Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions
On February 21, 2025, attackers drained about 1.5 billion dollars in ether from a Bybit cold wallet by serving malicious JavaScript through the Safe{Wallet} multisig interface Bybit used to sign transactions. Safe's investigation with Mandiant found a Safe developer's Mac was compromised on February 4, after which the attackers hijacked the developer's active AWS session tokens, avoiding the need to pass MFA, and altered Safe's AWS-hosted front end. The FBI attributed the theft to North Korea's TraderTraitor.
- Victim
- Bybit (through a compromise of Safe{Wallet})
- Industry
- Crypto and Web3
- Country
- United Arab Emirates
- Intrusion began
- Feb 4, 2025
- First disclosed
- Feb 21, 2025
- Actor
- TraderTraitor (UNC4899), per the FBI and Mandiant (Nation-state)
- Attributed group
- Lazarus Group and TraderTraitor
- Initial access
- Session or token theft
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- $1.5 billion (Approximate value of the virtual assets stolen, per the FBI public service announcement of February 26, 2025. This is stolen value, not a company-reported cost.)
The identity lesson
AWS session tokens stolen from a developer laptop carried the same power as a fresh MFA login. Short-lived, device-bound sessions and separate approval for production front-end changes would have broken the chain.
Go deeper on SWI
- Technique: Token replay against an unbound endpoint
Sources
- North Korea Responsible for $1.5 Billion Bybit Hack, FBI Internet Crime Complaint Center, Feb 26, 2025
- Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist, The Hacker News, Mar 7, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- CircleCI engineer session token theft and customer secrets exposure 2023 · Session or token theft
- Slack private GitHub repositories downloaded with stolen employee tokens 2022 · Session or token theft
- Electronic Arts source code theft via purchased Slack cookie 2021 · Session or token theft
- Stolen Microsoft 365 session tokens replayed into 79 organizations 2026 · Phishing (adversary-in-the-middle)
Cite this record
SWI Community Team. (2026). Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-bybit-safe-wallet-aws-session-hijack/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.