Bybit hack forensics show SafeWallet compromise led to stolen funds

By Matt Brienen

Published: 2025-02-26T19:01:26+00:00

A series of third-party forensic investigations into the recent Bybit exploit revealed that compromised SafeWallet credentials led to more than $1.4 billion worth of Ether

being stolen by North Korea’s Lazarus Group.

On Feb. 26, Bybit confirmed that forensic reviews conducted by Sygnia and Verichains revealed that “the credentials of a Safe developer were compromised [...] which allowed the attacker to gain unauthorized access to the Safe(Wallet) infrastructure and totally deceive signers into approving a malicious transaction.”

According to Sygnia’s report, the attack originated from a “malicious JavaScript code” injected into SafeWallet’s Amazon Web Services infrastructure.

The findings were also confirmed by the SafeWallet developer, which said it had “added security measures to eliminate the attack vector.”

“The Safe(Wallet) team has fully rebuilt, reconfigured all infrastructure, and rotated all credentials, ensuring the attack vector is fully eliminated,” the announcement said.