--- title: "How $50M Vanished on Three Signatures — And Why You Should Care" url: https://daily.dev/posts/how-50m-vanished-on-three-signatures-and-why-you-should-care-ftmbpacvy source_url: https://coinsbench.com/how-50m-vanished-on-three-signatures-and-why-you-should-care-e8feb91a5255 type: article source: "Coins Bench" published: 2026-08-26T10:49:06.668Z updated: 2026-08-26T10:49:35.353Z tags: ["blockchain", "phishing"] reading_time: 4 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How $50M Vanished on Three Signatures — And Why You Should Care **[Coins Bench](https://daily.dev/sources/coinsbench)** · 4 min read · 1 upvotes · 0 comments ## Summary An analysis of how the Radiant Capital ($50M) and Bybit ($1.5B) exploits both succeeded via the same attack pattern: signers approved transactions on a poisoned Safe Wallet screen showing different content than the actual calldata their hardware wallets signed. The author, a former fraud detection systems builder for financial institutions, argues that Web3 multi-sig setups copy the appearance of banking-style verification (multiple keys) but lack the substance (multiple independent information channels). Alert systems like Blockaid and Hypernative exist but suffer from alarm fatigue, since most alerts are false positives and signers stop reading them. Proposed fixes include natural-language transaction explanations and an independent second verification channel outside the wallet UI. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers steal $1.5 billion from Bybit using the Safe Wallet interface? Attackers poisoned the Safe Wallet transaction screen so signers approved calldata different from what displayed on screen, the same blind-signing exploit used against Radiant Capital four months earlier for $50M. This is attributed to the Lazarus Group and shows multi-sig requiring multiple private keys does not guarantee multiple independent sources of transaction verification. _Track emerging crypto exploit patterns like this on daily.dev before they hit your protocol._ ### Why do security alert systems like Blockaid and Hypernative fail to stop signers from approving malicious transactions? Alert fatigue causes signers to stop reading warnings because most alerts are false positives. In one credit card fraud detection system, out of every 100 alerts operators reviewed, only 4 were real fraud, so within three months operators assumed alerts were always false positives and stopped checking them, letting real threats slip through. _Developers designing fraud or risk alerting can compare tooling approaches on daily.dev to avoid alert fatigue._ ### What security fix would prevent Safe Wallet UI poisoning attacks like the one used against Radiant Capital? An independent second verification channel outside the working wallet UI, plus plain-language transaction explanations instead of generic risk alerts. Rather than a flashing 'RISK LEVEL: HIGH' warning, a message like 'this looks like a supply cap update but actually transfers ownership to an unverified contract deployed 14 days ago' gives signers something a human can actually act on. _Protocol founders evaluating multi-sig threat models can follow security writeups like this on daily.dev._ ## Similar posts on daily.dev - [Anatomy of a $53 Million Hack: How Radiant Capital’s Multisig Failed](https://daily.dev/posts/anatomy-of-a-53-million-hack-how-radiant-capital-s-multisig-failed-hr2mkr3kv) · Coins Bench · 1 upvotes · 0 comments - [The $1.5B Blind Spot — And Why You’re Next](https://daily.dev/posts/the-1-5b-blind-spot-and-why-you-re-next-4zf39eghr) · Coins Bench · 2 upvotes · 0 comments - [The Anatomy of a $53M Hack: Radiant Capital Post-Mortem and the Operational Security Playbook](https://daily.dev/posts/the-anatomy-of-a-53m-hack-radiant-capital-post-mortem-and-the-operational-security-playbook-w9tjebodm) · Coins Bench · 0 upvotes · 0 comments --- Tags: [#blockchain](https://daily.dev/tags/blockchain), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/how-50m-vanished-on-three-signatures-and-why-you-should-care-ftmbpacvy)