Multisig Cold Wallets: Bybit's $1.5B Lesson in Security

Multisig cold wallets, often considered one of the safest ways to store digital assets, provide an extra layer of protection against theft. However, even these advanced security measures are not infallible, as demonstrated by the February 2025 Bybit hack.

Before diving into their security, let's break down what multisig cold wallets actually are. A cold wallet is a cryptocurrency storage method that remains offline and disconnected from the internet, making it significantly harder for hackers to access the funds remotely. Examples include hardware wallets, paper wallets, and air-gapped computers. By keeping private keys offline, cold wallets reduce the risk of online attacks, such as phishing or malware. Multisignature (multisig) technology requires multiple private keys to approve a transaction, unlike single-signature wallets that need only one key. Think of it as a joint bank account, where two or more signatories are needed to approve any withdrawal. Common multisig setups include 2-of-3, 3-of-5, and 5-of-7.

Multisig cold wallets require multiple private keys from trusted parties to approve and authorize a transaction, enhancing security by preventing a single point of failure. To understand how they work, imagine a safety deposit box at a bank that requires two or more keys to open. No single person can access the contents alone — multiple trusted parties must be present. Multisig cold wallets apply this concept to digital assets, adding an extra layer of security by requiring multiple private keys to authorize transactions.

Despite their security benefits, multisig wallets are not immune to attacks. Hackers often exploit weaknesses in implementation, human behavior, or third-party services. For example, in February 2025, the Bybit exchange lost $1.5 billion worth of Ether (ETH) when hackers compromised the multisig signing process. The attack happened when attackers breached the infrastructure of a third-party wallet provider, compromised a developer's device, and injected malicious code that altered the multisig signing process. Bybit's security team approved transactions that appeared legitimate, but in reality, the funds were redirected to hacker-controlled addresses. This attack highlights the risks of relying on third-party providers for wallet security.

To make multisig cold wallets more secure, use a higher threshold of required signatures, implement multilayer authentication, and store keys in secure, geographically dispersed locations