What the Bybit Exploit Reveals About Enterprise Custody

On February 21, 2025, Bybit misplaced roughly $1.5 billion in ETH from its Ethereum chilly pockets. It was the largest single theft in digital asset historical past.

What makes this case instructive for enterprise custody groups: Bybit was utilizing what most take into account best-practice safety. A Safe (formerly Gnosis Safe) multisignature pockets requiring three approvals, with every signer utilizing a Ledger {hardware} pockets. The total drain executed in beneath quarter-hour.

The assault didn’t break cryptography or steal non-public keys; it manipulated what the signers believed they have been authorizing. The cryptographic layer was intact, however the human belief layer was compromised.

How the Attack Worked

The assault had 4 phases, every documented by independent forensic investigators:

• Infrastructure compromise: On February 4, 2025, attackers compromised a Safe{Wallet} developer’s macOS machine by way of a social engineering attack. Using the developer’s hijacked AWS session tokens, they gained entry to Safe’s hosted frontend infrastructure.
• Transaction substitution: On February 19, the attackers injected malicious JavaScript right into a single file serving Safe’s net interface. The code activated just for Bybit’s particular pockets addresses. When Bybit’s operators initiated a routine ETH switch, the malicious JS silently changed the transaction payload. The UI displayed a legitimate-looking switch, however the precise payload contained directions to switch pockets possession to attacker-controlled addresses.
• Blind signing: All three Ledger signers authorized the transaction. Each {hardware} pockets displayed structured knowledge fields however could not decode what the transaction’s data parameter actually did. The essential change from a normal name to a delegatecall was seen as a numeric parameter (operation: 1) however meaningless with out decoded context. No signer might confirm what they have been truly authorizing.
• Drain: With possession transferred through the delegatecall mechanism, the attacker signed and executed transactions draining all property in beneath quarter-hour. Two minutes after the theft succeeded, the attackers eliminated the malicious code from Safe’s frontend.

The assault was later attributed to Lazarus Group, a North Korean state-sponsored menace actor, by the FBI and multiple on-chain investigators.

The Core Architectural Failure

The basic failure was a single one: all three signers trusted the similar compromised net interface. Every different safety measure Bybit had in place relied on the integrity of that interface. Once it was compromised, no downstream management might compensate.

Multisig protects towards one compromised signer. It offers no safety when all signers are deceived by the similar supply. Three-of-three safety collapsed to one-of-one.

Three properties of the underlying structure made this collapse attainable:

The UI was the single belief level. There was no unbiased system between the consumer interface and the signing occasion that would confirm whether or not the displayed transaction matched the precise transaction. Every signer relied on the similar compromised frontend. There was no coverage engine, no deal with whitelist verify, no server-side validation working independently of the UI.

Blind signing is the default for advanced Ethereum transactions. When a {hardware} pockets is requested to signal a posh sensible contract interplay, it can not totally decode and show what the transaction does. The signer hits Confirm as a result of they belief the interface that offered the transaction. No show warned that the transaction would switch management of a $1.5 billion pockets to an unknown deal with.

Ethereum’s delegatecall enabled full possession takeover. This is the mechanism that turned a UI compromise into a complete loss, quite than a single fraudulent switch. The malicious transaction used delegatecall to interchange the record of approved signers with attacker-controlled addresses and scale back the required signatures to 1. From that time, the attacker might drain all the things unilaterally.

What Is delegatecall, and How Was It Exploited?

delegatecall is an Ethereum Virtual Machine opcode. When Contract A executes a delegatecallto Contract B, Contract B’s code runs utilizing Contract A’s storage. This means Contract B can learn and write Contract A’s state variables.

The normal legit use is proxy contract upgrades. A proxy contract shops knowledge however holds no enterprise logic. It makes use of delegatecall to ahead all calls to a separate implementation contract. When an improve is required, a delegated admin adjustments the implementation pointer to a brand new contract model. Users hold interacting with the similar proxy deal with whereas the logic behind it adjustments. In correctly designed methods like OpenZeppelin’s Transparent Proxy sample, solely a delegated admin contract can set off this alteration.

In the Bybit exploit, the attackers abused this similar mechanism. The malicious transaction referred to as Safe’s execTransaction operate with the operation parameter modified from 0 (normal name) to 1 (delegatecall), concentrating on an attacker-deployed contract. Because of delegatecall, this contract’s code executed in the context of Bybit’s pockets and overwrote the storage slot containing the pockets’s implementation pointer. This redirected all future calls to a draining contract managed by the attacker.

Bitcoin’s UTXO Model Eliminates the Attack Class

Bitcoin’s transaction mannequin removes the delegatecall assault class totally.

In Ethereum’s account mannequin, a sensible contract maintains a persistent state {that a} single transaction can modify, together with who controls the contract. delegatecall compounds this by permitting exterior code to execute inside a contract’s personal storage context.

Bitcoin makes use of a UTXO (unspent transaction output) mannequin. Each UTXO is locked to a script that defines its spending circumstances. Bitcoin’s Script language is stateless: there isn’t a persistent storage, no international state to change, and no idea of “altering possession” by way of code execution. A transaction both satisfies the script’s spending circumstances and consumes the UTXO, or it fails. Scripts validate; they never mutate.

Bitcoin Script is intentionally not Turing-complete. It has no loops, no state mutation, and no mechanism for delegated code execution. There is not any opcode equal to delegatecall. An attacker can not assemble a transaction that rewrites who controls current funds, no matter what interface they compromise. The UTXO both spends in response to its script, or it doesn’t.

This is a structural property of Bitcoin’s design, current since its launch in 2009. It can’t be replicated by including controls on prime of Ethereum’s extra versatile execution mannequin.

Independent Validation: The Missing Layer

The basic failure at Bybit was the absence of an unbiased validation layer between the consumer interface and the signing occasion. What the signers noticed was not what they signed. No system checked whether or not the precise transaction matched the meant transaction.

By distinction, if Blockstream’s enterprise custody structure had been used, our structure introduces three unbiased layers between a transaction request and the signing occasion:

Layer 1: Policy Engine. Every transaction passes by way of a coverage engine that runs server-side inside the consumer’s personal infrastructure. The engine evaluates the precise transaction towards configurable insurance policies: vacation spot deal with whitelists (most significantly), worth limits, and role-based entry controls. A compromised UI can not override the coverage engine as a result of it operates independently of the frontend. In the Bybit state of affairs, the substituted payload would have failed coverage validation earlier than any signer noticed it.

Layer 2: Multi-party approvers with clear view on what’s signed and the place funds are going. After coverage validation, M-of-N human approvers verify the transaction inside the platform.

Layer 3: HSM signing. Private keys by no means depart {hardware} safety modules managed by the consumer. The HSM indicators solely after each coverage layers have cleared. The total signing stack runs inside the consumer’s perimeter. There is not any third-party hosted frontend to compromise.

Each layer should be independently compromised for an assault to succeed. At Bybit, there was just one layer: a third-party hosted web site.

Liquid: Separating Settlement from Cold Storage

The Bybit assault succeeded as a result of the compromised interface had direct entry to the custody pockets. Moving funds meant executing an on-chain transaction that instantly uncovered $1.5 billion in chilly storage to the execution atmosphere.

The Liquid Network offers architectural separation between institutional settlement operations and base-layer chilly storage, instantly addressing this publicity.

When bitcoin is pegged into Liquid, the underlying BTC is locked beneath a federation multisig scheme managed collectively by institutional members (exchanges, custodians, monetary establishments). An equal quantity of LBTC (Liquid bitcoin) is issued on the Liquid sidechain. Settlement, buying and selling, and sensible contract execution occur on Liquid, whereas cold-storage bitcoin isn’t touched throughout regular operations.

To redeem bitcoin through peg-out, the federation should attain consensus. No single compromised celebration can drain the underlying reserves unilaterally. This is a structural safety gate that no single-chain multisig can replicate.

In the Bybit state of affairs, an attacker who compromised a Liquid-based settlement interface would solely have an effect on LBTC actions inside the sidechain atmosphere. The cold-storage bitcoin would stay unexposed to the assault floor. The $1.5 billion loss was attainable as a result of the compromised UI had direct signing authority over the chilly pockets itself. Liquid’s structure eliminates that direct publicity by design.

Key Takeaways for Enterprise Clients

The Bybit exploit was a failure of UI belief and sensible contract complexity, not cryptography. From it, 5 ideas emerge for institutional custody groups:

• Hardware wallets alone are usually not enough for institutional chilly storage. Signing should be preceded by an unbiased coverage validation layer that evaluates the precise transaction, not the UI illustration.
• Multisig is just as sturdy as the supply of its signing interfaces. All signers utilizing a weak exterior UI collapse M-of-N safety to 1-of-1.
• Cloud-hosted frontend infrastructure is a essential vulnerability. On-premises deployment eliminates this whole assault class.
• Execution mannequin flexibility is a legal responsibility in high-value custody. Bitcoin and Liquid (plus Simplicity contracts) have constrained execution fashions that take away delegatecall-class assaults by design, vastly bettering on Ethereum’s advanced sensible contract interfaces.
• Custody infrastructure should assume a well-resourced attacker. Lazarus Group operates at nation-state stage sophistication. The Bybit assault demonstrates surgical precision: injected code activated just for Bybit’s particular Safe deal with, indicating intensive prior reconnaissance.

Blockstream’s enterprise custody stack, constructed on Bitcoin-native infrastructure with unbiased coverage validation, HSM-controlled signing, and the Liquid Network’s federated settlement mannequin, instantly addresses every of those architectural weaknesses.

How to Evaluate Enterprise Custody Solutions

The Bybit exploit exhibits that custody structure can decide whether or not a complicated UI compromise can drain a chilly pockets. The questions beneath assist consider any enterprise custody supplier, together with Blockstream.

Does the supplier supply:

• a server-side coverage engine that may be deployed on-premises, inside the buyer’s personal infrastructure?
• an on-premises deployment possibility for the full signing stack, with no essential part working on third-party hosted infrastructure?
• customer-controlled HSMs that generate and maintain non-public keys, with no key shares ever leaving the HSM boundary?
• a signing path with no dependence on an externally hosted net frontend?
• an unbiased pre-signing validation layer that checks the precise transaction towards coverage earlier than a signer is requested to verify?
• an underlying chain with no delegatecall-equivalent assault floor, so a single transaction can not rewrite management of a pockets?
• a federated settlement layer, reminiscent of the Liquid Network, that separates institutional settlement from base-layer chilly storage?
• help for high-assurance sensible contracts on the underlying chain?
• air-gap-compatible {hardware} signing units?

Each “no” reply marks an architectural hole. Blockstream’s enterprise custody answer was designed to reply “sure” to every of those. 

To study extra:

• Visit Blockstream Enterprise
• Contact us for enterprise custody inquiries