The $1.5B Bybit Hack: The Era of Operational Security Failures Has Arrived

Summary: On February 21, 2025, cryptocurrency exchange Bybit lost approximately $1.5B from its multisig cold storage wallet, the largest cryptocurrency theft in history, after attackers compromised multiple signers' devices and manipulated what signers saw in their wallet interface while collecting the required signatures. Researcher ZachXBT provided proof linking the attack to North Korea, whose state-sponsored groups tracked as TraderTraitor, Jade Sleet, UNC4899, and Slow Pisces run social engineering campaigns, including job recruitment pretexts, against system administration, software development, and treasury personnel.
Why it matters: The attackers did not exploit a smart contract or application flaw; they compromised the computers used to manage the system, so a $1.5B loss came from operational security rather than code, and the same tested playbook is being reused against each new target.

Read the original at Trail of Bits Blog ↗