On February 5, 2025, a Safe{Wallet} developer logged into their workstation unaware that North Korean hackers had already compromised the machine. Within hours, the TraderTraitor unit — operating under the Lazarus Group umbrella — leveraged stolen credentials to infiltrate Safe’s AWS infrastructure, setting in motion a chain of events that would culminate in the theft of $1.4 billion from Bybit’s cold wallet. The attack did not exploit a smart contract vulnerability or a zero-day in blockchain code. It exploited the human layer — the weakest link in even the most sophisticated security stacks.
The Exploit Mechanics
The attack began with a targeted social engineering campaign against a Safe{Wallet} developer. TraderTraitor operatives crafted a malicious Docker project designed to appear legitimate, tricking the developer into executing it on their local machine. Once activated, the payload established persistent access to the developer’s environment, including credentials used to manage Safe’s AWS cloud infrastructure.
With AWS access secured, the attackers initiated a 19-day reconnaissance and preparation phase. They studied Safe’s deployment pipeline, identified the JavaScript bundles served to wallet users, and carefully injected malicious code into the Safe{Wallet} web interface. The injection was surgical — designed to activate only when Bybit’s cold wallet signers initiated a transaction, leaving all other Safe users completely unaffected and unaware.
When Bybit’s signers executed what appeared to be a routine transfer on February 21, the malicious JavaScript intercepted the transaction in real time. It swapped the legitimate transaction with a delegate call to an attacker-controlled contract, effectively transferring ownership of the cold wallet’s assets — valued at approximately $1.4 billion at the time — to the hackers. Bitcoin traded near $96,615 and Ethereum at $2,787 when the attack was first set in motion.
Affected Systems
The breach exposed critical vulnerabilities across multiple infrastructure layers:
- Developer endpoints: The initial compromise vector — an unprotected developer laptop with access to production AWS credentials
- AWS cloud infrastructure: Used to host and deploy the Safe{Wallet} web application, compromised via stolen credentials
- CI/CD pipeline: The attackers navigated Safe’s deployment workflow to inject malicious JavaScript into production bundles
- Safe{Wallet} web interface: The end-user application that signers relied on to review and approve transactions
- Bybit cold wallet: The ultimate target, holding approximately $1.4 billion in ETH and other tokens
Notably, the Safe smart contracts themselves — audited and deployed on-chain — remained completely unaltered. The attack bypassed the blockchain layer entirely, targeting the Web2 infrastructure that users interacted with before transactions reached the chain.
The Mitigation Strategy
Following forensic investigations by Sygnia and Verichains, Safe implemented immediate containment measures. The compromised AWS environment was isolated, all developer access credentials were rotated, and the Safe{Wallet} web interface was rebuilt from verified clean code. Safe engaged Mandiant for a comprehensive incident response and publicly disclosed the full attack timeline on March 6, 2025.
Bybit CEO Ben Zhou confirmed that two independent forensic reports verified the attack vector originated from Safe’s infrastructure, not from any vulnerability in Bybit’s own systems. The exchange launched a recovery program and worked with blockchain analytics firms to trace the stolen funds across multiple laundering pathways.
Lessons Learned
The Safe{Wallet} breach fundamentally challenges the crypto industry’s security assumptions. For years, the focus has been on smart contract audits, formal verification, and on-chain security. Yet the largest heist in cryptocurrency history was executed entirely through Web2 attack vectors — compromised credentials, cloud infrastructure infiltration, and supply chain manipulation of a trusted web application.
The incident demonstrates that no amount of on-chain security can compensate for weak operational security in the layers between users and the blockchain. Multisig wallets, hardware security modules, and cold storage all provide meaningful protection, but only if the interfaces used to interact with them are equally secure.
User Action Required
If you use or have used Safe{Wallet} or similar multisig interfaces, consider the following steps: verify that you are interacting with the most recently deployed and verified version of the web interface. Implement hardware-based transaction signing where possible, verifying transaction details on the device screen before approval. Use dedicated, hardened machines for managing high-value wallets — never a daily-use developer workstation. Monitor all multisig operations through independent on-chain verification tools that do not rely on the wallet provider’s web interface. Finally, advocate for transparent, independently audited deployment pipelines from your wallet providers — because in crypto, your security is only as strong as the infrastructure you cannot see.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research before making security decisions.
1.4 billion stolen because one dev ran a fake docker image. the entire security model of cold wallets depends on a workstation that connects to AWS
hyun_bin_dev_ 19 days of recon before the actual drain. TraderTraitor spent more time studying the pipeline than most teams spend on their own security audits
19 days of recon and nobody noticed anything. thats the scariest part, not the initial compromise
^ exactly. the dwell time is what gets me. most teams would miss that too
19 days of recon with zero alerts is an infrastructure failure, not just a social engineering problem. where was the anomaly detection
19 days and zero alerts means no canary tokens, no anomaly detection, no integrity checks on deployment artifacts. basic infra hygiene
19 days and zero alerts means no canary tokens, no anomaly detection, basic infra hygiene failed
a docker project. they got pwned through a fake docker project. and we trust these people with $1.4b
a fake docker project compromised a $1.4b cold wallet. the entire security model relied on one developer not clicking the wrong thing
a single compromised developer laptop taking down a $1.4B cold wallet. the supply chain attack surface is terrifying
Alina V. 1.4B cold wallet protected by one developer not clicking a malicious docker image. the entire security model had a single point of failure and it was a human
lazarus has been running this playbook since 2017 at least. fake repos, poisoned npm packages, its always the same vector
poisoned packages still work in 2026 because half the ci pipelines out there install whatever the lockfile says. a decade old vector and registry pinning is still optional
signed commits and reproducible builds have been free for years, teams still ship docker images from a laptop. lazarus never needed a zero day, just a readme
sigstore_stan signed commits wouldnt have caught this one. the dev chose to run the docker project himself, signing only helps when commits are the entry point. scoped aws credentials were the actual missing layer
signed commits being free for years while a 1.4b treasury sat behind an unsigned docker pull is the whole industry in one sentence honestly
compromised through a fake docker project. $1.4b cold wallet security relying on one developer clicking carefully
19 days of AWS recon with zero alerts. safe didnt have canary tokens or integrity checks on their deploy pipeline. basic infra hygiene was completely absent
North Koreans sent a malicious Docker project to a Safe dev. one click and 1.4B gone from Bybit. supply chain attacks are the new bridge exploits
19 days of reconnaissance inside AWS and nobody noticed. Safe had zero monitoring on their own deployment pipeline. 1.4B for want of a log alert
an alert on new IAM users in the aws account costs literally nothing to set up. thats the detail that should keep every infra team awake
that alert plus mandatory hardware keys for anyone touching prod signing. the whole bybit path was one reused credential away from being boring
An IAM alert on unknown principals costs nothing and would have flagged 19 days of recon on day one. The cheap controls are always the ones nobody configures until they end up in a postmortem.
iam_role_model the cheap part is what stings. 19 days of recon inside AWS and a basic cloudwatch alarm on new IAM keys would have ended it
the malicious docker project probably had a plausible readme and a maintainer who supposedly left the team. deadline on a friday, even senior devs click
everyone calls it the largest heist and misses that there was zero novelty. no zero day, no contract bug, just a poisoned docker project and 19 days of patience. the 1.4B went to tradecraft