Bybit’s signers approved what their screens showed, which was not what they signed

The week

On February 21, 2025, the cryptocurrency exchange Bybit disclosed that attackers had taken roughly $1.5 billion in ether from one of its cold wallets during what looked like a routine transfer to a warm wallet. The wallet required multiple approvals through a third-party interface, Safe{Wallet}. Investigations found that attackers had compromised a developer machine at the interface provider and injected malicious code into its web application, aimed specifically at Bybit. The signers saw what appeared to be a normal transfer; the transaction they approved handed control of the wallet to the attackers. On February 26 the FBI attributed the theft to North Korea, in activity it tracks as TraderTraitor. It was widely reported as the largest cryptocurrency theft to date. Bybit said it remained solvent and kept processing withdrawals, drawing on reserves and short-term loans.

Coverage of Bybit centered on crypto markets and North Korea. The method matters more widely. The multi-signature control worked as designed: several authorized people reviewed and approved the transaction. The attack succeeded because the screen they relied on had been altered, and the data they actually signed was not something a person could read.

Banks face a version of the same risk. Wires, treasury payments and securities settlements are approved by people looking at screens in applications that vendors often build and that browsers often deliver. Approval integrity can fail at four points along a payment’s life: when the approval interface is built and changed, when the approver views the transaction, when the payment is verified before release, and when a loss is chased afterward. Each point needs its own control, and a failure at any one can defeat the rest.

Build: the supply chain of the approval interface

The attackers never broke into Bybit’s own systems to plant the code. They compromised the company that supplied the interface, then targeted Bybit through it. That makes the approval tool part of the institution’s attack surface even when another company runs it.

Institutions should know who builds and hosts each interface used to approve high-value payments, how changes reach production and how quickly the institution would learn of malicious code. Web applications are a special case, because their code can change between one session and the next with no install for the customer to see. Controls include vendor commitments on development security and code signing, notice of changes to approval screens, and, where feasible, approval through an installed client or a pinned version that cannot change silently. Payment approval vendors belong in the critical tier of third-party oversight.

The developer’s workstation was the entry point at Bybit’s supplier, and that detail matters for diligence. Questions about a vendor’s security usually focus on its production environment. They should also cover how its engineers’ machines are protected, how access to build and deployment pipelines is controlled, and whether any single developer can push code to the approval interface without review. A vendor that cannot answer those questions has not secured the part of its business attackers chose.

View: making what is approved match what is executed

Approvers trust the screen to show the true beneficiary, amount and account. In Bybit’s case the display showed a routine transfer while the signed data did something else. Bank systems usually present human-readable details, but the same gap opens if the application, browser or endpoint is compromised, or if details were altered upstream before the approver saw them. Business email compromise, the costliest category of cyber-enabled fraud in the FBI’s annual internet crime reports, exploits a version of this gap: people approve details they believe are correct because they came through a trusted channel.

The control objective is to bring the approved view as close as possible to the executed instruction. Useful measures include showing key fields from the payment system’s own record rather than the request, highlighting any beneficiary detail that differs from previous payments, and dedicated, hardened workstations for high-value approvals. In crypto, the equivalent is a signing device that decodes and displays the transaction on its own trusted screen.

Verify: a second path to the truth before release

The strongest defense against a deceptive display is confirmation through a channel the attacker does not control. For banks that means calling back a verified contact before paying a new or changed beneficiary. Other options are hardware tokens that display transaction details for signing, and a release check that compares the outgoing instruction against an independent record. In crypto it means simulating the transaction in a separate tool before signing.

Independent verification is slower and costs money, so it should be proportionate. It should apply to the highest-value transactions, to non-routine ones and to any change in payment instructions. Bybit’s transfer looked routine, which is the case for not exempting routine transfers from the largest accounts. An institution can set a value threshold above which every movement, routine or not, gets a second-path check.

Recover: chasing the loss fast

The final point assumes the others failed. Bybit kept operating because it had reserves, quick access to emergency funding and a clear public message within hours. The stolen funds were moved and laundered rapidly, and only a small portion was frozen.

For banks, the equivalents start with payment recall procedures that can begin within minutes and standing contacts at correspondent banks. Large wire frauds should be reported quickly through the FBI’s Internet Crime Complaint Center, whose Recovery Asset Team works to freeze funds. Liquidity planning should include a large single loss. Recovery odds fall sharply after the first hours, so these steps need rehearsal, not just documentation. Communication is part of recovery too. A prompt, factual message to customers and counterparties protects liquidity as much as any funding line.

With hindsight

Bybit survived the theft. Safe{Wallet} and outside investigators published accounts tracing the compromise to a developer’s machine, which confirmed that the approval interface itself had been the target. North Korea’s campaign continued. In December 2025 Chainalysis estimated that North Korean actors stole about $2 billion in cryptocurrency during the year, a record. That was roughly 60 percent of the global total of about $3.4 billion, and Bybit was by far the largest single incident. The FBI and others kept warning about related methods, including fake job applicants and compromised developers inside technology suppliers. For banks, the relevance grew as treasury and payment approval moved further into browser-delivered platforms. Wherever approval runs through a vendor’s interface, Bybit remains the clearest case for treating what an approver sees as a control in its own right.