A NullMeridian record Andromeda Logs

NullMeridianLog

21 Feb 2025, 14:13 UTC

Bybit: ETH Cold Wallet Drained via Spoofed Safe{Wallet} UI

Bybit: on 21 Feb 2025 a spoofed Safe{Wallet} UI let attackers change its ETH cold-wallet logic and move ~$1.46B. Other cold wallets unaffected; Bybit says client assets remain 1:1 backed.

  • Event date
  • Incident typeExchange cold-wallet compromise
  • Bug classSocial engineering
  • Published

Loss, as sourced

~$1.46B from one ETH cold wallet, per Bybit: 401,347 ETH ($1.12B), 90,375 stETH ($253.16M), 15,000 cmETH ($44.13M), 8,000 mETH ($23M).

Traceability

Primary sources

  1. 01bybit.comBybit Security Incident Timeline and FAQs, 3 Mar 2025 (opens in a new tab)

In brief

Root cause: Per Bybit: phishing of ETH cold-wallet multisig signers; Safe{Wallet} UI showed a legitimate cold-to-warm transfer while the signed payload changed multisig logic. Bybit later cited Sygnia and Verichains preliminary reports pointing to malicious JavaScript on Safe{Wallet}'s platform; Bybit says no vulnerability in its own infrastructure.

Timeline, as sourced: Per Bybit (UTC): 21 Feb 13:30 routine 30,000 ETH transfer; 14:13 spoofed UI and outflows across 39 addresses; 15:44 first CEO update; 17:15 livestream; 22 Feb Safe pauses {Wallet}; 26 Feb preliminary reports shared.

Account, as sourced

Claimed (Bybit) (timeline (opens in a new tab)): spoofed Safe UI changed ETH cold-wallet logic; only that wallet compromised; client assets said to remain 1:1 backed.

Unknown: full independent post-mortem beyond the preliminary reports Bybit cites.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/bybit-eth-cold-wallet-safe-ui-2025