Hackers Planted Code in Safe Wallet to Drain $1.5 Billion From Bybit

One Signing App, $1.5 Billion

Nearly $1.5 billion left the crypto exchange Bybit in February 2025, and the door the attackers used did not belong to Bybit. They planted code inside Safe{Wallet}, an outside signing application the exchange had folded into its transfer workflow, a common arrangement for desks that sign multisig transactions through a dedicated interface. Staff members reviewing a transaction saw one destination on screen while the signature they produced authorized another. The FBI attributed the operation to North Korea. Bybit's customers were exposed through infrastructure they never touched. No private key was ever stolen. The thieves never obtained the master credentials controlling the wallets; they tricked the exchange's own approval systems into releasing funds, and the compromise sat in the application layer, one step above the cryptography itself. Multisig signing exists to force more than one approval before money moves, and the planted code defeated that check by controlling what the approvers saw. The $1.5 billion that left the platform moved through that single compromised flow. On-chain records and company statements put the wider damage above $8 billion across Binance, Bybit and Bitget in 20 months, and every one of those heists ran through the approval step rather than through the keys. Safe{Wallet} is the signing interface of the Safe protocol, whose wallets are a widely used standard across the sector, which is why the incident resurfaces each time a new breach lands. The Safe price trades 3.3% lower over the past 24 hours as the pattern repeats. For a protocol whose product is trust in the signing process, an episode in which signers approved transfers they never chose is the precise failure the brand exists to prevent.

Three Hacks, No Stolen Keys

Binance's turn came on Thursday, October 29, when the exchange lost about $6.3 billion. Co-CEO Richard Teng said the heist began with an engineer's compromised laptop, and the company's review found no evidence of a key leak. “The attacker did not simply use one engineer's permissions, and this was not a single one-click action,” Teng said in his official account of the breach. Bitget lost about $387.5 million in September, entering through flaws in outside security products, after which fake withdrawal orders passed through its normal signing process. Coinbase, which has disclosed no comparable theft, is the counterexample the market now studies. Its custody model uses multi-party computation, which splits each key into pieces kept on separate machines, and the company says it builds all security-critical software in-house; both the Bitget and Bybit breaches entered through third parties. Greg Tusar, co-CEO of Coinbase Institutional, described the design in a company blog post: “MPC ensures that full private keys are never stored at rest, nor in any single machine during signing and when in use.” On-chain data shows Coinbase wallets hold about 959,000 BTC across 69.8 million addresses, a stake worth $74.7 billion, and researcher Zeeme argues in a thread on X that this setup blocks all three attack routes, since a stolen laptop yields one useless key piece. Chief Technology Officer Rob Witoff said the exchange is “monitoring price volatility, tracking stolen funds on-chain,” while Chief Security Officer Jeff Lunglhofer said Coinbase is blocking sends to compromised Binance wallets and adjusted its cold storage out of caution. Customers who prefer to move funds off the platform can follow our walkthrough on how to cash out on Coinbase. The company is not breach-free: in 2025, criminals bribed overseas support staff to leak customer data collected through its KYC process, an incident Coinbase priced at $180 million to $400 million, though it said funds were never accessible. Researcher Marc Baumann estimated in April that Coinbase holds 84% of US spot Bitcoin ETF assets, roughly $77 billion with a single custodian.

Signing Risk Beyond the Exchanges

The three heists share one design flaw, and it is not cryptography: each targeted the approval step where a human signs, which is what Coinbase's key-splitting and in-house build are arranged to defend. For SAFE the reading is harder: the protocol's signing interface was the vector in the Bybit theft, and the market is repricing the token on that association as much as on its token's tokenomics. Our SAFE technical analysis page tracks how the token absorbs each new security headline. Hardware wallets face parallel supply-chain questions, as the Safe 5 implant report involving CryptoBilis devices has shown since March 2026. With 84% of US spot Bitcoin ETF assets on a single custodian, the same approval step now guards Wall Street's funds. The losses sit with the exchanges and their users; Coinbase says it is tracking stolen funds on-chain, and the record offers no route back for what was drained.