/
,
/ 

Bybit: the largest theft in the asset class, and the signing interface behind it

On 21 February 2025 roughly $1.46 billion left one of Bybit’s Ethereum cold wallets in a single transaction carrying three valid signatures from the wallet’s own owners.

01 / 01 Sections Sections

2026-07-31 · Illicit Finance

On 21 February 2025 roughly $1.46 billion left one of Bybit’s Ethereum cold wallets in a single transaction carrying three valid signatures from the wallet’s own owners. Nobody stole the keys: the owners approved a payload their interface never showed them.

Case file

Field Value
Matter Bybit Ethereum cold wallet exploit
Court None. No prosecution has been brought publicly
Docket Not established
Event 21 February 2025, 14:13:35 UTC, Ethereum block 21,895,238
Exploit transaction 0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882
Wallet Safe multisig 0x1Db92e2EeBC8E0c075a02BeA49a2935BcD2dFCF4, threshold 3
Signature record Three confirmations, all recorded by Safe as ETH_SIGN, v = 31
Amount at issue $1.46 billion (Bybit). Approximately $1.5 billion (FBI). Over $1.4 billion (Verichains)
Assets taken 401,347 ETH, 90,375 stETH, 15,000 cmETH, 8,000 mETH
Attribution FBI, PSA I-022625-PSA, 26 February 2025: North Korea, activity the FBI tracks as TraderTraitor
Attack vector per forensics Malicious JavaScript served from Safe{Wallet}’s AWS S3 bucket at app.safe.global
Origin per Safe A compromised Safe{Wallet} developer machine
Jurisdictions United Arab Emirates, United States, Germany, Democratic People’s Republic of Korea
Posture as of 31 July 2026 No charges filed publicly. No named defendant. FBI attribution stands. Most of the funds have been laundered
Agencies and firms on record FBI; Sygnia; Verichains; Mandiant; Elliptic; Chainalysis; TRM Labs; Hacken

What the record shows

Bybit is a cryptocurrency exchange headquartered in Dubai. On 21 February 2025 it moved funds from one of its Ethereum multisig cold wallets to a warm wallet. Bybit’s own account of the day records a first transfer of 30,000 ETH at 13:30 UTC.

At 14:13:35 UTC a second transaction executed against the same wallet. Safe’s transaction service, operated by the company that builds the wallet software, records it as nonce 71 on Safe 0x1Db92e2EeBC8E0c075a02BeA49a2935BcD2dFCF4, addressed to 0x96221423681A6d52E184D440a8eFCEbB105C7242, value zero, operation 1, safeTxGas 45,746, with three confirmations against a required threshold of three. The executing address was 0x0fa09C3A328792253f8dee7116848723b72a6d2e, which Verichains labels the attacker’s main wallet. On chain the transaction is 0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882, in block 21,895,238.

Bybit’s published timeline puts the loss at $1.46 billion from a single cold wallet, broken down as 401,347 ETH ($1.12 billion), 90,375 stETH ($253.16 million), 15,000 cmETH ($44.13 million) and 8,000 mETH ($23 million). The FBI’s public service announcement gives “approximately $1.5 billion USD in virtual assets”. Verichains, one of the two firms Bybit brought in, describes “over $1.4 billion in cryptocurrencies, including 401,347 Ether”. The three figures differ; the composition above is Bybit’s own.

What did the transaction actually do?

The operation field on a Safe transaction selects between a normal call (0) and a delegatecall (1). This one was set to 1. The data field carried the four-byte selector for transfer(address,uint256), with 0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516 in the address slot and zero as the amount, which reads at a glance as an ERC-20 transfer of nothing.

A delegatecall runs the target contract’s code against the caller’s own storage. In NCC Group’s technical analysis of the attack, the attacker’s contract at 0x9622... contains no transfer logic at all: “instead of a transfer, it modifies the value of the slot 0 of the contract’s storage, with the value passed in the _to parameter.” NCC Group describes why slot 0 matters for this particular wallet: the Safe proxy stores the address of the contract holding all the wallet’s logic in a variable NCC Group names as the masterCopy, “which corresponds to slot 0 in the contract’s storage.”

So the address that looked like a transfer recipient became the wallet’s master copy. Bybit’s Safe stopped running Safe’s code and started running the attacker’s. Verichains records what followed: the attacker “then used the backdoor functions sweepETH and sweepERC20 in the malicious contract to drain the wallet.”

Both attacker contracts were deployed three days before the theft, from the same address that later executed it. Ethereum block data timestamps 0x9622... at 15:39:11 UTC on 18 February 2025 and 0xbDd077... at 18:00:35 UTC the same day. Verichains’ own report gives those times in its timeline and then, in its table of related addresses, dates 0xbDd077... to 19 February at 07:15:23 UTC. The chain supports the earlier pair of timestamps, and the discrepancy is inside a single source.

The master copy was never restored. Queried on 31 July 2026, Safe’s own transaction service still returns 0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516 as the masterCopy of Bybit’s cold wallet, and returns null for owners, nonce and threshold, because the contract now sitting behind that proxy does not answer those questions. NCC Group gives the legitimate Safe master copy for this wallet as 0x34CfAC646f301356fAa8B21e94227e3583Fe3F5F.

Where did the malicious code come from?

Verichains examined the machines of Bybit’s three signers and found a malicious JavaScript payload from app.safe.global sitting in Chrome’s cache. Two files were involved, _app-52c9031bfa03da47.js and 6514.b556851795a4cbaa.js, served by Amazon S3 through CloudFront, with last-modified stamps of 19 February 2025 at 15:29:43 and 15:29:25 UTC. The same two files on app.safe.global after the theft carried last-modified stamps of 21 February at 14:15:32 and 14:15:13 UTC, about two minutes after the transaction executed. Verichains also located a copy of the malicious file in the Wayback Machine dated 19 February 2025.

The injected code carried two hardcoded lists: Safe addresses to attack, and signer addresses to watch. Bybit’s cold wallet is the first entry in the first list, and Verichains labels the second entry a test multisig belonging to the attacker. On the signer list, Verichains identifies the first address as Bybit’s proposer wallet and the second as a test wallet of the attacker’s; when that proposer connected, the script forced an immediate page reload, which Verichains reads as blocking it from signing while still allowing it to propose, and adds “we’re still unsure why.”

When the Safe in use matched the target list and the transaction’s operation was 0, the code cloned the original transaction data, overwrote the to, operation, data, value and safeTxGas fields with the attack values, passed the rewritten transaction to the Safe SDK to be signed or executed, and then put the original data back. Verichains: this last step ensured “the tampering remains hidden from subsequent processing.” The safeTxGas hardcoded in the injected script is 45,746, the same number recorded on the executed transaction.

Verichains’ preliminary conclusion, written on 24 February 2025 from Bybit’s Dubai headquarters, was that “AWS S3 or CloudFront account/API Key of Safe.Global was likely leaked or compromised.” Bybit’s own timeline records that both preliminary reports “suggested that the root cause of the hack was due to malicious JavaScript code on Safe{Wallet}’s platform, and no vulnerability was detected in Bybit’s infrastructure.”

What Safe said, and what Safe ruled out

The Safe Ecosystem Foundation published a statement on 28 February 2025. It identifies the attack vector as “a compromised Safe{Wallet} developer machine resulting in the proposal of a disguised malicious transaction,” and states that “the forensic review of external security researchers did NOT indicate any vulnerabilities in the Safe smart contracts or source code.” The team “fully rebuilt, reconfigured all infrastructure, and rotated all credentials,” and Safe committed to “lead an industry-wide initiative to increase verifiability of transactions.”

Sygnia, the other firm Bybit engaged, published its own account on 16 March 2025 built from its investigation of Bybit’s signer hosts plus material released by others. Its timeline: 4 February, a Safe developer’s macOS workstation compromised, likely through social engineering; 5 February, that developer’s AWS access token used to reach Safe’s AWS infrastructure; 5 to 17 February, the attackers operating inside it; 19 February, the JavaScript modified; 21 February, the transaction; two minutes later, the malicious code removed.

Sygnia sources the developer-machine detail to snippets of Mandiant’s preliminary report posted by Safe, which name a Docker project called “MC-Based-Stock-Invest-Simulator-main” reaching out to getstockprice[.]com from the ~/Downloads folder. Sygnia records that the attackers failed to register an additional MFA device on the compromised account and relied on a hijacked active AWS session token, because Safe’s configuration required MFA re-authentication every 12 hours, and that they worked hours matching the developer’s own schedule. Sygnia also flags a limit on what has been established: Mandiant’s report “did not independently confirm this finding through a forensic investigation of Safe{Wallet}’s infrastructure.”

How were the three signatures produced?

Safe’s transaction service records all three confirmations on the exploit transaction with signature type ETH_SIGN. Each of the three signature blobs ends in a v value of 31 (0x1f). In the Safe contracts a v above 30 selects the eth_sign recovery path, meaning the owner signed the 32-byte Safe transaction hash with the prefixed personal-message method rather than as EIP-712 typed data.

NCC Group’s analysis notes that the underlying Safe transaction hash is an EIP-712 struct hash, and left open which method the signers’ devices used, writing that where hardware wallets did not support EIP-712 the signers “would require to blind-sign on the hardware wallets.” The v values on this transaction answer that: the eth_sign path was used for all three. NCC Group’s summary of the position a signer was in either way: “Although the transactions appear to be slightly different, the underlying data is not human-readable, making it easy to mistake one for the other.”

On 24 February 2025, three days after the theft, Safe merged pull request 5090 into its wallet repository, titled “Fix(Blind signing): remove eth_sign” and described as removing “the outdated eth_sign signing fallback.”

One naming point, because it changes what the fix was. Safe’s ETH_SIGN label does not mean the eth_sign JSON-RPC method, which MetaMask had already removed in August 2024. Safe’s path called signMessage over the raw 32 bytes of the transaction hash, which reaches a wallet as personal_sign, and then adjusted the recovery byte by four. Recovering each of the three signatures against the prefixed digest returns the three owner addresses the transaction service names; recovering them against the unprefixed hash returns three addresses that own nothing. The mechanism, and what a signer can do about it, is set out in blind signing: what you approve is not what you sign.

What Bybit did in the first 72 hours

Ben Zhou, Bybit’s co-founder and chief executive, posted publicly at 15:44 UTC, roughly 90 minutes after the transaction, saying the attacker had taken control of the wallet and that client assets were backed 1:1. At 16:07 UTC he wrote that “Bybit is Solvent even if this hack loss is not recovered, [and] all of clients’ assets are 1 to 1 backed, [so] we can cover the loss.” He went on a livestream at 17:15 UTC.

Withdrawals were not halted. By 00:54 UTC on 22 February Bybit reported that 99.994% of over 350,000 withdrawal requests had been processed within 10 hours, and by 02:51 UTC that all withdrawals were processed and operations had resumed. Bitget deposited 40,000 ETH. Bybit launched a recovery bounty at 10% of stolen funds on 22 February at 15:32 UTC, and the dedicated LazarusBounty platform on 25 February at 14:40 UTC; that site, run by Bybit, carries the headline figure of $140 million and states that “the total bounty pool will be equivalent to 10% of the total value of the frozen funds.”

By 15:41 UTC on 23 February, Bybit put frozen funds at $42.89 million across Tether, THORChain, ChangeNOW, FixedFloat, Avalanche, CoinEx, Bitget and Circle, with mETH Protocol recovering 15,000 cmETH. At 02:35 UTC on 24 February Bybit recorded $1.23 billion in ETH received through bridge loans, whale deposits and OTC purchases, covering the deficit. Its timeline states that the blockchain security firm Hacken published an updated proof-of-reserves report on 24 February confirming the ETH gap on client assets closed within 72 hours, with support from Galaxy Digital, FalconX, Wintermute, Bitget, MEXC and DWF Labs.

What did the FBI actually say?

The FBI published public service announcement I-022625-PSA on 26 February 2025, five days after the theft. Its opening sentence: “The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025.” It continues: “FBI refers to this specific North Korean malicious cyber activity as ‘TraderTraitor.’”

On the movement of funds, the PSA states that “TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains.” It asks the industry to act: “FBI encourages private sector entities including RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets.” The PSA lists 51 Ethereum addresses described as “holding or have held assets from the theft.”

That is an attribution statement by an investigative agency, with no court finding behind it. No individual has been charged publicly in connection with the Bybit theft as of 31 July 2026.

Where the money went

Elliptic, publishing on 23 February 2025 and updating on 5 March, records that within two hours of the theft the funds were sent to 50 wallets each holding roughly 10,000 ETH, and that those wallets were emptied one by one over the following nine days, the last of them on 3 March. Bybit’s own timeline describes the funds being split across 39 addresses at the moment of the theft; the two counts describe different points in the movement. Elliptic also records that stETH and cmETH were exchanged for Ether on decentralised exchanges within minutes, which puts the value beyond a token issuer’s ability to freeze it, and that the resulting Ether was largely converted to bitcoin and then passed through Cryptomixer and Wasabi Wallet.

TRM Labs, writing on 26 February 2025, put at least $160 million through illicit channels in the first 48 hours, over $200 million by 23 February and over $400 million by 26 February, and attributed the theft to North Korea on the basis of “clear overlaps between the wallets used in this operation and those associated with past North Korean thefts.”

Chainalysis, on 24 February 2025 and updated on 27 February, recorded that it “worked with contacts in the crypto industry to help freeze more than $40 million in funds stolen from Bybit,” and that funds from the exploit “consolidated in addresses holding funds from other known DPRK-linked attacks.”

One service carried an outsized share. Elliptic’s post of 29 April 2025 is titled “the dark service used by North Korea to launder $200 million stolen from Bybit”, and describes eXch as an anonymous swap service that refused Bybit’s direct requests to block the activity. eXch announced closure effective 1 May 2025. Elliptic’s twelve-month review of 16 February 2026 records that by the six-month mark “over $1 billion had already been laundered, much of it through suspected Chinese over-the-counter (OTC) trading services”, and that as of February 2026 “the vast majority of the stolen funds have been processed”. The same piece puts DPRK-linked thefts across 2025 at a record $2 billion, taking the cumulative known total above $6 billion.

How it compares to the previous records

Elliptic’s assessment on the day: “This is by the far the largest crypto heist of all time, dwarfing the $611 million stolen from Poly Network in 2021 (and the vast majority of these funds were eventually returned by the hacker).”

The other benchmark is the Ronin bridge. In a statement of 14 April 2022, the FBI said: “Through our investigation we were able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $620 million in Ethereum reported on March 29.” Coverage of Ronin usually rounds that to $625 million. The figure used here is the FBI’s own.

What I think happened

The sentence you will read almost everywhere is that Bybit’s cold wallet was hacked. That framing sends you looking at the keys, and the keys were fine.

Three owners of that wallet signed. Their signatures were mathematically valid, produced by the right addresses, and the Safe contract checked them and did exactly what it had been instructed to do. Every key stayed on its device and the threshold held at three. What those three people were looking at when they approved was computed by JavaScript that had been sitting in somebody else’s S3 bucket for two days.

Look at what Bybit’s controls had in common. Three signers instead of one guards against a single compromised person. A cold wallet guards against a hot server, and the device on each signer’s desk guards against somebody lifting a key off a laptop. All of it sat downstream of one screen, and that screen came from a single vendor’s content delivery network. Three independent approvals of the same lie still add up to one lie.

The signature detail is the most concrete thing in the whole record and I have not seen it discussed anywhere. All three signatures carry v = 31. That is the eth_sign path, which means each device was handed a raw 32-byte digest and asked whether to sign it. Ask yourself what a screen can usefully show you at that point. It can show you the digest. You are being invited to confirm that a hash you cannot read corresponds to a transaction you cannot see. The strongest evidence for how Safe read its own failure is that it deleted that code path three days later.

The targeting is worth sitting with too. The injected script only fired when operation was 0, which tells you the attackers had studied Bybit’s routine and knew the normal flow was plain transfers to a warm wallet. NCC Group points out that Bybit had performed a delegatecall from this wallet before, moving mETH on 14 January. So a signer who did notice operation: 1 had a recent precedent for deciding it was fine. That is a much harder detection problem than “spot the weird field.”

Two things I will not claim. I will not say this has been proved against anyone, because nobody has been charged. The FBI stated that North Korea was responsible and published 51 addresses, Elliptic and TRM Labs each reached the same attribution from wallet overlaps before the FBI did, and Mandiant reached it from the intrusion side. That is a strong convergent record and it is still an attribution rather than a verdict. I also will not treat the Sygnia and Verichains documents as final. Both are titled preliminary and both say so on the page.

Here is the gap that still bothers me seventeen months later. Sygnia wrote in March 2025 that the most significant remaining gap was a comprehensive investigation into activity inside Safe’s AWS account, and noted that Mandiant’s report had not independently confirmed the S3 modification through forensics on Safe’s own infrastructure. Safe’s Ecosystem Foundation promised a full post-mortem on completion. I cannot find one on Safe’s blog: the March 2025 post-mortem material was posted to X as report snippets and nothing since. The most expensive supply-chain compromise in the history of this asset class has a two-week hole in the middle of its public timeline, covering 5 to 17 February, and the only description of what happened in that window comes from excerpts of a preliminary report on social media.

The precedent should have been louder. Sygnia sets two earlier incidents next to Bybit: WazirX in July 2024, roughly $230 million, and Radiant Capital in October 2024, roughly $50 million. Radiant’s own post-mortem describes devices “compromised in such a way that the front-end of Safe{Wallet} (f.k.a. Gnosis Safe) displayed legitimate transaction data while malicious transactions were signed and executed in the background.” WazirX described “a mismatch between the information displayed on Liminal’s interface and what was actually signed.” Same failure, seven months and four months earlier, at 16% and 3% of the size. Sygnia is careful to say neither of those originated inside Safe’s own infrastructure. The technique was documented and the industry read it as somebody else’s incident.

The part of Bybit’s conduct I would copy is the first twelve hours. Zhou said solvent on the record inside 90 minutes, went on camera at 17:15, kept withdrawals open through a bank run and cleared 350,000 requests overnight. The reason this desk has a Bybit exploit article and not a Bybit insolvency article is that decision, made under the worst pressure anyone in this industry has faced.

What would have changed the outcome

Nothing about how you personally hold crypto would have changed this. This was one exchange’s operating security and one wallet vendor’s build pipeline, and a retail holder, a family office and a fund were all equally spectators. There is no structure to recommend against it, and I am not going to invent one so that this section has a product in it.

The transferable lesson is blind signing, and it applies at every size.

A signature commits to a payload. The device signs the payload. The screen tells you what the payload is. When the process computing the screen and the process computing the payload are the same compromised code, the screen is decoration. That is the whole Bybit attack, and it is also what happens to somebody approving a token allowance on a phishing site for $4,000.

What follows from that, in rough order of how much it buys you:

  • Read the operation field, or use something that reads it for you. A delegatecall from a wallet is that wallet running someone else’s code against its own storage. It belongs in a different approval category from a transfer, and most signers have never been shown it.
  • Treat any signing flow that shows a hash as unverified. If the device cannot decode the call into something you can read, you are confirming a digest.
  • Decode the calldata somewhere the same server did not produce. A second machine, an independent simulator, a different network path. NCC Group’s assessment is that a review of the data parameter and the operation type “could have prevented the theft”, and there is nowhere to run that review except off the compromised surface.
  • Configuration changes deserve their own rule. Owners, threshold, modules, guard and the singleton pointer are the wallet changing what it is. Nothing in a routine treasury workflow should be able to touch them on the same approval path as a payment.

On hardware wallets specifically, because this is where the marketing gets ahead of the engineering. A hardware wallet solves key extraction, and it solves it well. It does not tell you the transaction is the one you intended. It displays what it is handed, and when what it is handed is a 32-byte digest there is nothing on the screen to check. This is the point I make in the cold wallet guide: the on-device screen is the control that matters, and it only functions as a control when the device can decode the call. Ledger, writing about this incident in March 2025, put the same thing more bluntly: “Even the most secure multi-signature setup is vulnerable if the signing interface is compromised.”

The honest limitation on the obvious answer. Moving assets to a third-party qualified custodian changes who operates the signing workflow. It reduces certain risks, including platform-insolvency risk, and it does not remove this one. It relocates it to the custodian’s own signing stack and interface. WazirX’s assets sat at Liminal, a custody platform, and Liminal’s interface is precisely what WazirX said displayed one thing while another was signed. No custody arrangement removes the risk that an authorised signer approves a transfer they should not have approved.

There is no dag.com link on this article. The test for including one is whether the structure would have changed the outcome, and here the answer is no.

Sources

Corrections

1 August 2026, update rather than correction. Two claims on this page were published with open verification items against them, and both have now been closed. The rule that a recovery byte above 30 selects the prefixed personal-message path was confirmed against the deployed contract source, and each of the three signatures was recovered independently against both the prefixed and the unprefixed digest. Nothing on the page changed as a result. A paragraph was added to “How were the three signatures produced?” distinguishing Safe’s ETH_SIGN label from the eth_sign JSON-RPC method, because the two are easy to conflate and conflating them suggests MetaMask’s August 2024 removal of eth_sign was relevant here. It was not.

Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.

More from the journal

Continue reading.