--- title: "The $1.5B Blind Spot — And Why You’re Next" url: https://daily.dev/posts/the-1-5b-blind-spot-and-why-you-re-next-4zf39eghr source_url: https://coinsbench.com/the-1-5b-blind-spot-and-why-youre-next-87310ac96a7f type: article source: "Coins Bench" published: 2026-08-26T10:49:06.794Z updated: 2026-08-26T10:49:35.379Z tags: ["crypto"] reading_time: 4 upvotes: 2 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The $1.5B Blind Spot — And Why You’re Next **[Coins Bench](https://daily.dev/sources/coinsbench)** · 4 min read · 2 upvotes · 0 comments ## Summary An analysis of the February 2025 Bybit hack, in which North Korea's Lazarus Group stole roughly $1.5 billion in ETH from a Safe (Gnosis Safe) multisig cold wallet secured with Ledger hardware wallets. Attackers compromised a Safe developer's macOS machine, hijacked AWS session tokens, and injected malicious JavaScript into Safe's frontend that only activated for Bybit's wallet addresses. The injected code silently swapped a routine transfer for a delegatecall that transferred wallet ownership and reduced required signatures to one, letting attackers drain funds in under 15 minutes while all three Ledger signers unknowingly approved it because their hardware wallets couldn't decode the malicious payload. The piece argues the core failure was that all signers trusted a single compromised UI, and recommends independent verification tools, better hardware wallet decoding, and time locks for contract upgrades. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers steal $1.5 billion from Bybit's Ethereum cold wallet despite using a multisig setup with Ledger hardware wallets? Attackers compromised a Safe{Wallet} developer's macOS machine via social engineering, hijacked AWS session tokens, and injected malicious JavaScript into Safe's frontend that activated only for Bybit's wallet addresses. When Bybit initiated a routine ETH transfer, the JS silently substituted a delegatecall transaction that transferred wallet ownership to attacker addresses, which all three Ledger signers approved because their hardware wallets couldn't decode the payload. _Teams securing multisig wallets can follow deep dives on infrastructure compromise and blind signing risks via daily.dev._ ### Why couldn't the Ledger hardware wallets prevent the Bybit multisig hack even though three signatures were required? Ledger hardware wallets displayed structured data fields but could not decode what the transaction's data parameter actually did, showing the critical delegatecall change only as a numeric operation:1 parameter with no meaningful context. Because all three signers relied on the same compromised Safe frontend to interpret the transaction, three-of-three multisig security collapsed to one-of-one once that single interface was poisoned. _Anyone evaluating hardware wallet trust assumptions can track blind signing research and fixes on daily.dev._ ### What role did delegatecall play in the Bybit hack and why is it dangerous in multisig contracts? The delegatecall in the malicious transaction rewrote the list of authorized multisig signers to attacker-controlled addresses and dropped the required signature threshold to one, letting the attacker drain all remaining funds unilaterally afterward. This single opcode converted one blindly approved transaction into a full takeover of wallet ownership, bypassing the entire three-signer protection model. _Developers auditing smart contract permission changes can keep up with delegatecall exploit patterns through daily.dev._ ## Similar posts on daily.dev - [How $50M Vanished on Three Signatures — And Why You Should Care](https://daily.dev/posts/how-50m-vanished-on-three-signatures-and-why-you-should-care-ftmbpacvy) · Coins Bench · 1 upvotes · 0 comments - [The $38 Million Ghost in the Machine](https://daily.dev/posts/the-38-million-ghost-in-the-machine-dsu0zxffl) · Coins Bench · 3 upvotes · 0 comments - [The Auditors Signed Off. The Money Left Anyway.](https://daily.dev/posts/the-auditors-signed-off-the-money-left-anyway--p8brhmwb5) · Coins Bench · 0 upvotes · 0 comments --- Tags: [#crypto](https://daily.dev/tags/crypto) [View this post on daily.dev](https://daily.dev/posts/the-1-5b-blind-spot-and-why-you-re-next-4zf39eghr)