Bybit's signers approved a transaction they couldn't see — $1.5B gone

Bybit, founded in 2018, had grown into one of the world's largest crypto exchanges by volume, holding tens of billions of dollars in client assets. Its main Ethereum cold wallet — the offline vault holding the exchange's own ether — was a multisig that signed transactions through Safe{Wallet}, a third-party signing interface.

On 19 February 2025, attackers who had compromised Safe{Wallet}'s infrastructure injected malicious code into its frontend. Two days later, when Bybit initiated a routine transfer from the cold wallet, the hijacked interface showed the three signers a disguised version of the transaction. They approved what they thought was normal; 401,000 ETH — about $1.5 billion — moved to addresses controlled by the attackers, the largest theft in crypto history.

Bybit kept withdrawals running, covered the hole with bridge loans from investors, and launched a Lazarus Bounty programme to trace the funds. Forensics by Sygnia and Verichains, alongside blockchain analysis from Elliptic and Arkham, attributed the theft to North Korea's Lazarus Group. Within days at least $300 million had been laundered beyond recovery, and roughly a fifth of the total was written off as unrecoverable.