Bybit Hack: What the Safe Wallet Investigation Found
The February 2025 theft involved a compromised Safe developer and a manipulated transaction interface. Here is what investigators confirmed and what remains unknown.
On this page(4)
On February 21, 2025, attackers stole approximately $1.46 billion from one of Bybit’s Ethereum cold wallets. Bybit lists 401,347 ETH among the stolen assets. The incident centered on the transaction approval path through Safe{Wallet}, a third-party multisignature wallet interface.
What happened
Bybit says that during a routine transfer from a cold wallet to a warm wallet, attackers manipulated what the signers saw in the Safe interface. The signers approved a transaction that changed the wallet’s smart-contract logic. The attacker then transferred assets from that wallet to 39 addresses.
Bybit later reported that a Safe developer’s credentials had been compromised. NCC Group’s technical analysis describes malicious JavaScript inserted into the Safe web interface through a compromised developer machine. The code targeted Bybit’s transaction flow while the application otherwise appeared to work normally. The investigation found no indication that Bybit’s own infrastructure was compromised.
The FBI attributed the theft to North Korean TraderTraitor actors. Attribution and the mechanics of the malicious transaction are separate findings: neither establishes that an API key was leaked or identifies the exact credential type used to reach Safe’s environment.
Why multiple signatures did not stop it
Multiple approvals protect a transaction only when the signers can verify the transaction they are actually approving. In this case, the compromised interface presented a routine transfer while the signed data changed the wallet implementation. NCC Group traced the difference between the interface, the signed transaction and the on-chain contract changes.
What security teams can check
For systems that deploy transaction interfaces, inventory who and what can modify the production frontend, including developer sessions and deployment credentials. Restrict that access, review changes to delivered JavaScript, and make revocation procedures clear. For high-value transfers, verify destination and call data through an independent channel or device before signing. These are investigation and control priorities drawn from the incident, not claims that a single scanning product would have prevented it.
Cremit can help identify exposed credentials in supported repositories and public surfaces, verify supported credential types, and map findings to an owner. Those capabilities address one part of credential exposure management; the public investigation does not show that Cremit would have detected the particular access used in this attack.
Sources
Bybit: security incident timeline and loss breakdown
Bybit: preliminary forensic findings
FBI: attribution to TraderTraitor
NCC Group: technical analysis of the transaction and interface
Read next
GhostAction Analysis: How a Malicious Workflow Collects Keys from Git History
A review of 100 public workflow samples and Uber repository events shows four collector versions. We examine deleted-key collection through Git patches, successful exits after transfer failure, and credential-based response priorities.
The machine access behind an exposed API key
An exposed key is a lead. Connect it to its issuer, principal, permissions, workload, and owner before closing the access path.
AntV npm compromise: what the package evidence shows
Socket and SafeDep documented hundreds of malicious AntV-related npm releases. Compare exact versions, understand the two execution paths, and scope credentials exposed on affected hosts.
Get the next one in your inbox
Monthly NHI security brief from Cremit. One email, high signal.