# Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea) · pwn.watch

> North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.

Page: https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025 · generated 2026-10-22T19:29:07.289Z

## Status
- Severity: critical · status: closed · patch: no-fix-needed
- Product: Bybit cold wallet / Safe{Wallet} web UI
- Started: 2025-02-21 · closed: 2025-03-06
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025/feed.xml
- JSON Feed: https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025.json
- This file: https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025/llms.txt

## Updates (newest first)
- 2025-03-06: Safe{Wallet} confirms a developer machine compromise by TraderTraitor (https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html)
- 2025-02-26: FBI attributes the theft to North Korea ('TraderTraitor') (https://www.ic3.gov/psa/2025/psa250226)
- 2025-02-21: About $1.5B in ETH drained from a Bybit cold wallet

## Fix brief
# Security brief: Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)

Source: https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025 · status: closed (closed Mar 6, 2025) · severity: critical · updated Mar 6, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.

Severity detail: ~$1.5B stolen; nation-state supply-chain attack on a wallet frontend

- Product: Bybit cold wallet / Safe{Wallet} web UI

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Mar 6, 2025: Safe{Wallet} confirms a developer machine compromise by TraderTraitor
- Feb 26, 2025: FBI attributes the theft to North Korea ('TraderTraitor')
- Feb 21, 2025: About $1.5B in ETH drained from a Bybit cold wallet

## Advisories
- [North Korea Responsible for $1.5 Billion Bybit Hack](https://www.ic3.gov/psa/2025/psa250226) (FBI IC3)
- [North Korea Responsible for $1.5 Billion Bybit Hack](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack) (FBI)

## Write-ups & news
- [Bybit Confirms Security Integrity Amid Safe{Wallet} Incident](https://www.bybit.com/en/press/post/bybit-confirms-security-integrity-amid-safe-wallet-incident-no-compromise-in-infrastructure-blt9986889e919da8d2)
- [Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist](https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html)

## Caveats
Safe{Wallet} confirmation date approximate (The Hacker News, early March 2025).

---
Machine-readable: https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.