Bybit's signers approved a transaction they couldn't see — $1.5B gone

Bybit, founded in 2018, had grown into one of the world's largest crypto exchanges by volume, holding tens of billions of dollars in client assets. Its main Ethereum cold wallet — the offline vault holding the exchange's own ether — was a multisig that signed transactions through Safe{Wallet}, a third-party signing interface.

On 19 February 2025, attackers who had compromised Safe{Wallet}'s infrastructure injected malicious code into its frontend. Two days later, when Bybit initiated a routine transfer from the cold wallet, the hijacked interface showed the three signers a disguised version of the transaction. They approved what they thought was normal; 401,000 ETH — about $1.5 billion — moved to addresses controlled by the attackers, the largest theft in crypto history.

Bybit kept withdrawals running, covered the hole with bridge loans from investors, and launched a Lazarus Bounty programme to trace the funds. Forensics by Sygnia and Verichains, alongside blockchain analysis from Elliptic and Arkham, attributed the theft to North Korea's Lazarus Group. Within days at least $300 million had been laundered beyond recovery, and roughly a fifth of the total was written off as unrecoverable.

Hackers hijacked Safe{Wallet}'s frontend to show a disguised transaction; signers approved it, and 401,000 ETH (~$1.5B) left the cold wallet.

Multisig is only as strong as what signers can verify. A compromised signing interface can show one transaction and submit another, and the approvals follow the screen.

Bybit concentrated roughly $1.5B in a single Ethereum cold wallet behind one signing workflow. One spoofed screen emptied the whole vault.

The attackers went through the wallet vendor's infrastructure, not Bybit's. The trust boundary quietly extended to a third-party frontend nobody at the exchange controlled.

Multi-signature protects only what signers can verify — treat the signing interface as untrusted and confirm the actual transaction, not the screen that displays it.