Source: Bybit hackers planted malicious code to manipulate transactions by compromising a developer's computer at crypto wallet provider Safe, used by Bybit
On the night of Feb. 21, Ben Zhou, the chief executive of the cryptocurrency exchange Bybit, logged on to his computer to approve what appeared to be a routine transaction.
Context & Ripple Effects
Coverage first established that Bybit had lost control of a cold Ethereum wallet amid $1.46B in suspicious outflows. Subsequent reporting described UI manipulation and social engineering around employee devices, shifting attention from the wallet itself to the approval environment.
This account identifies an upstream point of compromise at Safe, a wallet provider used by Bybit. It matters because a transaction can appear routine to an authorized signer even when the interface or underlying transaction data has been altered.
First-order effects
- Bybit and Safe face an immediate forensic and trust problem: they must determine which transaction-approval flows and developer systems were exposed to the malicious code.
- The incident narrows the apparent failure mode from a compromised cold wallet to manipulation of the tooling used to prepare or display transactions for approval.
Second-order effects
- Other exchanges and organizations using multisignature wallet software are likely to reassess whether signer approvals independently verify transaction details rather than relying on a single interface or provider environment.
- Wallet providers face increased pressure to secure developer endpoints and software-release paths, since a compromise there can affect customers without directly compromising each customer's private keys.
Third-order effects
- If similar incidents persist, institutional crypto custody will be judged less by whether assets sit in “cold” wallets and more by the integrity of the full transaction-creation and signing chain.
- The episode reinforces the crypto legitimacy gap: operational controls, auditability, and third-party software risk may become as consequential as on-chain wallet design for large custodians.
The trend: This is one data point in the shift from key-theft-focused crypto security toward securing the people, interfaces, and software supply chains that shape authorized transactions.