The $1.5B Blind Spot — And Why You’re Next
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
An analysis of the February 2025 Bybit hack, in which North Korea's Lazarus Group stole roughly $1.5 billion in ETH from a Safe (Gnosis Safe) multisig cold wallet secured with Ledger hardware wallets. Attackers compromised a Safe developer's macOS machine, hijacked AWS session tokens, and injected malicious JavaScript into Safe's frontend that only activated for Bybit's wallet addresses. The injected code silently swapped a routine transfer for a delegatecall that transferred wallet ownership and reduced required signatures to one, letting attackers drain funds in under 15 minutes while all three Ledger signers unknowingly approved it because their hardware wallets couldn't decode the malicious payload. The piece argues the core failure was that all signers trusted a single compromised UI, and recommends independent verification tools, better hardware wallet decoding, and time locks for contract upgrades.
Questions this post answers
How did attackers steal $1.5 billion from Bybit's Ethereum cold wallet despite using a multisig setup with Ledger hardware wallets?
Attackers compromised a Safe{Wallet} developer's macOS machine via social engineering, hijacked AWS session tokens, and injected malicious JavaScript into Safe's frontend that activated only for Bybit's wallet addresses. When Bybit initiated a routine ETH transfer, the JS silently substituted a delegatecall transaction that transferred wallet ownership to attacker addresses, which all three Ledger signers approved because their hardware wallets couldn't decode the payload. Teams securing multisig wallets can follow deep dives on infrastructure compromise and blind signing risks via daily.dev.
Why couldn't the Ledger hardware wallets prevent the Bybit multisig hack even though three signatures were required?
Ledger hardware wallets displayed structured data fields but could not decode what the transaction's data parameter actually did, showing the critical delegatecall change only as a numeric operation:1 parameter with no meaningful context. Because all three signers relied on the same compromised Safe frontend to interpret the transaction, three-of-three multisig security collapsed to one-of-one once that single interface was poisoned. Anyone evaluating hardware wallet trust assumptions can track blind signing research and fixes on daily.dev.
What role did delegatecall play in the Bybit hack and why is it dangerous in multisig contracts?
The delegatecall in the malicious transaction rewrote the list of authorized multisig signers to attacker-controlled addresses and dropped the required signature threshold to one, letting the attacker drain all remaining funds unilaterally afterward. This single opcode converted one blindly approved transaction into a full takeover of wallet ownership, bypassing the entire three-signer protection model. Developers auditing smart contract permission changes can keep up with delegatecall exploit patterns through daily.dev.