Lessons from the Bybit hack: signing UX is multisig’s weakest link

On February 21, roughly $1.5 billion in ETH and staked-ETH tokens left one of Bybit’s cold wallets in a single approved transaction — the largest crypto theft on record. The wallet was a multisig. Every required signer signed. And as far as any investigation has shown, no private key was ever stolen. If you take away only one of the Bybit hack multisig lessons, make it this one: the cryptography held, and the money left anyway.

That is not an argument against multisig. We build a multisig wallet, and we still consider M-of-N signing the most independently verifiable way to hold serious funds. It is an argument about where the real attack surface sits. Multisig distributes key custody; it does not, by itself, distribute verification. Every signature is exactly as trustworthy as the signer’s understanding of the payload in front of them — and on February 21, that understanding was manufactured by an attacker.

What we know, two weeks in

As of this writing, the picture assembled from Bybit’s statements, Safe’s post-incident disclosure, and the FBI’s public attribution is consistent. Bybit’s team set out to perform a routine transfer from an Ethereum cold multisig to a warm wallet, using the Safe{Wallet} web interface they had used many times before. Each signer saw a legitimate-looking transaction: the familiar interface, the expected flow, nothing that would interrupt muscle memory.

What the quorum actually authorized was something else. The transaction quietly changed the smart-contract logic of the wallet itself, swapping in an implementation the attacker controlled. Once the genuine signatures landed on-chain, the vault obeyed its new logic, and roughly 400,000 ETH and staked-ETH tokens — about $1.5 billion at the time — moved out. Safe’s investigation traced the compromise to a developer machine, with malicious code served through the front end and aimed specifically at Bybit’s signers; the interface behaved normally for everyone else. In late February, the FBI publicly attributed the operation to North Korea’s Lazarus Group, tracked under the name TraderTraitor.

Two further facts deserve equal billing. Bybit remained solvent and kept processing withdrawals through the aftermath. And no key material was extracted at any point: no seed phrase was phished, no signing device was seized, no threshold was mathematically bypassed.

The keys held — and that is exactly the point

A multisig wallet requires M of N independent keys to approve a transaction before funds can move. That property worked flawlessly on February 21. The signatures were genuine, the quorum was legitimate, and the contract executed precisely what was signed. The attacker never attempted to defeat the mathematics; they arranged for the quorum to willingly sign a lie. The Bybit hack was a failure of transaction verification, not of multisig cryptography.

A signature is an opinion about a payload. If the payload you verified is not the payload you signed, the number of signers is irrelevant.

The headlines that read “cold wallet hacked” miss this distinction, and the distinction matters because it decides what you fix. Cold storage did its narrow job: the keys never touched an online machine. Multisig did its narrow job: no single signer could act alone. The component that failed is the one almost nobody writes into their threat model — the screen.

Blind signing, precisely

Blind signing is approving a transaction whose true contents the signer cannot independently verify. On Ethereum, what a signer cryptographically approves is a hash of structured transaction data, not the human-readable summary on the screen. Some piece of software has to decode that data back into intent — destination, amount, contract call — and the signer inherits whatever that software claims. If the interface lies, the human confirms a fiction while the chain executes the truth.

The Bybit transaction abused exactly this gap. A single field that most interfaces do not surface prominently — the operation type — turned an apparent transfer into a delegatecall that rewired the wallet’s logic. Hardware signing devices do not automatically close the gap, either: a device that displays only an opaque hash is asking a human to verify something no human can parse. That is verification theater, and it is arguably worse than nothing, because it manufactures confidence without adding scrutiny.

One front end, one quorum, one failure

Bybit’s signers held independent keys, on separate devices. But they all verified the transaction through the same web front end, so one compromised interface reached the entire quorum at once. Signer independence requires independent verification channels, not merely independent keys. A 3-of-3 wallet whose signers all trust one screen collapses, for practical purposes, into a 1-of-1 — and the “1” is whoever controls the interface.

The lesson is scheme-agnostic. MPC wallets replace the on-chain contract with distributed key shares — we compared the trade-offs in MPC vs MultiSig: an honest comparison — but an MPC quorum terminates in exactly the same place: humans approving a payload that some interface rendered for them. It also says something about the industry’s priorities that so much energy goes to distant, exotic threats — in December we examined how far quantum computers remain from Bitcoin’s keys — while the largest theft in the industry’s history required no new cryptography at all. It required JavaScript.

Practical Bybit hack multisig lessons

None of the following requires new cryptography or new hardware. It is operational discipline — which is precisely why it gets skipped.

1. Treat every signing screen as untrusted. The interface that builds your transaction becomes a target the moment your balance justifies the effort. Assume it can lie to you on exactly the day it matters most.
2. Verify on a second, independent surface. Decode the raw transaction — destination, value, calldata, operation type — on a device that shares nothing with the machine that built it. Two screens lying identically is a far harder attack than one screen lying alone.
3. Refuse opaque payloads. If a signer cannot see, parameter by parameter, what a transaction does, the correct number of signatures for it is zero. “It’s probably the usual transfer” is how $1.5 billion moves.
4. Bound the blast radius. Address whitelists, daily and monthly limits, and separated roles turn one bad approval into a capped loss instead of a total one. Bybit’s loss was total for that vault because nothing constrained what a single approved transaction could do.
5. Slow down the routine. The attack was dressed as the most ordinary operation the team performed, because ordinary operations receive the least scrutiny. Routine is not a reason to relax; it is the costume an attacker will choose.

How this shapes signing at Ownbit

Of the Bybit hack multisig lessons above, the durable one is structural: final verification has to live somewhere the compromised machine cannot reach. Ownbit’s cold wallet workflow is built around that idea. A spare phone becomes an air-gapped signer; the online phone runs a Watch Wallet that holds no keys, builds the unsigned transaction, and passes it across as a QR code. The offline phone shows what it is actually being asked to sign before any signature exists, then returns the signature the same way. The QR hop is deliberately narrow: every transaction is forced through a second, independent surface, and the device holding keys never loads the web page that might have been poisoned.

For teams, Enterprise MultiSig applies the blast-radius lessons directly: address whitelists so funds cannot reach an unlisted destination regardless of who signs, daily and monthly spending limits, Owner, Signer and Security Admin roles, and an emergency pause. These controls do not make deception impossible — nothing does, entirely — but they cap what one manipulated approval can cost.

And one honest note about ourselves. Ownbit’s servers coordinate signing but never hold user keys; every key in an Ownbit multisig is a standard BIP39 seed phrase, and recovery works without our infrastructure. Minimized trust cuts both ways: the same design that limits what a compromised coordinator could do to you is the reason we can write about Bybit’s worst week without pretending to be immune to targeted attacks. Bounded damage, not claimed invulnerability, is the standard worth holding vendors to.

Frequently asked questions