ClosedCriticalNo fix needed

Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)

Bybit cold wallet / Safe{Wallet} web UI

North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.

Why this severity: ~$1.5B stolen; nation-state supply-chain attack on a wallet frontend

Started: Feb 21, 2025
Closed: Mar 6, 2025

Follow this incident

Updated Mar 6, 2025

Affected

Fixed in

No fixed release yet

Timeline3

Mar 6, 2025
Safe{Wallet} confirms a developer machine compromise by TraderTraitor
Source
Feb 26, 2025
FBI attributes the theft to North Korea ('TraderTraitor')
Source
Feb 21, 2025
About $1.5B in ETH drained from a Bybit cold wallet

Advisories2

News & write-ups2

Notes & caveats

Safe{Wallet} confirmation date approximate (The Hacker News, early March 2025).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified