Bybit, 1.5 billion: when the signing interface is the supply chain

On 21 February 2025 Bybit lost about 1.5 billion dollars in ether during a transfer from its cold wallet, through a signing interface manipulated at the supplier Safe{Wallet}. The analysis: cyber, crime and custody policies, state attribution and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, February 2025 · by cybercoverinsurance

On 21 February 2025 the crypto exchange Bybit lost more than 400,000 ether and related tokens, worth about 1.5 billion dollars, during a scheduled transfer from a "cold" wallet to an operational one. Five days later the FBI attributed the theft to North Korea. Bybit covered the shortfall within three days through loans, deposits and purchases, and said it remained solvent.

Bybit was not breached in the classic sense. The signers approved a transaction that looked legitimate on screen. The code that displayed it had been altered two days earlier on the servers of Safe{Wallet}, the supplier of the signing interface. For cyber and crime underwriters, the case touches three points: the supply chain of signing software, the line between cyber, crime and custody policies, and the weight of attribution to a state.

What is known

The theft. On 21 February 2025, around 12:30 UTC, Bybit detected unauthorised activity in an Ethereum multisig cold wallet during a transfer to an operational wallet. More than 400,000 ETH and stETH, worth over 1.5 billion dollars, went to an unknown address (BleepingComputer). The Block reports about 401,347 ETH plus other tokens, worth about 1.4 billion (The Block).

The method. According to Sygnia, the JavaScript code that targeted Bybit's wallet was served from Safe{Wallet}'s AWS S3 bucket and had been modified about two days before the attack. Verichains confirmed the injection of malicious code into the Safe web interface used by Bybit's signers. The code activated only under specific conditions. About two minutes after the transaction, the files were replaced with clean versions. Safe said the attack began with a compromised machine of one of its developers, which gave access to a Bybit-operated account (BleepingComputer).

Attribution. On 26 February 2025 the FBI attributed the theft to North Korea, specifically the group known as TraderTraitor or Lazarus. It reported the conversion of part of the funds into bitcoin across thousands of addresses and published 51 Ethereum addresses to block (BleepingComputer).

Covering the shortfall. On 24 February CEO Ben Zhou said the ether gap had been closed. On-chain data points to loans, deposits from large holders and over-the-counter purchases. Zhou had said earlier that the treasury and retained earnings would cover the loss even without recoveries (The Block).

What is not known. Whether Bybit had insurance for this type of loss, and which, has not been made public.

The signing interface is a supply chain

The signers saw one transaction and signed another. A multisig wallet exists to stop one person from moving funds. Here several people approved, but all of them looked at the same manipulated interface. Multisig protects against a rogue signer, not against a falsified screen.

The code came from a supplier. The Safe{Wallet} interface is third-party software, loaded by the browser at each use. It is the same pattern as Polymarket in 2026: external code, served by a supplier, runs the insured's most sensitive operation. The difference is scale: hundreds of accounts in one case, a wallet worth billions in the other.

A developer machine opened a customer's wallet. According to Safe, it all started from a developer's computer. People with privileged access to release infrastructure are the target, even when they work for a supplier rather than the insured.

Which policy responds

Cyber cover does not pay for stolen funds. Standard cyber policies usually exclude loss of money or digital assets and respond to investigation, restoration and liability. In a 1.5 billion dollar event, the cyber part is marginal.

Crime cover depends on the trigger. Computer fraud insuring agreements usually require fraudulent entry or alteration of data or instructions by a third party. Here a third party altered the interface, and employees signed in good faith. That is closer to classic computer fraud than a theft using internal credentials. But many crime policies exclude cryptocurrency or cover it only through dedicated extensions.

Custody cover looks at the cold wallet. Cold wallets are the part digital asset custody policies cover most willingly, because they are less exposed. Bybit shows that the critical moment is the transfer from cold to operational: the asset is cold, the signature is online. A custody underwriter should ask how that step is handled.

Subrogation against the supplier is worth little. Safe{Wallet} supplied the compromised interface. An insurer that indemnified Bybit could pursue Safe, but a software supplier's ability to answer for a 1.5 billion dollar loss is theoretical.

State attribution and exclusions

The FBI attributed the theft to a state within five days. It is a fast, public attribution. For policies with exclusions tied to state or war acts, the question is whether that is enough.

Theft for profit is not an act of war. The state-act exclusions introduced in the cyber market in recent years usually focus on attacks that impair the functioning or security of a state. A theft from a private exchange, even if attributed to North Korea, hardly falls within that scope. But wording varies from policy to policy, and an official attribution makes the discussion unavoidable.

A recurring actor is managed with controls. On-chain traces linked Bybit to earlier thefts at Phemex, BingX and Poloniex (BleepingComputer). For a book of digital asset operators, North Korean groups are a constant risk, to be met with specific signing controls, not exclusions.

Solvency as mitigation

Bybit covered the shortfall in three days. Loans, deposits and purchases restored reserves by 24 February (The Block). It is a remarkable mitigation that avoided a run on the exchange. But it depends on the exchange's financial strength and on partners' willingness, not on insurance.

Treasury is not a substitute for insurance capacity. A smaller operator with the same loss would have failed. For underwriters, the applicant's financial strength is part of the assessment: it decides whether a severe loss becomes a manageable claim or an insolvency.

What to bring to renewals

Impact for insurersHigh

A signing interface manipulated at a supplier led several signers to approve a 1.5 billion dollar transfer.

On the portfolio side, digital asset operators share a small number of multisig wallet and custody suppliers. An incident at one of them can hit several insureds at once. Knowing which suppliers each applicant uses is the first step in estimating aggregation.