Scourge · February 21 2025

The Great Bybit Heist

Chronicle

On 21 February 2025 North Korean hackers from the TraderTraitor group, part of Lazarus, emptied the cold wallet of the Bybit exchange. They had compromised a developer's computer at Safe{Wallet}, the multisig service Bybit used, and altered the interface so that the signers approved a malicious transaction believing it was routine. About $1.5 billion in ETH went out: the largest crypto theft on record. Within days the FBI attributed it to North Korea.

Lesson learned

It taught that a multisig is only as good as what the signers actually see, and that the software supply chain reaches all the way to the best-guarded wallets.

Prayer of reparation

O Lazarus, who rise again with every theft, be blinded before our wallets, and let our signers truly read what they sign. Amen.

How it is remembered

Remembered by verifying transactions on an independent device before signing, protecting developers' computers as critical systems and distrusting any interface that "looks normal".