The Bybit hack: $1.5bn stolen through a third-party tool

In February 2025, crypto exchange Bybit lost nearly $1.5bn, the largest theft in the industry’s history. The attack went through the interface of a tool used to sign transactions.

On 21 February 2025, cryptocurrency exchange Bybit lost nearly $1.5bn in Ethereum. It is the largest cryptocurrency theft ever recorded.

How the attack worked

• Bybit’s signers were moving funds from a secure wallet to an everyday wallet through the Safe{Wallet} interface.
• According to investigators, the attackers had compromised a Safe developer’s computer and injected malicious code into the interface.
• The signers saw a normal transaction, while the transaction actually signed sent the funds to the attackers.
• The FBI attributed the attack to a North Korean group known as Lazarus or TraderTraitor.

The main lesson: what you see is not always what you sign

The signers did their job: they checked the screen and approved. But the screen itself had been tampered with. It is the same logic as a perfectly imitated fake invoice: if verification relies on a single channel, it can be fooled.

What businesses can take from it

• Verify important operations through a second, independent channel: a call, another device, another person.
• Limit how much a single operation can move.
• Watch the security of third-party tools used for payments and administration.
• Have a response plan: who to alert, how to freeze operations, how to communicate.

Transparency helped

Bybit communicated quickly and rebuilt its reserves, which limited panic among customers. When an incident happens, clear and fast communication also protects trust.

An approval is only safe if the screen showing it is safe.

Sources: FBI, Sygnia and Verichains reports, BleepingComputer, The Block, February and March 2025.

Want safer online payments on your website? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.