Bybit Hack Analysis (III): Implications and the Future of Crypto Security After the Bybit Hack
By Kike Gandia · Threats · 4 min read
The $1.5 billion attack on Bybit has exposed critical vulnerabilities in the security infrastructure that underpins even the most sophisticated exchanges in the Web3 ecosystem. Forensic investigations by specialist firms such as Verichains and Sygnia Labs have revealed alarming details about the methodology used by the North Korean hackers, exposing a new dimension of attacks that challenges current security paradigms.
The attack method revealed
Independent audits have confirmed that the attack vector did not originate in Bybit's infrastructure but in that of Safe (formerly Gnosis Safe), the multisig wallet provider used by the exchange. The hackers managed to compromise a Safe Wallet developer machine and inject malicious JavaScript directly into the infrastructure hosted on Amazon Web Services2.
The most sophisticated part of the attack was its targeted design: the malicious code was programmed to activate only when it interacted with Bybit's contract address, which allowed it to stay undetected until exactly the right moment. Just two minutes after executing the hack, the attackers removed the malicious lines of code, wiping out virtually every trace of their intervention.
The industry's response
Safe has publicly acknowledged that the hack came from “a compromised Safe Wallet developer machine”, while stressing that there were no vulnerabilities in its smart contracts or front-end source code. The company has stated that it has completely rebuilt and reconfigured its infrastructure and rotated all its credentials to eliminate any residual attack vector.
The situation has caused significant concern in the crypto community about the reliability of solutions considered practically unbreakable:
“If it's Safe, then we're in a really bad situation,” Aurora co-founder Alex Shevchenko wrote in a since-deleted tweet.
Market impact and investor sentiment
The hack had a devastating effect on crypto market sentiment. The Crypto Fear & Greed Index, used to gauge market mood, plunged from 55 (neutral) to 21 (extreme fear) in less than a week12.
The resulting volatility caused Bitcoin to lose roughly 20% of its value over the past month, while Ethereum suffered an initial 4.2% drop after the hack was announced, falling from $2,828 to $2,708 before briefly rebounding7.
Attribution and sophistication of the attack
The FBI has officially confirmed that the North Korean group TraderTraitor (another name for the Lazarus Group) was responsible for the attack4. The group, under watch since 2022 for its attacks on blockchain companies, has shown an unprecedented ability to move and launder stolen funds.
“What sets this hack apart is the extraordinary pace of post-hack laundering,” said Ari Redbord, global head of policy at TRM Labs6. In just two days, the North Korean group pushed $160 million through illicit channels, “an amount that would have been unthinkable to move so quickly just a year ago”6.
Challenges for multisig security
The Bybit hack has challenged fundamental beliefs about cryptocurrency security, showing that even with robust smart contracts and multisig protections, the human factor remains the weakest link8. The incident has highlighted how user interface manipulation and social engineering can compromise even the most secure wallets8.
Check Point Research had previously identified a worrying pattern in which attackers manipulated legitimate transactions through the Safe Protocol's execTransaction function8. That research, published in July 2024, provided a technical analysis of how the function operates within the Safe framework and documented cases where it had been used in attack chains8.
The future of Web3 security
MetaMask's Taylor Monahan, a recognized expert on North Korean crypto hacks, has warned that the industry needs stronger security: “It's time to get really fucking serious about security. The bad guys will do crazy things to get in because the payoff for doing so is millions — billions! — of dollars”.
The incident has prompted a call to action to implement:
- More robust verification systems that go beyond traditional multisig
- Real-time transaction monitoring with anomaly detection capabilities
- Isolated development infrastructure with strict access controls
- Continuous security audits and regular penetration testing
Conclusion
The Bybit hack marks a turning point for Web3 security. It has shown that even the most advanced security solutions can be vulnerable to sophisticated attacks that combine social engineering, interface manipulation and in-depth knowledge of blockchain protocols.
The industry now stands at a crossroads where it must reinvent its approach to security, prioritizing not only technical robustness but also resistance to human manipulation. The future of Web3 security will depend on the ecosystem's ability to learn from this incident and build more comprehensive defenses that protect both the code and the people who use it.
Related service
Pentesting and ethical hacking services