calldata decoding on the hardware wallet itself; tools such as Safe's transaction-decoder offline verifier exist but were not part of the runbook. Third, and most fundamental, the trust model of multisig self-custody as practiced by the industry treats the signing front-end as an implicitly trusted component, when in fact it is a remote-code-execution surface that any of the participating signers' browsers can deliver. The Safe contract itself was not exploited; its on-chain audit trail and its formal verification both held up perfectly. The exploit lived entirely in the gap between the human signer's intent and the bytes that the hardware wallet was asked to sign. This is sometimes called the what-you-see-is-what-you-sign problem, and it has been a known weakness of the entire smart-account ecosystem since the early Gnosis Safe deployments of 2017. The Bybit incident converted that theoretical concern into a $1.46B empirical demonstration.
Initial response and recovery
Bybit's response was, by industry standards, exemplary in its speed and transparency. Within four hours of the on-chain execution, CEO Ben Zhou had tweeted confirmation, publicly disclosed the rough scale of the loss, and committed that customer balances were unaffected because the exchange would absorb the shortfall from corporate treasury and a hastily-arranged emergency credit line drawn from existing institutional partners. Withdrawals on Bybit, which surged to several billion dollars within the first twelve hours as users de-risked, were processed continuously without freeze or rate limit, a deliberate choice intended to head off the panic-and-bank-run dynamics that had killed FTX and Mt. Gox. By February 24, Bybit had published a proof-of-reserves snapshot showing customer assets fully backed, and by February 28 the exchange announced that the entire $1.46B shortfall had been replenished, partly through treasury, partly through a three-month bridge loan from a consortium that reportedly included Bitget, MEXC and a private credit fund. No customer was made whole later than seven days after the breach, and no customer experienced a loss. The contrast with FTX and the 2014 Mt. Gox collapse is deliberate and was repeatedly emphasized by Zhou; the Bybit response has since become a reference template for how a centralized exchange ought to behave under hot-wallet or cold-wallet compromise.
Funds tracking and laundering
Within hours of the theft, on-chain investigator ZachXBT had clustered the receiving addresses and tagged them as Lazarus, citing wallet-overlap with the July 2024 WazirX exploit and the May 2024 DMM Bitcoin theft. Chainalysis, Elliptic and TRM Labs published independent attributions over the following days, with all three converging on Lazarus / DPRK based on transactional patterns: an immediate split of the principal across dozens of intermediate addresses, conversion of staked-ETH derivatives back to native ETH via on-chain redemptions, and the use of THORChain and a small set of cross-chain bridges to move value to Bitcoin and Tron. By March 7, Bybit had published a public bounty program offering up to 10% of recovered funds to investigators and exchanges that froze attacker-linked balances; approximately $42M of stablecoins had been frozen by USDT issuer Tether and various centralized venues within the first ten days. THORChain became a focal point of community criticism: the protocol processed an estimated $605M of the stolen ETH in cross-chain swaps over the first week, with no on-chain mechanism to halt the flow. A subsequent THORChain governance vote on whether to pause stolen-fund swaps narrowly failed. Tornado Cash, sanctioned by OFAC since August 2022, was used for a smaller portion of the proceeds; the bulk of the obfuscation occurred via cross-chain hops rather than mixers, reflecting a Lazarus shift away from sanctioned mixers and toward jurisdictionally-agnostic cross-chain liquidity.
Legal and regulatory aftermath
The FBI's Internet Crime Complaint Center (IC3) issued a public advisory on February 26 attributing the theft to TraderTraitor, the FBI's designation for the Lazarus subgroup that has specialized in crypto theft since approximately 2020. OFAC subsequently added the named receiving addresses to the SDN list, making any U.S.-touching transaction with those addresses a sanctions violation. The European Union's Markets in Crypto-Assets (MiCA) regulator opened a formal review of multisig custody practices for licensed exchanges, and the Hong Kong SFC, where Bybit holds limited operating permissions, opened a parallel inquiry. No criminal charges have been filed against any individual because none of the suspected operators are under any extraditable jurisdiction; the indictments that the U.S. Department of Justice has unsealed against named Lazarus operators (Park Jin Hyok and others) date from before 2025 and remain unenforceable. Bybit itself was not sanctioned or charged, but the Safe team faced civil exposure: a class-action filing was submitted in California in March 2025 alleging negligent maintenance of the deployment pipeline, though the suit is widely expected to fail on the contractual disclaimers Safe ships in its terms of use. In the broader regulatory conversation, the incident accelerated a long-running U.S. and EU push toward mandatory secure-element calldata decoding on hardware wallets, with both Ledger and Trezor announcing firmware roadmap commitments by April 2025.
Industry implications
The Bybit incident has reshaped four areas of industry practice. First, hardware-wallet vendors have accelerated work on what is variously called clear signing or full-payload decoding: rendering of EIP-712 typed data and Safe-specific transaction templates directly on the device screen, so that the human signer reads the bytes the device will sign rather than the bytes the browser claims it will sign. Ledger's Stax and Flex models have shipped firmware that decodes Safe execTransaction payloads as of Q3 2025; Trezor has shipped equivalent functionality on the Safe 5. Second, the Safe team itself has restructured its deployment pipeline to use reproducible builds, signed bundles, subresource integrity, and a fallback IPFS-pinned UI that operators can self-host. Third, custodial and exchange treasury teams have broadly adopted a policy of independent calldata verification using a separate machine running a known-good Safe transaction-builder, with the verifier comparing the computed transaction hash against the hash about to be signed. Fourth, the regulatory and insurance market has adjusted: Lloyd's syndicates writing crypto custody policies have repriced multisig coverage upward by roughly 40% per industry reporting, and several jurisdictions are exploring a mandatory baseline of operational controls modeled on the post-mortem's recommended remediations. The practical effect is that the cost and friction of self-custodial treasury operations has risen materially, with second-order effects on which exchanges and protocols can afford to operate cold wallets at scale.
Verdict and lessons
The Bybit cold-wallet compromise is the cleanest large-scale demonstration to date that the smart-contract layer can be perfectly correct while the surrounding human-and-software layer is catastrophically broken. The Safe contract worked as specified. The hardware wallets signed what they were instructed to sign. The signers performed the procedure they had been trained on. And $1.46B left the treasury. The lesson is not that multisig is broken but that the trust boundary of a multisig extends far beyond the on-chain contract, encompassing every static asset, every dependency, every browser, every hardware wallet's display logic, and every operational procedure - and that any one of these layers, if compromised, can defeat the others. For practitioners, three concrete remediations follow: clear-signing on the hardware wallet must become the only acceptable signing mode for high-value transactions; static-asset delivery for signing UIs must be reproducibly built and integrity-verified; and the operational runbook for any treasury action above an agreed threshold must include independent calldata verification on a separate, trusted machine. For the industry, the incident closes the chapter in which audited multisig was treated as a sufficient operational control and opens a new chapter in which the front-end-and-human stack is treated as a first-class component of the security model, audited and adversarially tested with the same rigor as the contracts themselves.
Root cause
Compromised Safe.global S3 deployment pipeline served maliciously-modified JavaScript to Bybit's three multisig signers, rewriting the transaction payload between the browser and the hardware wallet to invoke a delegatecall that overwrote the Safe proxy's implementation slot, granting the attacker total control of the cold wallet's funds. The Safe contract and signers' private keys were never compromised; the attack lived entirely in the gap between human intent and the bytes signed by the hardware device.
Recovery and aftermath
Approximately $42M frozen by Tether and centralized venues within ten days; estimated 3-5% of stolen funds recovered by Q2 2026 per Chainalysis tracking. Bybit covered customer losses entirely from treasury within seven days; no customer experienced a loss.
Lessons
- Audited contracts are necessary but not sufficient; the signing UI is part of the trust boundary and must be audited and integrity-verified
- Hardware wallets must decode and display full transaction payloads on-device for any high-value action; opaque blind-signing is a known-defeated control as of February 2025
- Treasury runbooks must include independent calldata verification on an out-of-band machine before any signature is collected
- Static-asset delivery for security-critical front-ends must use reproducible builds, signed bundles, subresource integrity, and ideally IPFS-pinned fallbacks
Precedent
Established that a compromised front-end can defeat a perfectly-implemented multisig, fundamentally extending the trust boundary of self-custodial smart-account treasury operations. Accelerated industry mandate for hardware-wallet clear-signing and reproducible static-asset delivery for signing UIs.