The Bybit Incident: When Research Meets Reality - Check Point Research

On February 21st, Check Point’s Blockchain Threat Intel System detected a critical attack on the Ethereum blockchain where hackers gained unauthorized access to a Bybit multisig wallet, stealing approximately $1.5 billion in digital assets primarily consisting of Ethereum tokens. The attack represented a sophisticated breach that manipulated the Safe Protocol’s infrastructure and user interface, allowing attackers to deceive signers and execute unauthorized transactions by exploiting the execTransaction function. This incident marks one of the largest thefts in digital asset history and challenges previous assumptions about crypto security by demonstrating that even multisig cold wallets can be compromised through advanced UI manipulation techniques. Bybit’s forensic partners traced the root cause to a JavaScript file on app.safe.global that was swapped for malicious code on February 19, aimed specifically at Bybit’s cold wallet, while Safe{Wallet} blamed a compromised developer machine. The FBI attributed the theft to North Korea’s TraderTraitor actors, who were already converting the loot to Bitcoin.