$1.5B Bybit Hack Exposes Multisig Interface Vulnerabilities

The $1.5 billion Bybit hack in February 2025 was not just a smart-contract bug, but an operational security failure that highlighted the importance of multisig setup and interface integrity.

Bybit's engineers used Safe-based multisig cold wallets to move ETH from cold storage to a warm wallet, a routine operation they had performed many times before. However, attackers hijacked AWS session tokens and swapped a JavaScript bundle served from Safe's own frontend, rewriting the pending transaction without touching the Safe smart contract.

The signers used Ledger hardware wallets, but a hardware wallet can only show what the software feeding it chooses to display. This 'blind signing' was the crux of the problem: the interface, not the cryptography, was the attack surface.