Crypto Custody Heist: Bybit Loses Record $1.34 Billion Amid Interface Layer Attack

In February 2025, Bybit, one of the world's largest crypto exchanges, suffered the largest crypto theft in history, losing $1.34 billion to an attacker.

The incident raised questions about the security of institutional custody practices, with many attributing the loss to a 'multisig failure.' However, a closer examination reveals that the attack was not a failure of multisignature cryptography itself, but rather a human error in approving a malicious transaction interface presented to signers.

The attacker compromised Safe's frontend infrastructure and served Bybit's signers a spoofed transaction interface, which appeared as a routine internal transfer. The signers, unaware of the deception, approved the malicious transaction, resulting in the loss of $1.34 billion.

This incident highlights the importance of hardening the interface layer where humans interact with the system, rather than solely focusing on cryptographic key management. Institutional custody design must treat this attack surface as a priority to prevent similar incidents in the future.