SafeWallet Re-architects Security Infrastructure Following $1.5B Bybit ETH Hack

In February 2025, the cryptocurrency industry witnessed its largest-ever theft, with hackers stealing $1.5 billion in Ether (ETH) from the Bybit exchange. The attack, attributed to North Korea's Lazarus Group, exploited a compromised SafeWallet developer's workstation, where malicious JavaScript was injected into the user interface. This manipulated Bybit's multisignature process, capitalizing on the blind signing vulnerability, where users unknowingly approve transactions without full context.

Safe CEO Rahul Rumalla described the incident as a reckoning moment that compelled a total restructuring of the company's security approach. He emphasized that while Safe's core protocol and smart accounts remained uncompromised and super battle-tested, the breach highlighted the fragmented nature of self-custody security as a shared responsibility across the industry. In response, SafeWallet is re-architecting its systems across multiple layers: transaction-level security, signer device security, infrastructure security, and standards compliance, aiming to balance usability with robust protection.

Rumalla warned that social engineering remains the foremost future threat, with hackers infiltrating industry channels like Telegram and job applications. The event spurred industry-wide reflections on enhancing security without undermining self-custody principles, though fears of market contagion were mitigated by swift industry efforts to support Bybit's recovery.