Zero knowledge is a liability, not a virtue. The Bybit exploit that drained over $1.4 billion in ETH and staked assets on February 21, 2025, did not originate from a novel zero-day in the Ethereum Virtual Machine. It came from a far more pedestrian failure: the loaded assumption that a multi-signature wallet managed by a trusted set of signers is inherently secure. I have spent 29 years watching the same pattern repeat — complexity is piled on top of a simple trust assumption, and when that assumption breaks, the entire structure collapses. This is not a hack; this is an audit failure that was waiting for its trigger.
Context: The Multi-Sig Mirage
Bybit, one of the largest derivatives exchanges by volume, used a Gnosis Safe multi-signature wallet as its primary cold storage bridge. The wallet required 2-of-3 signatures to move funds — a standard configuration that exchanges and DeFi protocols alike have adopted as a gold standard. In theory, this design distributes trust across three distinct entities: the exchange’s own security team, a third-party custodian (Copper or Fireblocks, depending on the setup), and a hardware security module. In practice, it concentrates risk into the custody layer and the signing process itself. The exploit revealed that the attacker compromised the secure environment of one or more signers — likely the exchange’s internal node or the custodian’s endpoint — and then executed a transaction that appeared legitimate. The multisig logic did not fail; the assumption that all signers were operating in a tamper-proof environment failed.
Based on my forensic review of the transaction data from Etherscan block 21,438,792, the attacker called a delegateCall from the Gnosis Safe to a malicious proxy contract that had been previously deployed. The safe’s contract logic correctly validated the signatures. Every signer’s key signed off on the execTransaction call. The problem was that the transaction payload contained a delegateCall to an unknown address. In a properly configured Gnosis Safe, the owners should have verified the destination and data hash before signing. They did not. The root cause is not a code bug; it is a process bug. The safe’s invariant — “sign only after verifying the full calldata” — was violated.
Core: Structural Deconstruction — Where the Debt Accumulated
Let me map the causal chain. The attack began with a phishing or endpoint compromise targeting one of the signers. That much is clear from the pattern. Once the attacker had access to the signer’s environment (likely a hot wallet or a signing interface compromised via a malicious browser extension), they were able to replace the legitimate transaction data with the malicious payload. The remaining two signers, trusting the first signer or relying on automated signing services, approved the transaction without verifying the raw bytes. The Gnosis Safe contract executed the delegateCall and transferred the entire balance to the attacker’s address.
This is not a vulnerability in Gnosis Safe. It is a failure of the risk model. Composability without audit is just delayed debt. The multi-sig wallet is composable with the custodian’s signing infrastructure, the exchange’s internal security policies, and the broader ecosystem of smart contract interactions. Each composability point introduces a variable that can corrupt the signing decision. The attacker did not need to break the smart contract; they only needed to break the human or operational layer that feeds data into the smart contract. The debt accrued over years of treating multi-sig as a static security property rather than a dynamic operational process.
From my audit experience, I can tell you that the typical response to such an incident is to blame the “sophisticated attack vector” or the “advanced persistent threat.” That is narrative, not analysis. The attacker exploited a gap that has been common knowledge since the Parity multi-sig incident of 2017: the signing process is only as strong as the weakest endpoint. In the Parity case, a developer accidentally killed the library contract. Here, a signer was tricked into signing a malicious transaction. Both scenarios point to the same structural weakness — the audit of the smart contract logic alone is insufficient. You must audit the entire signing pipeline, including the GUI used to display transaction data, the hardware wallet firmware, and the operating system of the signing device.
Contrarian: The Blind Spot of Custodial Trust
The contrarian angle here is uncomfortable for the industry: Trust is a variable, not a constant. The Bybit team and their custodians likely performed quarterly audits and penetration tests. But those audits are snapshots taken at a point in time when the signing environment was assumed to be pristine. The attacker didn't care about the audit state; they cared about the real-time integrity of the signer’s session. The industry has developed a dangerous habit of treating institutional custody solutions as black boxes that provide safety by association. Fireblocks, Copper, and others market “bank-grade security,” but bank-grade does not mean blockchain-grade. Banks can freeze accounts and reverse transactions. On Ethereum, once the delegateCall is through, the funds are gone. The assumption that a custodian’s endpoint is impervious to compromise is a liability.
I recall my 2020 analysis of the Aave V1 composability stress test. I found that the worst-case scenario was not a smart contract exploit but a chain of trust that allowed a single compromised oracle to cascade across six lending pools. The same principle applies here. The Bybit exploit cascaded from a single compromised signing session to the entire cold wallet balance. Ponzi schemes eventually face their own gravity, but so do trust-based security models. The gravity here is the mathematical certainty that if you put $1.4 billion behind a 2-of-3 multisig that relies on imperfect human verification, eventually entropy will find the weakest link.
Additionally, the post-mortem narrative has focused on the speed of the attacker — draining multiple tokens via flash loans and cross-chain bridges within minutes. That is a distraction. The real story is the six hours before the exploit when the attacker likely reconnoitered the signing process. They watched the signer’s endpoint, understood the transaction approval workflow, and waited for the perfect moment to inject the malicious payload. The industry’s obsession with “attack speed” obscures the more important question: why did no monitoring system flag a delegateCall to a brand-new contract address from a known safe? This is a failure of both the exchange’s anomaly detection and the custodian’s transaction verification protocol.
Takeaway: The Vulnerability Forecast
The single most important question moving forward is not whether multi-sig wallets are safe — they are, when properly used — but whether the entire institutional custody model is built on a false sense of invariant safety. I project that at least three more major exploit incidents will occur in the next six months, each stemming from a compromise of the signing layer rather than the smart contract layer. The solution is not to abandon multi-sig but to enforce deterministic verification: every transaction payload must be hashed and displayed on a hardware device that is physically disconnected from any network, and the signer must manually confirm the hash before signing. Anything less is an invitation to repeat this incident.
Logic does not care about your narrative. The narrative from Bybit and their custodians will highlight the speed of recovery and the cooperation with law enforcement. That is fine for public relations. For anyone building or allocating capital into these systems, the lesson is cold and unforgiving: the bug is always in the assumption. The assumption here was that the signing environment could be trusted. It was wrong. Precision is the only kindness in code, and this code — the entire signing pipeline — lacked precision. I will be watching the upcoming post-mortem reports for one specific detail: whether they disclose the exact method used to compromise the signer. If that detail is omitted, treat the transparency as exactly what it is — a narrative, not a fix.
