Crypto's $1.5B Ethereum Heist: Bybit Hack Exposes Third-Party Vulnerabilities

The crypto world was shaken in February 2025 by the Bybit hack, a massive security breach that resulted in the loss of $1.5 billion in Ethereum. This incident has raised serious questions about the adequacy of existing security measures in cryptocurrency exchanges and third-party providers.

According to a forensic investigation, Bybit's core systems were not breached. Instead, attackers exploited a vulnerability in Safe{Wallet}, a third-party wallet service used for transaction processing. This revelation has highlighted critical vulnerabilities in crypto exchanges, leading to a $1.5 billion loss and prompting urgent calls for improved security measures.

The Bybit hack was a highly coordinated attack that resulted in $1.5 billion in Ethereum (ETH) being drained from the platform. Investigations suggest that hackers exploited a single-signing transaction vulnerability, allowing them to bypass wallet security and execute unauthorized withdrawals. This attack was facilitated by a flaw in the wallet signing process, which may have been the key entry point for attackers. Additionally, phishing and social engineering attacks may have helped gain internal credentials.

A single-signing transaction vulnerability allows a single transaction approval to be reused or manipulated, leading to unauthorized withdrawals. In this case, attackers intercepted the approval signature generated when funds were moved from a cold wallet to a hot wallet, triggering multiple unauthorized transactions. Since the system treated these as approved transactions, the funds could be drained without immediate alerts.

While the single-signing transaction flaw appears to be the main exploit, phishing attacks and delayed detection contributed to the vulnerability. The breach was first spotted by ZachXBT, who noticed excessive fund outflows on February 21. It was later determined that a breach in Safe{Wallet}, a third-party service used for transaction verification, enabled the hack.

Safe{Wallet} is a smart contract-based wallet service that ensures secure transactions using multi-signature approvals. However, a security flaw led to JavaScript exploits that compromised its integrity. Hackers embedded malicious code into the Safe{Wallet} service running on AWS, allowing them to modify transaction details unnoticed. During a typical ETH cold wallet transfer, the compromised Safe{Wallet} script altered transaction details just as they were being authorized, redirecting funds to the hacker's destination.

This hack emphasizes that vulnerabilities can arise not from direct attacks but from third-party integrations. Transactions must undergo continuous audits, ensuring that dependencies do