How Threat Modeling Could Have Prevented the $1.5B Bybit Hack
Summary: On February 21, 2025, cryptocurrency exchange Bybit lost $1.5 billion in the largest crypto hack to date, after attackers compromised the Safe signing frontend used by all of its multisig signers and manipulated transaction data so signers authorized a change to a malicious implementation address. Trail of Bits attributes the breach to operational security failures rather than code flaws, citing similar incidents at WazirX ($230M) and Radiant Capital ($50M), and says the signers could not see what they were signing because of interface-modifying malware and the limits of blind signing on hardware wallets.
Key Takeaway: The multisig was bypassed without breaking it: every signer approved the malicious transaction, so the control that was supposed to require multiple people failed at the point where humans read what they were signing. Trail of Bits notes its threat model assessments for blockchain clients usually stay confidential, which leaves the industry without public evidence of whether this class of failure gets caught before an attacker finds it.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026