Bybit: Signers validate a transfer... that delivers their safe

A cash transaction must move assets between two portfolios of Bybit. Several people have to agree. On February 21, 2025, however, their signatures authorize an operation that gives control of the wallet to the attacker. About $1.5 billion in assets are stolen.

The technical investigation marks a decisive step for Safe, the provider of the signature interface. A compromised developer position makes it possible to modify a resource served to users. The signatories see an expected operation, while the data actually presented for signature have been altered.

The breaking point is therefore not a cryptographic key guessed by an overpowered computer. It is the trust between the screen, the people in charge of controlling and the operation finally approved. Multiple signatures can confirm the same deception if they depend on the same misrepresentation.

Outflows of assets trigger the public incident and investigations. Bybit mobilizes investigators and organizes its liquidity; Safe rebuilds its environment and renews access. The interim report cited by Bybit finds no compromise on its own infrastructure. This conclusion is about the perimeter examined, not about any imaginable flaw.

The FBI attributes the theft to North Korean actors tracked under the TraderTraitor name. The investigators then observe the conversion and dispersion of assets across multiple networks. A group assignment does not automatically provide the name of each operator.

The case reveals a specific weakness: owning a safe and demanding several agreements is not enough if the guards are led to sign something other than what they believe they are verifying. The amount stolen, the recovery of reserves and the money actually recovered remain different measures.