Bybit hack (2025)
The theft of about 1.5 billion dollars in ether from a cold wallet of the Bybit exchange in February 2025, the largest known crypto theft, attributed by the FBI to North Korea.
A cold wallet keeps its keys offline and requires several signers for any transfer: it is the benchmark protection for exchanges. The attackers did not break it, they went around it through the supply chain: by compromising the computer of a developer at the signing interface provider, they altered what the signers saw on screen. The signers approved what they believed was a routine transfer, and the transaction actually handed control of the wallet to the thieves. The case shows that the security of a multisignature setup depends on the integrity of the screen used to sign. It also confirms that a sanctioned state specializes in stealing crypto assets, which makes every such theft a matter of political risk as much as fraud.
On February 21, 2025, about 401,000 ether, nearly 1.5 billion dollars, left Bybit's cold wallet. On February 26, the FBI attributed the theft to North Korean actors it calls TraderTraitor. The exchange covered the hole from its reserves and loans, and customer withdrawals were not suspended.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.