The Bybit theft shows that a supplier’s developer account can be the way into your largest transactions. Bybit says the credentials of a Safe developer were compromised, which let the attacker reach Safe{Wallet} infrastructure and deceive signers into approving a malicious transaction. Bybit’s forensic experts found no sign of compromise inside Bybit. The buyer question is who can change what your approvers see.
What happened in the Bybit theft?
On 26 February 2025 the FBI said North Korea was responsible for the theft of about 1.5 billion USD in virtual assets from the exchange Bybit, on or about 21 February 2025. The FBI calls this activity TraderTraitor. Bybit names the Lazarus Group and says US authorities identified Lazarus as the DPRK-linked group responsible. The full account is on our Bybit theft incident page.
Bybit says it began a routine transfer from an Ethereum multisig cold wallet to a warm wallet at 13:30 UTC on 21 February 2025. At 14:13 UTC, it says, attackers abused the Safe wallet interface, changed the smart contract logic of the cold wallet and moved the funds out, split across 39 addresses. Bybit lists the loss as $1.46 billion from a single cold wallet, and says its other cold wallets were not affected. Bybit also says Safe temporarily paused its Wallet functionality for a review, so a supplier incident can interrupt the tool you rely on as well as expose it.
Why does a supplier’s account matter to a buyer?
Bybit says its third-party forensic experts found no indication of compromise within Bybit’s infrastructure. It also says Safe confirmed on 22 February that there was no compromise of its codebase, no malicious dependencies, and that no other Safe addresses were affected. In Bybit’s account, the way in was a developer’s credentials at a supplier, not a flaw in the buyer’s own systems.
The sources opened for this post do not say how the developer’s credentials were taken, so do not assume a method. For background, CISA advisory AA22-108A (last revised 20 April 2022, now archived) describes TraderTraitor intrusions that began with spearphishing of staff at cryptocurrency companies, often in system administration or DevOps, with messages that mimic a recruitment effort.
Where could the chain have been caught?
Bybit’s account gives several points where a buyer could have asked a question. Each is a point in a chain, not proof that a single control would have stopped it.
- Developer credentials compromisedBybit says the credentials of a Safe developer were compromised.
- Supplier infrastructure reachedBybit says this gave the attacker access to Safe{Wallet} infrastructure.
- Malicious code on the platformBybit says preliminary reports pointed to malicious JavaScript on the Safe{Wallet} platform.
- Signers deceivedBybit says signers were deceived into approving a malicious transaction.
- Wallet logic changedBybit says the smart contract logic of the cold wallet was changed during what began as a routine transfer.
- Funds moved outBybit says the funds were split across 39 addresses.
Three of these points are worth a question. Who watches developer accounts at a supplier you depend on? Who reviews a change to the code of the interface your approvers use? Does a change to wallet logic look different from a normal transfer, and does it need its own approval?
What happened after the theft?
The FBI says the actors moved fast, converting some assets to Bitcoin and spreading others across thousands of addresses on several blockchains. It asked node operators, exchanges, bridges, analytics firms and other virtual asset providers to block transactions linked to laundering addresses, and it published Ethereum addresses it ties to TraderTraitor actors.
Bybit says 99.994% of over 350,000 withdrawal requests were processed within 10 hours, and that by 24 February it had received $1.23 billion in ETH through bridge loans, large deposits and OTC purchases, covering the ETH shortfall. On 7 August 2026 it said about US$48.4 million had been recovered and about US$30.5 million frozen across more than 28 exchanges and custodians, and that it had won a preliminary injunction freezing identified stolen assets. The US Treasury’s 2026 assessment says the DPRK stole digital assets worth $1.5 billion from Bybit, one of the largest digital asset thefts ever.
What should a CISO ask suppliers about signing tools?
Start with the tools between your approvers and the money, then work outward to the suppliers behind them.
- Who can change our approvers’ screen?Bybit says attackers abused the Safe wallet interface and signers approved a malicious transaction.
- Can approvers verify elsewhere?Bybit says the transaction and Safe interface were spoofed. Ask whether signers can check what they sign somewhere else.
- Who guards supplier developer access?Bybit says a Safe developer’s credentials were compromised. Ask how suppliers protect those accounts.
- Does a logic change need its own approval?Bybit says the wallet logic changed during a routine transfer. Ask whether that differs from a normal transfer.
- Can we block listed addresses fast?The FBI asked providers to block transactions linked to laundering addresses it listed.
CISA’s advice in the same advisory is general but fits: apply least access models and defense-in-depth to user and application privileges, enforce multifactor authentication, and keep an incident response plan that includes reporting to the FBI and CISA. Bybit says it reported the case to the appropriate authorities at 21:07 UTC on the day of the theft, and that it moved most funds out of its Safe Wallet administered addresses that day.
Related reading: the tj-actions compromise and the F5 breach.