Bybit cold-wallet theft via tampered Safe{Wallet} front end and blind-signed approval

On 21 February 2025 Bybit reported unauthorized activity in one of its Ethereum multisig cold wallets during a routine transfer to a hot wallet. According to Bybit, the attacker altered the smart contract logic and masked the signing interface, and more than 400,000 ETH and stETH were moved to an unidentified address. The cold wallet was a Safe{Wallet} multisig; Verichains traced the theft to a transaction at 14:13:35 UTC that upgraded the implementation behind the wallet’s proxy contract, followed by a transfer of 401,346.76 ETH.

According to Verichains, as reported by The Hacker News, the JavaScript file served by app.safe.global was replaced with malicious code on 19 February 2025 and was designed to activate during the next Bybit transaction. Sygnia, as reported by BleepingComputer and The Block, concluded that an AWS S3 or CloudFront account or API key of Safe was likely leaked or compromised, found that the code activated only for specific contract addresses including Bybit’s, and found that clean JavaScript was uploaded two minutes after the malicious transaction was executed. NCC Group’s analysis of the tampered file shows it replaced the transaction’s destination with an attacker contract, switched the operation to delegatecall and replaced the data with a zero-value transfer call. Verichains and Check Point Research explain that, run as a delegatecall, this call overwrote storage slot 0 of the wallet, replacing the legitimate Safe implementation with the attacker’s; Verichains says the attacker then drained the wallet. NCC Group writes that signers would have seen the intended transaction in the web interface while their wallets received the tampered data, which is not human-readable.

In a livestream summarised by CriptoNoticias, Bybit CEO Ben Zhou said he made the final signature on a Ledger hardware wallet, that its screen showed a block of code rather than a clear destination address, and that he reviewed it, but not completely in detail. BleepingComputer describes the native Ledger integration as the signing method used in the theft, and NCC Group concludes that Bybit’s signers blind-signed the messages. The sources do not say which devices the other signers used. None of the forensic findings cited here describe a vulnerability in the hardware wallets themselves: they place the compromise in Safe{Wallet}’s infrastructure, and Bybit states that Sygnia and Verichains found no compromise of Bybit’s own infrastructure.

In a statement dated 28 February 2025, the Safe Ecosystem Foundation says the attack was achieved through a compromised Safe{Wallet} developer machine, which led to the proposal of a disguised malicious transaction, and that external researchers found no vulnerabilities in the Safe smart contracts or in the source code of the front end and services. Safe says it rebuilt and reconfigured all infrastructure, rotated all credentials and restored Safe{Wallet} on Ethereum mainnet in a phased rollout; according to BleepingComputer, the rollout temporarily removed the native Ledger integration and added monitoring alerts and extra validation of transaction hashes, data and signatures. In March, as reported by The Hacker News, Safe{Wallet} said its investigation with Mandiant found that the developer’s macOS machine was compromised on 4 February 2025 through a Docker project and that the attackers hijacked AWS session tokens to bypass multi-factor authentication. On 26 February 2025 the FBI attributed the theft to North Korea, naming the activity TraderTraitor.

What Safe advises:

• Exercise extreme caution and remain vigilant when signing transactions.