Bybit Heist

On February 21, 2025, Bybit lost roughly 401,000 ETH — about $1.46 billion at the time — in what remains the largest single cryptocurrency theft ever recorded. The attack did not break Bybit's wallet, its signing process or its key custody. It broke the user interface that Bybit's signers looked at.

What happened

The exchange was preparing a routine transfer from a multi-signature Ethereum cold wallet to a warm wallet. The wallet was a Gnosis Safe instance managed via the Safe{Wallet} web interface.

Days earlier, a developer at Safe — the company that maintains the Safe{Wallet} frontend — had been socially engineered. The attackers compromised the developer's workstation, lifted AWS session tokens, and used those temporary credentials to bypass MFA and reach Safe{Wallet}'s production AWS environment.

From inside the Safe deployment pipeline, they replaced a piece of frontend JavaScript with code targeting Bybit's specific Safe address. When Bybit's signers reviewed the pending transaction in their browser, the UI showed the benign warm-wallet transfer they were expecting. The transaction actually being sent to their hardware wallets, however, was a delegatecall that overwrote the Safe's implementation contract — handing the attacker full control of the wallet.

Three signatures later, all 401,000 ETH was gone.

Aftermath

• The FBI publicly attributed the heist to TraderTraitor, a sub-cluster of the North Korean Lazarus Group, within days.
• By mid-March, on-chain investigators reported the attackers had converted ~86% of the stolen ETH to BTC and were laundering it through cross-chain bridges and mixers.
• Bybit raised ~50,000 ETH in emergency bridging loans from competitors and made all customer withdrawals whole.
• Safe published a post-mortem and overhauled its signing-UI integrity controls.

Why it matters

Bybit is the founding case study for an entire new threat model: the wallet UI is part of the trust boundary. Hardware-wallet signing assumes the human can read the transaction; if the screen showing the transaction is compromised, hardware wallets do not save you. Multiple custody platforms have since added independent transaction-simulation displays, second-channel verification, and hash-based signing prompts in direct response.