The $1.5 Billion Heist: Lazarus vs. Bybit

On February 21, 2025, at approximately 12:30 PM UTC, Bybit detected unauthorized activity in one of its Ethereum cold wallets. Within minutes, 401,347 ETH — worth over $1.5 billion — had been drained to an unknown address.

It was the largest cryptocurrency theft in history. And it started with a Docker project on a developer’s laptop.

The Timeline

The attack didn’t begin on February 21. It began 17 days earlier.

Date	Event
Feb 2	Domain getstockprice[.]com registered via Namecheap
Feb 4	Safe{Wallet} Developer1’s macOS workstation compromised
Feb 5	Attacker begins accessing Safe{Wallet} AWS infrastructure
Feb 19	Malicious JavaScript injected into Safe{Wallet} S3 bucket
Feb 21, 12:30 UTC	Bybit initiates routine cold→warm wallet transfer
Feb 21, 12:31 UTC	Malicious JS intercepts transaction, redirects 401,347 ETH
Feb 21, 12:33 UTC	Attacker removes malicious JS from S3 bucket
Feb 26	FBI attributes attack to DPRK’s TraderTraitor (Lazarus)

Two minutes. That’s how long the malicious code was live in production before the attackers cleaned up after themselves.

The Supply Chain

Bybit didn’t get hacked directly. Safe{Wallet} did — the multisig wallet platform Bybit used to manage its cold storage.

Stage 1: Social Engineering

The attack began with a social engineering campaign targeting a Safe{Wallet} developer, referred to in forensic reports as “Developer1.” The approach likely came through LinkedIn, Telegram, or Discord — the standard playbook for DPRK’s “Contagious Interview” campaigns.

Developer1 downloaded what appeared to be a legitimate crypto-themed application: a Docker project called MC-Based-Stock-Invest-Simulator-main, found in their ~/Downloads folder. The project phoned home to getstockprice[.]com — a domain registered just two days earlier.

HACK

The malicious Docker project exploited a remote code execution vulnerability in the PyYAML library, giving the attackers code execution on the developer’s macOS workstation.

Stage 2: AWS Session Hijack

With control of Developer1’s machine, the attackers extracted their active AWS session token. Safe{Wallet}‘s configuration required MFA re-authentication every 12 hours for STS sessions, but the attackers didn’t need to bypass MFA — they simply hijacked an already-authenticated session.

Starting February 5, the attackers used the stolen token to access Safe{Wallet}‘s AWS infrastructure, probing S3 buckets and CloudFront configurations.

Stage 3: JavaScript Injection

On February 19, the attackers modified JavaScript resources hosted on Safe{Wallet}‘s AWS S3 bucket. The injected code was surgical — it only activated for transactions from Bybit’s specific cold wallet address (0x1Db92e2EeBC8E0c075a02BeA49a2935BcD2dFCF4).

When Bybit’s signers opened Safe{Wallet}‘s UI to approve the cold-to-warm transfer on February 21, they saw what appeared to be a legitimate transaction. The malicious JavaScript had altered the transaction’s destination while keeping the UI display unchanged.

Stage 4: The Drain

The Bybit signers approved what they believed was a routine transfer. Instead, the transaction executed a delegatecall to a malicious contract, replacing the wallet’s legitimate implementation and draining all 401,347 ETH to attacker-controlled address 0x47666fab8bd0ac7003bce3f5c3585383f09486e2.

Wallet: 0x1Db92e...dFCF4 (Bybit Cold)
  └→ ExecTransaction (delegatecall)
     └→ Implementation swap → attacker contract
        └→ Drain: 401,347 ETH → 0x47666f...86e2

Why Multisig Wasn’t Enough

Bybit used a Gnosis Safe multisig wallet — the industry standard. Multiple signers had to approve every transaction. So how did a single malicious JavaScript injection bypass multisig?

Because the attack didn’t target the crypto. It targeted the UI.

Every signer saw the same compromised Safe{Wallet} interface. Every signer approved what looked like a legitimate transaction. The multisig worked exactly as designed — it just signed the wrong thing.

WARN

NCC Group’s post-mortem was blunt: Bybit used a smart contract with a much larger attack surface than necessary. A purpose-built contract limited to native transfers and ERC-20 operations could have used human-readable EIP-712 signatures, making the malicious destination visible to signers. The delegatecall mechanism — which allowed arbitrary contract replacement — was an unnecessary feature that became the critical vulnerability.

Following the Money

Post-heist, the attackers moved fast. Within hours, the stolen ETH was being converted to Bitcoin and dispersed across thousands of blockchain addresses — the standard Lazarus laundering playbook.

The FBI released a Public Service Announcement on February 26, attributing the theft to “TraderTraitor” — their designation for the Lazarus Group / UNC4899 / Jade Sleet. They published 51 Ethereum addresses used in the initial laundering phase and called on exchanges, bridges, and DeFi services to block derived transactions.

Bybit launched a $140 million bounty program, offering up to 10% of recovered funds to anyone who could help trace and freeze the stolen assets. Blockchain analytics firms — Chainalysis, Elliptic, TRM Labs — raced to map the laundering infrastructure.

As of publication, approximately 88% of the stolen funds have been traced, though recovery remains partial. The Lazarus Group’s laundering operation continues to evolve, using bridge protocols and decentralized exchanges to obscure the trail.

Aftermath

Safe{Wallet} rebuilt its entire infrastructure from scratch. All credentials rotated. New monitoring and validation layers added. The native Ledger integration was temporarily removed. A phased rollout restored the platform on Ethereum mainnet with additional security measures.

Mandiant’s forensic investigation confirmed the 19-day attack timeline and the North Korean attribution. The sophistication of the operation — patient, targeted, surgically precise — was consistent with TraderTraitor’s previous campaigns.

Lessons

This wasn’t a crypto hack. It was a supply chain attack that happened to target crypto infrastructure. The lessons apply to any organization that depends on third-party software:

1. UI integrity matters. If your signing interface can be compromised, your cryptographic guarantees are meaningless.
2. Minimize your attack surface. Purpose-built contracts beat general-purpose ones. Don’t ship delegatecall if you don’t need it.
3. Developer workstations are the front line. A compromised laptop led to a $1.5 billion loss. Harden them accordingly.
4. MFA isn’t magic. Session token theft bypasses MFA entirely. Monitor for anomalous session usage.
5. Verify, then verify again. Transaction verification should happen through independent channels, not through the same UI that could be compromised.

---

The largest heist in history wasn’t executed with zero-days or quantum computers. It was a Docker project called “Stock-Invest-Simulator” and a developer who clicked download.

-- chainwatch