Bybit cold-wallet theft — Ethereum — 2025-02-21

Summary

On February 21, 2025, Bybit executed a routine internal transfer of user funds from a cold wallet (long-term offline storage) to a warm wallet. The cold-wallet transfer was authorised through Safe{Wallet}, a third-party multisig signing platform. Per the FBI IC3 advisory and corroborating industry technical analyses, the Safe{Wallet} infrastructure had been compromised earlier in February 2025 via social-engineering-led targeting of a Safe{Wallet} developer's workstation: a benign JavaScript component in the Safe{Wallet} signing UI was replaced with malicious code that altered the destination address of the ETH transfer when Bybit's signers approved the operation. The signers saw a legitimate-looking transaction in the Safe{Wallet} UI; the transaction that actually settled on-chain redirected the ETH to attacker-controlled addresses. Approximately $1.46–$1.5B in ETH was extracted in the resulting transaction.

For OAK's purposes, the incident is predominantly off-chain: the entry vector was a software supply-chain compromise of a third-party signing-infrastructure vendor, not an on-chain attack on Bybit's contracts or wallets. OAK v0.1 does not have an on-chain Tactic that captures this entry vector — it is documented here, in the worked example, because the attribution and downstream on-chain manifestation are on the public record and because a defender working a Bybit-style scenario will want OAK Group references (G01) and the downstream on-chain Techniques (T7.001, T8.001) cleanly mapped.

Timeline (UTC)

When	Event	OAK ref
Earlier Feb 2025	Safe{Wallet} developer workstation compromised via social-engineering payload; malicious JS planted in signing UI	(off-chain entry vector — out of OAK on-chain scope)
2025-02-21	Bybit signers approve a routine cold-to-warm internal transfer via Safe{Wallet} UI	(off-chain)
2025-02-21	On-chain transaction settles: ETH directed to attacker-controlled addresses (~$1.46–$1.5B)	T5-equivalent (extraction event)
2025-02-21 to 2025-02-26	Funds moved across multiple addresses; mixer-routed hops and cross-chain laundering observed	T7.001 + (T7 cross-chain laundering — pending v0.x)
2025-02-26	FBI IC3 PSA published attributing to DPRK / "TraderTraitor" cluster	G01 attribution

What defenders observed

• Pre-event: Bybit's signing process relied on a third-party vendor (Safe{Wallet}) whose developer-workstation security posture Bybit did not directly control. This is a textbook supply-chain dependency — a Bybit-side mitigation would have required either independent verification of the signed transaction destination (out-of-band, before signing) or independent operation of the signing infrastructure.
• At-event (off-chain): the malicious JS modification was reportedly visible only at signing time and only to signers using the compromised Safe{Wallet} UI; out-of-band verification (e.g., reading the transaction destination from a hardware wallet display rather than from the web UI) would have caught the mismatch.
• At-event (on-chain): the extraction transaction itself was a single large outflow; on-chain monitoring at Bybit detected the anomaly within minutes of settlement, but at that point the transaction was already final.
• Post-event: the FBI's published attribution within five days (one of the fastest authoritative attributions in industry history) reflects how mature the wallet-cluster forensic methodology has become for DPRK-attributed activity. NCC Group published technical analysis of the malicious-JS deployment; multiple industry providers (Chainalysis, TRM, Elliptic) independently corroborated the wallet-cluster attribution.

What this example tells contributors writing future Technique pages

• OAK-Gnn (Threat Actors) is the right attribution surface for incidents like Bybit. A T1–T9 Technique mapping alone undersells the case; the incident is best understood as an OAK-G01-attributed action with on-chain manifestations at T7.001, T8.001, and the (pending v0.x) bridge / cross-chain laundering Techniques. This is the canonical example of why OAK introduces the Groups axis.
• Off-chain entry vectors are real and OAK acknowledges them honestly. OAK's on-chain Tactic taxonomy does not cover supply-chain compromise of third-party signing infrastructure. Worked examples should make this explicit rather than awkwardly stretching an on-chain Technique to cover an off-chain entry vector. The OAK position is: document the off-chain vector in the worked example; do not invent an on-chain Technique that does not actually capture it.
• Attribution speed has improved. The five-day FBI attribution timeline reflects mature wallet-cluster forensics. Contributors writing recent (post-2024) DPRK-attributed examples can cite both the FBI / Treasury authoritative attribution and the corroborating industry forensic providers.
• "Confirmed" attribution is the standard for OAK-G01 incidents. The Bybit case meets OAK's confirmed attribution standard (FBI IC3 PSA + multiple industry corroborations). Many smaller incidents in the OAK-G01 cohort are inferred-strong only and should be marked accordingly.

Public references

• FBI IC3 PSA — North Korea Responsible for $1.5 Billion Bybit Hack — primary authoritative attribution.
• NCC Group — Bybit Hack: In-Depth Technical Analysis — technical analysis of the malicious-JS deployment.
• Wilson Center — The Bybit Heist: What Happened & What Now? — policy-context overview.
• TRM Labs — The Bybit Hack: Following North Korea's Largest Exploit — laundering-route forensic analysis.
• [chainalysis2024dprk] for category context and cumulative DPRK figures.

Discussion

Bybit illustrates several gaps in OAK v0.1's on-chain-Tactic-only framing that the Threat Actors axis partially addresses:

1. Entry vector is off-chain (supply-chain compromise of vendor); OAK v0.1 has no Tactic for this. The OAK-G01 page documents social-engineering and supply-chain compromise as the dominant Lazarus entry vectors, which is the right place — they are not on-chain Techniques but they are operationally definitive for the Group.
2. Single-transaction extraction is on-chain but is not well-captured by the existing T5 Techniques (which are operator-of-token-controlled outflows; Bybit was a custody / signing compromise). A future v0.x update may introduce a T11 / Custody-and-Signing Tactic; the current TAXONOMY-GAPS reflects this.
3. Downstream laundering maps cleanly to OAK-T7.001 (mixer-routed) plus pending cross-chain laundering Techniques; the OAK-G01 page captures the operator continuity.

For OAK's broader credibility, including Bybit as a worked example in v0.1 is essential: it is the largest single on-chain event of 2025, attribution is confirmed, the case is the highest-profile real-world scenario in which a defender or risk team would reach for an attribution framework. A v0.1 that did not cover Bybit would read as scoped to memecoin-era incidents only.