Writing
Bybit, February 2025: what the public record says about the withdrawal path
The sources agree on the outline of the event: a transfer from a cold wallet through a third party’s web interface that was altered. They differ on how far they go, and only one of those we read states what Bybit’s signers saw.
On 21 February 2025 about $1.5 billion in Ether left a Bybit cold wallet. The FBI says North Korea was responsible and calls the activity TraderTraitor. Sygnia, the forensic firm whose reports we read, says the transfer was an ordinary multi-signature transaction made through the Safe{Wallet} web interface, and that JavaScript served by that interface had been modified.
This note separates what the sources state from what they do not, then lists the questions a withdrawal-path review asks of any exchange whose signers use a third-party multisig interface. Every statement is tagged by source. Nothing here is a finding about the internal controls of any named company beyond what a source says, and we do not state a root cause that no source states.
What the sources state
| Date | What | Source |
|---|---|---|
| 2 Feb 2025 | Sygnia says the attacker registered the domain getstockprice[.]com. | Sygnia case study |
| 4 Feb 2025 | Sygnia says a Safe{Wallet} developer’s macOS workstation was compromised, “likely through social engineering” in the blog and “via social engineering” in the later case study and press release. The press release adds that the lure was a malicious Python application. | Sygnia blog (16 Mar 2025); Sygnia case study; Sygnia press release (18 Jun 2026) |
| 5 to 17 Feb 2025 | Sygnia says the developer’s AWS access token was used to reach Safe{Wallet}’s AWS infrastructure, where the attackers operated until 17 February. The case study adds that stolen session tokens were used and that a fraudulent MFA device was attempted. | Sygnia blog; Sygnia case study |
| 19 Feb 2025 | Sygnia says JavaScript resources on the AWS S3 bucket serving Safe{Wallet}’s web interface were modified. | Sygnia blog; Sygnia case study |
| 21 Feb 2025, 14:13:35 UTC | A successful execTransaction in block 21895238, sent from an address Etherscan labels “ByBit Exploiter” to the address it labels “Bybit: Cold Wallet 1”. Sygnia gives 14:13 UTC for the malicious transaction; Verichains gives 14:13:35 UTC. Neither Sygnia page we read prints the transaction hash; we matched the Etherscan entry by time and labels. | Etherscan; Sygnia case study; Verichains |
| 21 Feb 2025 | Sygnia says the transaction was manipulated by replacing it with a delegation call to a pre-deployed malicious contract, allowing the transfer of over 400,000 ETH from Bybit’s cold wallet. Verichains says the transaction replaced the implementation of the wallet proxy and moved 401,346.76 ETH. | Sygnia blog; Verichains |
| 21 Feb 2025, 14:15 UTC | Sygnia says the tampered JavaScript resources were modified about two minutes after the malicious transaction was executed, and that the malicious code was removed afterwards. | Sygnia blog; Sygnia case study |
| 21 Feb 2025, 16:47 (time zone not stated) | Sygnia says Safe{Wallet}’s first statement reported no evidence of frontend compromise at that stage. | Sygnia case study |
| 24 Feb 2025 | Sygnia says a breakthrough identified malicious injections on Safe{Wallet}’s website. | Sygnia case study |
| 25 Feb 2025 | Verichains published a technical analysis and said the incident was still under investigation. | Verichains |
| 26 Feb 2025 | The FBI says the theft was of approximately $1.5 billion in virtual assets, that North Korea was responsible, and that some of the stolen assets had been converted to Bitcoin and spread across thousands of addresses. | FBI Internet Crime Complaint Center public service announcement I-022625-PSA |
| 16 Mar 2025 | Sygnia published its blog analysis, saying the analysis was ongoing and that critical gaps remained. | Sygnia blog |
| 18 Jun 2026 | Sygnia published a press release summarising its findings and attributing the activity to a North Korean state-linked actor identified as the Lazarus Group. | Sygnia press release |
Where the sources differ
What signers saw. Sygnia’s case study says the Safe{Wallet} interface displayed legitimate transaction details to Bybit’s signers while different data was signed and executed. The Sygnia blog, as we read it, does not say what signers saw, and the Verichains analysis does not discuss signers or the interface. We did not read Bybit’s or Safe’s own statements.
When the JavaScript was tampered with. The Sygnia blog gives 19 February (its timeline and cache analysis) and also 21 February at 14:15 UTC, about two minutes after the transfer, and does not reconcile the two. The case study gives 19 February for the injection and says the code was removed right after the transfer.
How firmly the code is traced to Safe{Wallet}’s infrastructure. The Sygnia blog says the malicious code originated directly from Safe{Wallet}’s AWS infrastructure. It also says Mandiant’s preliminary report, shared by Safe{Wallet}, did not independently confirm the modification through a forensic investigation of that infrastructure, and that a comprehensive investigation of activity there is the most significant gap. The case study states that the frontend served altered JavaScript resources.
The wallet and the amount. Sygnia and Etherscan’s label call it a cold wallet; Verichains calls it a “Hot Wallet Proxy”. The FBI says approximately $1.5 billion; Sygnia says “over 400,000 ETH” in the blog and “nearly 400,000 ETH” in the case study; Verichains says 401,346.76 ETH.
How certain the first compromise is. The blog says “likely through social engineering”; the later case study and press release drop the hedge.
What the sources do not say
- Who at Bybit approved the transaction, with which devices, and under which signing procedure.
- What Bybit’s signing devices, as distinct from the web interface, displayed.
- Whether any of the sources we read examined Bybit’s own controls. Sygnia says its timeline was based on its investigation of Bybit’s signers’ hosts; it does not publish findings on Bybit’s procedures in the pages we read.
- What Bybit or Safe changed afterwards. We could not read Bybit’s own pages (they timed out) or Safe’s statements (not retrievable), and found no Safe-authored post-mortem.
- The text of the Mandiant report, or any Verichains report beyond its 25 February 2025 blog post. We found neither.
- A single stated root cause. The sources describe a chain from a developer workstation to a modified interface to a manipulated transaction; none of those we read adds more than that.
What the sources say about controls
Very little, and none of it is a regulator’s finding. Sygnia says Safe{Wallet}’s infrastructure was temporarily taken offline, and that Bybit did not halt operations or user withdrawals. It says its own investigation left a gap: the activity inside Safe{Wallet}’s AWS infrastructure had not been comprehensively investigated, so that “critical gaps remain before we can be fully assured that this attack vector will not be exploited again.” The case study states a general lesson, “Multi-signature protections assume that signers see what they sign”, and its press release comments on the sector’s use of “single-signing mechanisms, without the rigorous controls and distributed authorization”; neither is framed as a finding about Bybit or Safe specifically. The sources we read do not describe any change Bybit or Safe made to its own controls afterwards.
Questions a withdrawal-path review asks
These are the questions we put to any exchange whose signers use a third-party multisig interface. They are our analysis of a structure the public record describes, not a statement that any company lacked a control.
Sources
- FBI Internet Crime Complaint Center, public service announcement, 26 Feb 2025: ic3.gov
- Etherscan, transaction page: etherscan.io
- Sygnia, “Sygnia’s Investigation into the Bybit Hack: What We Know So Far”, 16 Mar 2025: sygnia.co
- Sygnia, Bybit heist case study (undated): sygnia.co
- Sygnia, press release, 18 Jun 2026: sygnia.co
- Verichains, “Technical Analysis of the Bybit Hot Wallet Exploit”, 25 Feb 2025: blog.verichains.io
- Not read: Bybit’s own incident pages (timed out), Safe’s statements (not retrievable), the fbi.gov statement, and Mandiant’s report (not found).
Quotations and dates are as printed in the sources; times are UTC unless a source gives none, and the time zone of three entries in the Sygnia case study is not stated. If you represent a company named here and see an error, or can point us to a source we could not read, write to research@deebug.io and we will correct it.