Blockchain security · Deep dive
Bybit: three signatures, one shared blind spot
A multisignature wallet can distribute keys while concentrating the meaning of a transaction in one compromised screen.
Kinwilder research desk · · AI-assisted analysis
Established findings: a signing-path compromise
On 21 February 2025, Bybit lost virtual assets that the FBI subsequently valued at approximately $1.5 billion. Its 26 February notice attributed the theft to North Korean activity it calls TraderTraitor. That is an agency attribution of a particular operation; it is not evidence that every label associated with Lazarus describes the same team.
Sygnia's investigation describes malicious JavaScript served through Safe's web application and found in signer browser caches. Its analysis separates the signers' hosts from the delivery path and explains how the presented transaction could diverge from the action actually authorized. This article does not claim that the wallet's signature mathematics failed.
Kinwilder analysis: count independent meanings, not only keys
A signature answers a narrow question: did a key authorize these bytes? A human approval answers a different one: did a person intend the consequences represented by those bytes? The boundary between them is software. If every signer interprets a transaction through the same presentation layer, multiple keys can inherit one interpretation error.
A useful review exercise is to draw two dependency graphs. The first lists keys, people and signing devices. The second lists everything that translates an action into human meaning: frontend build, transaction decoder, simulation service, contract metadata, proxy implementation, and display firmware. Three disjoint key branches can converge on a single node in that second graph. The security question is whether that convergence defeats the independence the approval threshold was meant to create.
This distinction matters beyond cryptocurrency. A release approver can sign a digest while relying on a compromised build report. A cloud administrator can authorize a role change whose friendly name hides a different resource. Thresholds protect only the decisions whose meaning remains independently checked.
Defensive design: make intent inspectable
For a signing workflow, define an approval record that binds chain identity, destination, value, operation type, implementation changes and decoded effects to the exact bytes being signed. The record should be derived independently of the initiating web session. Merely opening the same page on another laptop does not establish that independence.
Require separate review for changes that alter future authority. A transaction that installs an implementation, grants an approval or changes an owner deserves a different policy from an ordinary transfer, even when its immediate value appears small. Simulation is useful evidence, but it is another dependency to authenticate; do not quietly elevate its output into an oracle.
For an authorized assessment, test a harmless discrepancy in a disposable environment: can the operator detect when a human-readable intent record describes a different destination from the signed transaction? Measure the workflow's response before adding more signers. That exercise evaluates the trust boundary without reproducing a theft.
What to preserve during an investigation
Preserve the exact proposed transaction, signer-visible representation, independently decoded effects, frontend asset hashes and build provenance. Record timestamps and clock sources. Avoid reducing a complex incident to an address screenshot: the important evidence may sit between what was displayed and what was signed.
Limits
This is a retrospective architectural reading of public findings. It does not establish the present security of Safe or Bybit, the current whereabouts of funds, or the identity of an individual operator. Gross incident estimates are not net unrecovered losses. Follow the TraderTraitor profile for separately sourced attribution context.
Kinwilder research desk: AI-authored retrospective analysis of linked public investigations. No independent incident response, exploit reproduction, private intelligence or new vulnerability discovery is implied. Incident dates and source estimates describe the historical reports, not current balances.