Bybit Hack Laundering Begins — Why Multisig Cold Wallets Are No Longer Enough

On February 23, 2025, the attackers behind the $1.5 billion Bybit exchange hack began laundering stolen Ethereum through mixing services, marking a chilling new chapter in the evolution of cryptocurrency theft. The incident, which exploited not a smart contract flaw but human trust itself, forces the industry to confront uncomfortable truths about multisig security.

The Threat Landscape

The Bybit hack, executed on February 21, 2025, represents the largest single cryptocurrency theft in history. Attackers gained access to Bybit offline Ethereum cold wallet and stole approximately 401,346 ETH, worth roughly $1.5 billion at the time. By February 23, the attackers had begun moving funds through laundering infrastructure, while industry partners managed to freeze $42.89 million of exploited funds through coordinated efforts.

What makes this attack unprecedented is its methodology. The hackers did not find a vulnerability in the Safe smart contract protocol. They did not crack encryption. Instead, they manipulated the user interface that wallet signers saw when approving transactions, tricking authorized signers into approving a malicious transaction they believed was legitimate.

This UI manipulation attack represents a dangerous evolution beyond traditional attack vectors. The multisig cold wallet architecture — long considered the gold standard for institutional crypto custody — proved vulnerable not because of its cryptography, but because the humans operating it could be deceived through sophisticated social engineering.

Core Principles

The fundamental principle violated in this attack was the assumption of display integrity. Multisig wallets operate on the premise that if multiple authorized signers independently verify and approve a transaction, the risk of unauthorized transfers is minimized. But this model breaks down when signers cannot trust what they see on their screens.

Check Point Research had previously identified this class of attack in July 2024, documenting how attackers manipulate the Safe Protocol execTransaction function through legitimate blockchain operations. The research warned that legitimate protocol features could be leveraged through interface manipulation — a warning that proved prophetic in the Bybit incident.

The attack also demonstrates that the distinction between hot and cold wallets is less meaningful than previously thought. A cold wallet whose signing interface can be compromised is effectively no safer than a hot wallet, because the attacker does not need to access the private keys directly — they need only to deceive the humans who control them.

Tooling and Setup

Organizations securing significant crypto assets must adopt a layered defense approach that goes beyond multisig signatures. First, implement independent transaction verification through multiple disjoint interfaces. Signers should verify transaction details through at least two completely separate systems — for example, a hardware wallet display and a command-line blockchain explorer.

Second, deploy endpoint threat detection on all devices used for transaction signing. Check Point recommends integrating traditional security products with blockchain-specific monitoring. Anomalous behavior on a signing device — such as unauthorized browser extensions, modified display rendering, or network interception — should trigger immediate transaction freezes.

Third, implement time-locked transactions with mandatory delay periods. Even if signers are deceived, a delay window allows security teams to detect and cancel unauthorized transfers before they execute on-chain. This introduces an asymmetry favoring defenders: attackers must maintain their deception for hours or days rather than seconds.

Ongoing Vigilance

The laundering activity beginning February 23 illustrates the speed at which stolen funds move. Industry coordination proved partially effective, with $42.89 million frozen, but the vast majority of the $1.5 billion remains in motion. Organizations should monitor blockchain analytics services for any interaction with addresses linked to the attack.

With Bitcoin trading around $96,274 and Ethereum at $2,821 as of February 23, 2025, the crypto ecosystem has grown too valuable to rely on security models designed for a smaller era. Every exchange, custody provider, and institutional holder should be re-evaluating their transaction approval workflows in light of this attack.

Final Takeaway

The Bybit hack does not mean multisig wallets are broken. It means multisig alone is insufficient. The next generation of crypto security must account for the full attack surface — not just the blockchain, but the humans and interfaces that interact with it. Organizations that treat this incident as a learning opportunity will be better positioned. Those that ignore it may be the next headline.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.