How $1.5 Billion Disappeared in 47 Minutes: The Bybit Hack Dissected

The Setup: Months Before February 21

The attack did not begin on February 21. It began months earlier, when Lazarus Group’s TraderTraitor subunit identified that Bybit used Safe (formerly Gnosis Safe) for its ETH cold-wallet management. Safe is a battle-tested multisig wallet platform, but like any software-based signing system, it depends on a trusted execution environment — and that environment was the target.

Attackers gained access to the laptop of a developer at Safe via a social-engineering campaign. The exact vector has not been publicly confirmed, but follows the established TraderTraitor playbook: staged recruitment conversations or technical challenges on LinkedIn or Telegram, ultimately delivering a payload to the developer’s machine. Once on the developer’s laptop, the attackers waited.

The Attack in Technical Detail

The genius — if it can be called that — of the Bybit attack was that it exploited a trust boundary that no one at Bybit had reason to question: the Safe UI itself. The signers did not sign the wrong transaction because they were careless. They signed the wrong transaction because the interface they trusted showed them a different transaction from the one they were actually authorizing.

What the signers saw: a routine ETH transfer to familiar Bybit addresses, with matching gas parameters and expected amounts.

What the Ethereum Virtual Machine processed: a DELEGATECALL to a new implementation contract controlled by the attackers — effectively handing over the keys to the entire cold wallet in a single, irrevocable on-chain operation.

The attack required no zero-day exploit in Safe’s contract code. It required only that an attacker-controlled piece of JavaScript run in the browser at the moment of signing — intercepting the transaction display, replacing the shown parameters with legitimate-looking values, while passing the real malicious payload to the hardware wallet for signing.

The Laundering Operation

Within hours of the drain, the 401,346 ETH was being distributed across dozens of intermediate wallets — a fan-out technique designed to fragment the on-chain trail before aggregation. Chainalysis and TRM Labs tracked the funds through a sophisticated multi-stage laundering process that has since become Lazarus’s standard playbook:

• Fan-out: Funds split across 50+ intermediate wallets to complicate tracing.
• eXch: A no-KYC crypto exchange service used for initial conversion from ETH into other assets.
• THORChain: The permissionless cross-chain swap protocol used to convert across chains without centralized intermediary risk.
• Chinese OTC desks: Final off-ramp into fiat, through informal over-the-counter brokers in Southeast Asia.

Total recovered or frozen by the industry-wide response: approximately $42 million — less than 3% of what was stolen. The remainder is believed to be partially laundered and partially still in transit through intermediate holding wallets.

The Crisis Response That Saved Bybit

CEO Ben Zhou’s decision to announce publicly within two hours, and to commit unconditionally to absorbing the full $1.5 billion loss, is widely credited with preventing a catastrophic bank run. The exchange faced $4 billion in withdrawal requests in the first 24 hours — and met every one of them, backed by emergency loans from major crypto institutions and overnight reserve transfers from partners. Cold-wallet balances were replenished to 1:1 backing within 72 hours.

What the Bybit Attack Revealed About the Signing Problem

The Bybit hack exposed a structural weakness that exists across every multisig-based custody system that depends on a software UI for transaction visualization: the human signer cannot independently verify what they are signing if the visualization layer can be compromised.

The attack had a clear, exploitable pre-signature gap: no system was in place to independently verify that the transaction parameters shown to signers matched the transaction parameters being submitted to the network. A pre-signature monitoring layer — one that independently evaluates the actual transaction payload against expected parameters before the signing ceremony proceeds — would have detected the discrepancy between what the UI showed and what the EVM was about to execute. Web3Firewall’s transaction simulation capability, which dry-runs a transaction’s full execution path before it is signed, is precisely designed to catch this class of attack: the payload diverges from the display, and the simulation produces an unexpected outcome, triggering an escalation before any irreversible action is taken.