On 21 February 2025, Bybit lost nearly $1.5 billion worth of Ethereum in what became the largest cryptocurrency heist on record. Forensic investigators found the attackers had compromised a developer's device at Safe{Wallet}, the multisig platform Bybit used, to manipulate a transaction.
The FBI publicly attributed the attack to North Korea's Lazarus Group, and blockchain analysts tracked the rapid laundering of hundreds of millions of dollars across mixers and cross-chain bridges in the following weeks.
Infrastructure is the new attack surface
Notably, Bybit's own systems were not directly broken; the weak point was a trusted third-party tool in its signing workflow. The incident pushed exchanges across the industry to re-examine supply-chain risk in their custody and signing infrastructure.
Cold storage is only as strong as the signing process
The failure was in how a transaction was approved and displayed, not in the vault itself. Multi-signature schemes assume signers can verify what they are signing.
The exchange's ability to meet withdrawals through the event was the genuinely reassuring detail, and the reason confidence recovered as quickly as it did.
