How the Bybit hack happened: a vendor's laptop and a screen that lied

Bybit, one of the world's largest crypto exchanges, lost about $1.5 billion in a single transaction that its own executives approved. The screen they signed on had been quietly rewritten from inside another company.^[1][2] This case file covers how a vendor's hacked laptop led to a $1.5 billion theft, what it cost, and the one control that was missing.

What happened

How they got in

The attackers never needed to break into Bybit. The forensic firm Bybit hired found no sign that its own systems were compromised.^[2] Instead, they went after a supplier whose software sat in the middle of Bybit's most sensitive process.

A crypto approval is a signature on a block of technical data. People rarely read that data directly; they trust a web page to translate it into plain terms such as "send X to Y." The altered Safe page displayed an ordinary transfer while passing the signers something quite different underneath. Bybit's chief executive, Ben Zhou, who was the final signer, said afterward that he looked at the details but that the real destination was hidden inside the code he was approving.^[4][6] Analysts call this blind signing: approving a transaction whose full effect you cannot see.^[6]

Safe said its core smart contracts, the on-chain code that holds the money, were not affected. The weakness was in the web interface people used to read and approve transactions.^[5] In other words, several careful people checked the same lie, because they were all looking at it through the same compromised window.

How it was caught

The theft was obvious within minutes, since the funds moved on a public blockchain. Bybit went public the same day, and Zhou held a livestream saying the exchange could cover the loss and that other wallets were untouched. The company said it had lined up bridge loans for most of the missing ether and kept processing withdrawals.^[4][6]

On February 26, 2025, the FBI attributed the theft to North Korea, naming the group it tracks as TraderTraitor. It said the thieves were moving fast, converting the ether to bitcoin and other assets spread across thousands of addresses, and it published those addresses so exchanges could block them.^[1]

What it cost

Bybit offered a 10% bounty to anyone who helped trace or freeze the funds, and by the time of the FBI alert more than $40 million had been frozen.^[1] By early March, most of the stolen ether had already been converted to bitcoin across thousands of wallets, and only a small share had been frozen.^[3] Safe said it put additional safeguards in place.^[5]

The missing control

The missing control: independent verification of what signers actually approve. Every signer relied on the same web page to tell them what they were signing, and no separate check confirmed that the transaction matched the transfer they intended.

Multiple signatures are meant to stop one mistake or one bad actor. But if every approver reads the request through one shared screen, a single compromise fools them all at once. A check on a separate device or system, one that decodes the raw request and confirms the destination and action before anyone signs, would have flagged that this "transfer" was actually a change of control. Treating a vendor's web page as trusted, rather than verified, turned a supplier's breach into Bybit's loss.

What to do in your business

• Confirm payments outside the system that requested them. Before a large payment or change of bank details goes out, confirm the amount and destination through a second channel, such as a phone call to a known number.
• Make each approver check the source, not a summary. Approvers should look at the actual payee and account in the bank or payment portal, not only an email or a report someone else generated.
• List the vendors that sit inside your money flow. Payroll, invoicing and payment tools can all change what you approve. Know which ones they are and ask how they protect their own staff and code.
• Refuse to approve what you cannot read. If a request is too vague or technical to understand, the rule should be to stop and ask, not to sign because the screen looks familiar.
• Keep reserves separate and slow to move. Keep most savings in an account that needs extra steps and a waiting period to move, so a single bad approval cannot empty everything.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.