if every signer checks the screen, the transfer is what it says

what everyone assumed

A multisig wallet exists so that no single person can move the money. Bybit kept its ether in a cold wallet that needed several signers to approve any transfer, and each signer reviewed the transaction before approving it. This is the textbook answer to insider risk and to a single stolen device. If one signer is compromised, the others still have to agree, and they will only agree to what they can see.

what happened

On 21 February 2025, during what Bybit described as a planned transfer from its Ethereum multisig cold wallet to a hot wallet, the signers approved a transaction that changed the wallet’s smart contract logic. In Bybit’s words, the attack “masked the signing interface”. More than 400,000 ETH and stETH moved to an address the attackers controlled, according to BleepingComputer’s reporting of Bybit’s account.

What the attackers compromised was the interface the signers read. Bybit’s signers used Safe{Wallet}, a widely used multisig product, and its web app had been altered. Verichains and Sygnia, the firms that investigated for Bybit, found malicious JavaScript served from Safe’s AWS storage. It only activated for Bybit’s wallet and left every other customer alone. Sygnia found the files had been modified two days before the theft, and that clean versions replaced them about two minutes after the transaction executed.

The way in was a laptop. Safe’s preliminary report, published in early March 2025 with Mandiant and reported by CryptoSlate and Decrypt, traces the start to 4 February 2025, when a Safe developer’s macOS workstation was compromised through a Docker project that contacted a malicious domain. Mandiant believes the developer downloaded it as a result of social engineering. Safe’s AWS setup asked for multi-factor authentication again every 12 hours. The attackers tried to register their own MFA device and failed, so they used the developer’s active AWS session tokens instead, which kept working as long as the sessions stayed live. From there they could change the code that Bybit’s signers would later read.

how it surfaced

The transfer emptied the wallet in plain view on the Ethereum blockchain, and Bybit detected the unauthorised activity the same day. On 26 February 2025 the FBI attributed the theft to North Korea and named the activity TraderTraitor, putting the amount at approximately $1.5 billion, then the largest crypto theft on record. Bybit said it remained solvent and replenished its ether reserves. Safe rebuilt its infrastructure, rotated all credentials, and restricted privileged access to a few developers, with source code separated from infrastructure management.

The same group was assessed by analytics firms as behind the Binance theft in October 2026, which also began, according to Binance, on an engineer’s laptop.

A multisig wallet is only as honest as the screen every signer reads.

Several careful people checking the same screen add up to one check, if one outsider can change what the screen says. The approvers were independent of each other. The page they all trusted came from one developer’s laptop at another company.