How Did the Bybit Hack Happen?
In 2025, attackers stole about $1.5B from Bybit by tricking multisig signers through a compromised wallet interface. Here's how it worked and what it teaches.
In February 2025, attackers stole around $1.5 billion in ETH from the exchange Bybit, the largest crypto theft on record. The funds came from a multisig cold wallet, and the signers approved the transaction themselves. They just weren't approving what they thought they were.
What Bybit Was Protecting
Bybit kept a large reserve of ETH in a cold wallet secured by a multisig, meaning several authorized signers had to approve any transaction. It's a standard, widely recommended setup, and multisig is meant precisely to prevent a single compromised key from draining funds.
How the Attackers Got In
The attackers didn't break into Bybit's keys. Investigations found they compromised a developer machine at Safe, the provider of the multisig interface Bybit used, and inserted malicious code into the web interface. The code was designed to activate only for Bybit's wallet.
What the Signers Saw vs. What They Signed
During a routine transfer, Bybit's signers saw what looked like a normal transaction in the interface. Underneath, the transaction actually changed how the wallet itself worked, handing control to the attackers. Once enough signers approved it, the attackers drained around 400,000 ETH.
Why Multisig Didn't Stop It
Multisig protects against a single stolen key. It doesn't protect against every signer being shown the same false information. When all signers trust the same compromised screen, requiring several signatures just means several people approve the same deception, one of the real limitations of multisig.
The Problem of Blind Signing
Hardware wallets and signing tools often display transaction data that's hard for humans to read. If signers can't confirm what a transaction really does, they end up trusting the interface instead. A hardware wallet protects your keys, not your judgment, and it can only help if what it shows is actually checked.
Who Was Behind It
The FBI attributed the theft to North Korean hackers, part of the same broader threat activity linked to many major crypto heists.
How Bybit Stayed Solvent
Bybit covered the loss through its own reserves and support from other industry players, and continued processing customer withdrawals, which prevented a wider panic.
Lesson One: The Interface Is Part of the Attack Surface
Even perfectly secure keys can be misused if the screen showing the transaction is compromised. This is the same pattern behind fake DEX front-ends, at a much larger scale.
Lesson Two: Verify Transactions Independently
Large organizations now increasingly verify transaction details on separate devices or tools before signing, instead of relying on one interface.
Read and verify what you're signing, not what a screen claims you're signing. At $1.5 billion, Bybit showed that this rule applies to everyone.