Audit badges and Bybit’s $1.46B Ethereum theft

On Feb. 21, 2025 at 1:30 p.m. UTC Bybit moved funds from an Ethereum cold wallet to a warm wallet. Authorized signers approved a routine transfer after viewing the expected destination on their screens. The transaction instead routed control to attackers, who withdrew about 401,347 ETH and associated staked assets. Bybit reported the loss at $1.46 billion and the FBI attributed the theft to North Korea.

Bybit and the multisig provider Safe reported that a compromised developer machine enabled a disguised malicious transaction to be presented through the signing interface. External reviewers did not find vulnerabilities in Safe’s smart contracts or front-end source code. The private keys remained on signers’ devices; valid signatures were produced after signers were shown a false description of the action they were authorizing.

A preprint by a security researcher examined 23,818 public audit findings from multiple firms and compared them with 218 thefts recorded between Jan. 1, 2022 and March 27, 2026, totaling an estimated $7.764 billion in losses. The audit findings were concentrated in logic and business-logic defects (14.6 percent), code-quality issues (13.0 percent) and input-validation flaws (10.0 percent). The largest sources of stolen value were private-key compromise ($1.894 billion, 24.4 percent), phishing and social engineering ($1.511 billion, 19.5 percent) and access-control failures ($994 million, 12.8 percent). When dependency and governance attacks are included, the report’s “human-vector” category accounted for about 49.6 percent of observed losses.

The preprint found that 105 of the 218 incidents involved protocols that had at least one public audit before exploitation, representing about $4.3 billion in losses. The authors noted that a prior audit does not always match the code in production, cover later code changes, or assess the operational systems and signer interfaces that attackers exploited in several cases.

After the incident, Safe rebuilt infrastructure, rotated credentials and said it would make transaction contents easier for signers to verify. Bybit restored the lost ETH to its reserves within days and indicated it would change signer verification processes.

Security researchers and practitioners have proposed more detailed reporting standards for audits. Suggested elements include identifying the audited commit and review dates, listing the contracts covered, disclosing unresolved high-severity findings, stating whether deployed bytecode matches the reviewed version and providing recent verification dates for production configuration. Separate assessments would document key-management practices, signer procedures, front-end and cloud infrastructure, build systems, monitoring and incident-response exercises, and whether a material change invalidates prior reports.

The Bybit incident involved a valid on-chain signature paired with a compromised human-facing process that gave attackers control of funds. The companies involved described operational and interface changes following the theft.