What the published investigation says
Bybit reported that an Ethereum cold wallet was compromised on 21 February 2025. Its subsequent update described compromised Safe developer credentials and a manipulated signing experience. Bybit said the forensic firms it engaged found no indication that its own infrastructure had been compromised. These are attributed investigation findings, rather than an independent forensic determination by Web3Sec.
The useful distinction is between custody of a signing key and integrity of the transaction presented to its owner. A hardware wallet can keep a private key secret while the operator authorizes an action whose consequences are misunderstood.
The common dependency behind independent signers
Our analysis: count independent verification paths, not just people. If every signer reads the same browser application, the approval threshold still depends on a single presentation layer. A simulation opened through that same compromised workstation may share the failure mode.
For high-value transfers, construct a transaction manifest containing chain ID, wallet address, nonce, operation type, destination, value and decoded calldata. Compare that manifest through a separate, trusted path. Treat delegate calls, changes to owners or thresholds, module enablement and implementation changes as exceptional operations that require explicit review.
An exercise to run before the next treasury transfer
Use a test wallet and deliberately substitute an unexpected destination or privileged operation in a proposed transaction. Verify that the process rejects it before any signature is produced. Record which checks happen on the signing device, which depend on an application and which require a second device.
Define a stop condition for mismatched transaction details. Ensure the team can suspend signing, preserve frontend artifacts and coordinate an investigation without depending on the potentially affected application.
Controls to take away
- Review exact transaction semantics through an independent path.
- Separate routine transfers from privileged wallet administration.
- Practice a signing halt and evidence-preservation procedure.
Sources & further reading
Incident facts are attributed to the reports below. Controls and recommendations are our interpretation; this is not an independent forensic investigation.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.