On February 21, 2025, attackers stole approximately $1.46 billion from Bybit's Ethereum cold wallet in a single transaction — the largest cryptocurrency theft ever recorded. The hack did not exploit a smart contract bug or break Ethereum's cryptography. It compromised a developer at Safe{Wallet}, injected malicious JavaScript into the interface Bybit used to sign transactions, and tricked three hardware-wallet signers into approving a contract upgrade they believed was a routine internal transfer. The attacker was North Korea's Lazarus Group, and the technique — a supply-chain attack on signing infrastructure — exposed a vulnerability at the heart of institutional crypto custody that no amount of multisig thresholds can fix alone.
Bybit and Safe{Wallet}: The Setup
Bybit, founded in 2018, is one of the world's largest cryptocurrency exchanges by spot and derivatives volume, serving over 60 million users. Like most exchanges, Bybit segregates customer funds between hot wallets (online, for daily withdrawals) and cold wallets (offline, for the bulk of holdings). Bybit's Ethereum cold wallet was a Safe{Wallet} (formerly Gnosis Safe) multisig smart contract — a 3-of-m threshold setup requiring three valid signatures to execute any transaction.
Safe{Wallet} is the industry standard for multisig custody, used by thousands of DAOs, exchanges, and institutions holding collectively hundreds of billions of dollars. Each Safe wallet is a proxy contract that delegates all execution logic to an implementation contract (called masterCopy) via delegatecall. This design means the implementation contract can be upgraded — a feature intended for legitimate updates, but one that becomes catastrophic if an attacker controls the upgrade.
The signers used Ledger hardware wallets to approve transactions. The signing flow was: open the Safe{Wallet} web interface → review transaction details on screen → sign with Ledger → transaction submitted on-chain. The assumption was that hardware wallets provide an air-gapped verification layer. That assumption proved fatal.
Timeline: 48 Hours That Changed Crypto
February 19, 2025, 15:29 UTC — Attackers injected malicious JavaScript into Safe{Wallet}'s AWS S3 bucket, replacing a legitimate resource file. The code was designed to activate only when the transaction source matched Bybit's cold wallet address (0x1db9...). Sygnia's forensic investigation confirmed the modification time using Wayback Archive caches.
February 21, 2025, ~14:13 UTC — Bybit signers opened the Safe{Wallet} interface to execute a routine transfer of ETH from the cold wallet to the hot wallet. The malicious JavaScript detected the target address and activated. The Safe UI displayed what looked like a standard transfer: "send 401,000 ETH to warm wallet." The actual transaction payload sent to the Ledger devices was something entirely different — a delegatecall that would replace the Safe's implementation contract with an attacker-controlled address.
14:16 UTC — Three signers reviewed their Ledger screens, saw raw transaction data they could not meaningfully interpret, and signed. The transaction was submitted on-chain: 0x46de.... The operation field was set to 1 (delegatecall) instead of 0 (call). The delegatecall target overwrote slot 0 of the proxy — the masterCopy address — replacing the legitimate implementation with 0xbdd0..., a contract the attacker had deployed 72 hours earlier.
14:16–15:10 UTC — The attacker called two backdoor functions embedded in the malicious implementation: sweepETH() and sweepERC20(). Across five transactions, they drained:
| Asset | Amount | USD Value (at time) |
|---|---|---|
| ETH | 401,346.77 | ~$1.12 billion |
| stETH | 90,375.55 | ~$253 million |
| cmETH | 15,000 | ~$44 million |
| mETH | 8,000 | ~$23 million |
| USDT | 90 | $90 |
| Total | ~$1.46 billion |
~14:18 UTC — Two minutes after the attack transaction was confirmed, the attackers uploaded clean versions of the JavaScript files to Safe's S3 bucket, removing the malicious code. This indicated real-time monitoring — they cleaned up immediately after the payload fired.
~12:30 PM UTC — Bybit detected the unauthorized outflow. CEO Ben Zhou went live on stream within hours, confirming the breach and assuring users that all other wallets were secure and withdrawals would continue processing.
The Numbers: Loss, Recovery, and Laundering
The $1.46 billion loss dwarfed every previous crypto hack. For context, the second-largest — Ronin Bridge in 2022 — was $625 million. Bybit's loss was 2.3x larger.
Bybit's immediate crisis was solvency. The exchange faced 580,000 withdrawal requests in the hours following the announcement. Bitget lent 40,000 ETH (~$95 million) to help bridge the gap. Bybit processed all withdrawals and remained solvent — a stark contrast to FTX's 2022 collapse.
Recovery efforts were unprecedented in scale:
- 15,000 cmETH (~$44M) — recovered by mETH Protocol, which froze withdrawals mid-attack, preventing the attacker from converting the tokens
- $43 million — recovered by the Mantle team through rapid response
- 181,000 USDT — frozen by Tether
- Bounty program — Bybit offered up to $140 million (10% of recovered funds), received 5,443 reports, validated 70
As of April 2025, CEO Ben Zhou reported the fund status:
- 68.57% remained traceable
- 27.59% had "gone dark" through mixers
- 3.84% (~$56 million) frozen with exchange cooperation
The laundering operation was industrial-scale. Lazarus converted 432,748 ETH (84.45% of stolen funds) to Bitcoin via Thorchain, then distributed the BTC across more than 35,000 wallets. 944 BTC (~$90.6 million) passed through Wasabi Mixer alone. They also used Pump.fun meme coin launches on Solana as a laundering vector — a technique that blends stolen funds with speculative trading volume.
Root Cause: A Supply-Chain Attack on Trust
The Bybit hack was not a smart contract vulnerability. It was a Web2 supply-chain attack that produced a Web3 catastrophe. The root cause chain:
1. Developer machine compromise. Lazarus social-engineered a Safe{Wallet} developer — likely through a targeted phishing or trojanized job interview payload, a technique DPRK has refined across multiple exchange hacks. They stole AWS session tokens from the developer's macOS machine, bypassing MFA.
2. JavaScript injection. Using the stolen AWS credentials, attackers pushed malicious JavaScript to Safe's S3 bucket / CloudFront CDN. The code was conditional: it only activated when the transaction source matched Bybit's cold wallet address. Every other Safe user saw the legitimate interface.
3. UI/payload mismatch. When Bybit signers opened the Safe interface on February 21, the JS intercepted the transaction. The UI rendered a standard ETH transfer. The actual EIP-712 typed data sent to the Ledger hardware wallets contained a delegatecall instruction targeting the attacker's contract. The operation parameter was flipped from 0 (call) to 1 (delegatecall) — a single bit that changed "transfer funds" to "replace the entire wallet logic."
4. Hardware wallet blind spot. The Ledger screens displayed raw hex calldata for the delegatecall. There is no human-readable decoding of delegatecall targets on hardware wallets today. The signers saw a long string of hex characters, assumed it matched what the Safe UI showed, and pressed confirm. Three signatures. One transaction. $1.46 billion gone.
5. Proxy upgrade exploit. Safe wallets use a proxy pattern where delegatecall to the implementation contract executes in the proxy's storage context. By calling delegatecall to a malicious contract, the attacker overwrote slot 0 — the masterCopy pointer — replacing the legitimate implementation with their own. The malicious contract contained sweepETH() and sweepERC20() functions that transferred all token balances to attacker-controlled addresses.
Why Hardware Wallets Did Not Save Bybit
The Bybit hack exposed a fundamental limitation of hardware wallets that the industry has long acknowledged but never addressed: they verify cryptography, not semantics.
When a Ledger device receives a transaction to sign, it displays the raw transaction data — recipient address, value, calldata (function call data as hex). For a simple ETH transfer, this is readable: "To: 0x..., Value: 401,000 ETH." For a delegatecall to an unverified contract, the calldata is an opaque hex string. The signer cannot tell whether 0x000000000000000000000000bdd077f651... means "upgrade implementation" or "transfer tokens."
NCC Group's teardown identified the specific gap: the EIP-712 signing payload did not bind the delegate-call branch of the operation in a way the signer could verify. The Safe UI showed a typed-data structure that looked like a transfer; the actual signed payload contained the delegatecall. The hardware wallet faithfully signed what it was given — it just was not given something it could meaningfully display.
This is not a Ledger-specific problem. Every hardware wallet on the market has the same limitation with complex transaction types. The industry needs human-readable transaction simulation and decoding on hardware wallet screens — or a separate verification layer that independently reconstructs what a transaction will do before signing.
The Attacker: Lazarus Group / TraderTraitor
On-chain investigator ZachXBT linked the attack to North Korea's Lazarus Group within 48 hours. His analysis showed that the attacker's wallet had conducted test transactions using addresses previously connected to the Phemex (January 2025, $73M), BingX (September 2024, $52M), and Poloniex (November 2023, $126M) hacks — four exchange breaches attributed to the same DPRK cluster.
The FBI formally attributed the Bybit hack to TraderTraitor (also tracked as Jade Sleet, UNC4899, Slow Pisces), a subgroup operating under North Korea's Reconnaissance General Bureau. Trail of Bits noted that these attacks are not one-off operations but the output of a "tested playbook" — a cross-platform toolkit refined across years of exchange compromises that can operate across Windows and macOS, maintain persistence with minimal detection, and manipulate what users see in their interfaces.
The $90 USDT test transaction before the main drain is a Lazarus signature. They test small before executing large — the same pattern appeared in the Phemex and BingX hacks. This consistency helps investigators attribute attacks but did not prevent this one.
Protocol Response and Industry Impact
Bybit's response was remarkably effective for a $1.46 billion loss. Ben Zhou's immediate livestream, transparent communication, and the decision to keep withdrawals open prevented a bank run from becoming a death spiral. The broader industry rallied: Bitget lent ETH, exchanges froze identified addresses, Tether blacklisted USDT, and mETH Protocol's quick action saved $44 million.
Safe{Wallet} temporarily paused operations, then migrated its infrastructure and implemented additional security measures including hardware-enforced transaction simulation. The incident triggered industry-wide reviews of multisig signing workflows, with several exchanges moving to air-gapped signing setups and independent transaction verification layers.
The hack also reignited debate about EIP-712 signing security, the adequacy of hardware wallet displays for complex transactions, and whether "cold wallet" is a meaningful term when the signing interface is loaded from a web server.
Lessons: What Would Have Prevented This
1. Air-gapped signing. If the signing machines had no internet connection — loading transaction data via QR code or microSD from a separately connected machine — the malicious JavaScript could never have reached the signing payload. True cold storage means the signing environment is offline, not just the keys.
2. Independent transaction simulation. A second system that independently simulates the transaction and displays the expected state change — "this transaction will replace the implementation contract, not transfer ETH" — would have caught the mismatch. Several teams are now building this layer.
3. Human-readable hardware wallet decoding. Hardware wallets must decode and display delegatecall targets, contract upgrade patterns, and function names — not raw hex. This is a hard problem but solvable.
4. Developer endpoint security. The entire attack hinged on one developer's macOS machine. EDR (Endpoint Detection and Response), hardware security keys for AWS access, and session token rotation would have raised the cost significantly.
5. Multi-party signing independence. If the three signers used different interfaces, different machines, and different verification methods, compromising all three simultaneously becomes exponentially harder. Bybit's signers all used the same Safe{Wallet} web interface — a single point of failure.
Frequently Asked Questions
How much was stolen in the Bybit hack? Approximately $1.46 billion in ETH and ERC-20 tokens: 401,346 ETH (~$1.12B), 90,375 stETH (~$253M), 15,000 cmETH (~$44M), and 8,000 mETH (~$23M), stolen on February 21, 2025.
Who hacked Bybit? The FBI formally attributed the attack to North Korea's Lazarus Group (TraderTraitor subgroup), with on-chain evidence compiled by ZachXBT linking it to the Phemex, BingX, and Poloniex hacks — all attributed to the same DPRK cluster.
Did Bybit users lose money? No. Bybit covered the loss from its own reserves, processed all 580,000 withdrawal requests, and remained solvent. No customer funds were lost. The exchange raised the funds through a combination of reserves, loans (Bitget lent 40,000 ETH), and recovery efforts.
How was the Bybit hack different from previous crypto hacks? Previous large hacks (Ronin, Wormhole, Nomad) exploited smart contract or bridge vulnerabilities. Bybit was a supply-chain attack on a third-party infrastructure provider (Safe{Wallet}) — no smart contract bug, no broken cryptography, just manipulated signing interfaces and hardware wallet display limitations.
Has any of the stolen money been recovered? As of April 2025, approximately 3.84% (~$56M) was frozen, 15,000 cmETH (~$44M) was recovered by mETH Protocol, $43M was recovered by the Mantle team, and 68.57% remained traceable. Bybit launched a $140 million bounty program. However, 27.59% has "gone dark" through mixers including Wasabi, Tornado Cash, and Railgun.
What is a delegatecall and why was it the attack vector? delegatecall is a Solidity opcode that executes code from another contract in the caller's storage context. In Safe wallets, the proxy uses delegatecall to the implementation contract. By sending a delegatecall to a malicious contract, the attacker overwrote the masterCopy storage slot — replacing the wallet's entire logic with their own code containing backdoor drain functions.