## 1. What happened

On **February 21, 2025**, ByBit's Ethereum cold wallet (a Safe multisig at `0x1Db92e2EeBC8E0c075a02BeA49a2935BcD2dFCF4`) was drained in a single attack transaction. The total taken was approximately **$1.43 billion** at the time: 401,346 ETH (~$1.11B), 90,375 stETH (~$250.8M), 15,000 cmETH (~$44M), and 8,000 mETH (~$23.5M). [https://rekt.news/bybit-rekt/]

ByBit itself confirmed: "This transaction was manipulated through a sophisticated attack that masked the signing interface." [https://x.com/Bybit_Official/status/1892965292931702929] CEO Ben Zhou added: "All the signers saw the masked UI which showed the correct address and the URL was from Safe." [https://x.com/benbybit/status/1892963530422505586] The Lazarus Group (North Korea) was identified as the attacker. [https://rekt.news/bybit-rekt/]

## 2. Root cause

This was **not a smart contract bug**. A Safe{Wallet} developer's MacOS workstation was compromised via social engineering — the developer ran a malicious Docker project named "MC-Based-Stock-Invest-Simulator". The attackers (TraderTraitor / Lazarus Group) used this foothold to hijack AWS session tokens from the infected laptop, bypass MFA, and inject malicious JavaScript into the Safe{Wallet} frontend hosted on AWS. The JS was dormant except when the page detected ByBit's cold wallet address. When signers approved what appeared to be a routine cold-to-warm transfer, the injected code silently swapped the transaction calldata into a `delegatecall` to an attacker-controlled contract, which upgraded the Safe multisig's implementation to include a hidden `sweepERC20()` backdoor. The attackers then called that function to drain all assets. [https://rekt.news/not-so-safe/] [https://x.com/safe/status/1897663514975649938]

## 3. Pattern

**Key or signer compromise via frontend supply chain attack / blind signing.** The vulnerable shape: a multisig wallet whose signing interface is served from a centralized web infrastructure. If that infrastructure is compromised, the UI can display one transaction to the signers while presenting a different one on-chain. In pseudocode:

```
// Malicious JS injected into the Safe frontend
if (walletAddress === BYBIT_COLD_WALLET) {
    // Intercept the transaction proposal
    originalTx = { to: WARM_WALLET, data: transferCalldata };
    // Swap in a delegatecall to the attacker's contract
    maliciousTx = { to: SAFE_PROXY, data: delegatecall(ATTACKER_CONTRACT) };
    return sign(maliciousTx); // Signers see originalTx on screen
}
```

The signers rely entirely on the pixels their compromised browser renders to decide what to approve. There is no out-of-band verification of the raw calldata. [https://rekt.news/bybit-rekt/] [https://rekt.news/not-so-safe/]

## 4. The check that would have caught it

**A. Independent calldata verification (operational control).** Every multisig signer must decode and inspect the raw transaction calldata on a separate, air-gapped device before signing. If any signer had compared the calldata they were approving against the expected `transfer` invocation, the `delegatecall` substitution would have been immediately visible. The signing UI alone is insufficient: "The pixels that you see on your screen always come from somewhere else." [https://rekt.news/bybit-rekt/]

**B. Frontend integrity monitoring (review rule).** For multisig wallets holding institutional funds, deploy a canary script that loads the signing frontend at regular intervals, simulates a transaction to a test address, and verifies the resulting calldata matches the UI's claimed intent. Any divergence triggers an alert. The malicious JS sat in the Safe frontend for two days before execution — automated integrity checks would have caught it. [https://rekt.news/not-so-safe/]

## 5. Sources

- https://rekt.news/bybit-rekt/ (main post-mortem, Feb 22 2025)
- https://rekt.news/not-so-safe/ (Safe-focused follow-up, Mar 13 2025, with Mandiant forensic timeline)
- https://x.com/Bybit_Official/status/1892965292931702929 (ByBit official confirmation)
- https://x.com/benbybit/status/1892963530422505586 (Ben Zhou statement on masked UI)
- https://x.com/safe/status/1897663514975649938 (Safe investigation results with Mandiant)
- https://x.com/SlowMist_Team/status/1892963250385592345 (SlowMist initial alert with hacker addresses)
- https://x.com/benbybit/status/1894768736084885929 (Ben Zhou linking Sygnia and Verichains forensic reports)

Pages unreachable during research: CertiK blog (required JS+cookies beyond curl), Halborn analysis page (no specific ByBit post found), Verichains blog (404), QuillAudits Medium (blocked by Cloudflare). SlowMist's detailed analysis also blocked by Cloudflare on Medium; only their X alert was readable.