On 21 February 2025, attackers stole about $1.5 billion in cryptocurrency from the exchange Bybit, the figure the FBI gives for what it attributes to North Korea's "TraderTraitor" actors. Bybit's own systems were not breached. The attackers went through a supplier: Safe{Wallet}, whose web interface Bybit used to approve transfers from a multisignature cold wallet. According to Safe, a developer's laptop was compromised and the attackers hijacked that developer's AWS session tokens to get around multi-factor authentication. With that cloud access they changed JavaScript served to Bybit's signers, so a routine transfer became a transfer to the attackers. It is one of the clearest cases on record of a single human's workstation turning into a machine credential with enormous reach.
Key takeaways
- The FBI attributed the roughly $1.5 billion theft to North Korea, which it tracks as TraderTraitor. BleepingComputer reported more than 400,000 ETH and stETH stolen.
- Safe says a developer's macOS laptop was compromised on 4 February 2025 through a Docker project, and that the attackers hijacked AWS session tokens to bypass MFA. The developer had elevated access.
- Malicious JavaScript was served from Safe's AWS S3 bucket. Sygnia found it was modified on 19 February, activated only for Bybit's contract address or one other address likely linked to the attackers, and was removed about two minutes after the theft.
- Bybit and the investigators found no compromise of Bybit's own infrastructure. The weak point was a supplier's cloud identity and the integrity of code its signers trusted.
- Lessons: treat developer machines as holders of production credentials, keep cloud sessions short and bound to devices, separate the right to publish front-end code from everyday developer access, and verify what signers see.
At a glance
| Organisation(s) | Bybit (victim of the theft); Safe{Wallet} (supplier whose infrastructure was compromised) |
|---|---|
| When | Developer laptop compromised 4 February 2025; malicious code in place from 19 February; theft on 21 February 2025 |
| Attacker | North Korea's TraderTraitor, per the FBI; also tracked as UNC4899 and linked to the Lazarus Group |
| Entry point | A Safe{Wallet} developer's macOS workstation, compromised through a malicious Docker project |
| Identities abused | The developer's hijacked AWS session tokens, used to access Safe's AWS environment and alter JavaScript in an S3 bucket |
| Impact | About $1.5 billion in virtual assets stolen from Bybit's Ethereum multisig cold wallet |
| Category | NHI (cloud session tokens and front-end supply chain), after compromise of a developer's workstation |
What happened
Bybit kept most of its Ether in a multisignature cold wallet and used Safe{Wallet}'s web application to propose and sign transfers. On 21 February 2025, according to Sygnia's investigation for Bybit, "Bybit initiated a transaction from the targeted cold wallet using Safe{Wallet}'s web interface." The transaction was manipulated so that the attackers could take control of the wallet and move the funds. BleepingComputer reported that a scheduled transfer from the cold wallet to a hot wallet was intercepted, with more than 400,000 ETH and stETH, worth over $1.5 billion, sent to an address the attackers controlled.
The manipulation sat in Safe's front end, not in Bybit's systems. Sygnia found malicious JavaScript in Safe{Wallet}'s resources, "last modified on February 19, 2025, two days prior to the malicious transaction". The code contained an activation condition so it only fired when the transaction source matched one of two contract addresses: Bybit's, and an unidentified one Sygnia judged likely to be the attackers'. About two minutes after the malicious transaction, the JavaScript was modified again to remove the injection, which Sygnia said "was likely carried out by the attackers in an attempt to cover their tracks." BleepingComputer reported the code was served from Safe{Wallet}'s AWS S3 bucket, and that Verichains had concluded the "AWS S3 or CloudFront account/API Key of Safe.Global was likely leaked or compromised". Sygnia found no evidence that Bybit's own infrastructure had been compromised.
On 26 February 2025, the FBI said North Korea was responsible, naming the activity TraderTraitor. It warned that "TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains", and published a list of Ethereum addresses it linked to the actors. The same day Bybit said "The credentials of a Safe developer were compromised" and "Our infrastructure was not compromised".
Safe released preliminary findings from its investigation with Mandiant in early March. Its statement, as reported by The Hacker News, said: "The attack involved the compromise of a Safe{Wallet} developer's laptop ('Developer1') and the hijacking of AWS session tokens to bypass multi-factor authentication ('MFA') controls." Safe added: "This developer was one of the very few personnel that had higher access in order to perform their duties." The laptop was compromised on 4 February 2025 after the developer ran a Docker project named "MC-Based-Stock-Invest-Simulator-main", which talked to a domain registered two days earlier. The attackers' use of the developer's AWS account came from ExpressVPN IP addresses with Kali Linux user-agent strings, and they deployed the Mythic framework, then removed malware and cleared Bash history. CryptoSlate, summarising Safe's report, said the attackers tried and failed to register their own MFA device, then hijacked active AWS user session tokens to work around Safe's 12-hour MFA re-authentication requirement.
Elastic Security Labs later published an emulation of the attack chain based on public reporting. In its reconstruction, a stealer collected SSH private keys and AWS credentials from the developer's machine, and Elastic noted that "AWS temporary session tokens do not permit IAM API calls without MFA authentication context", which would explain why registering a new MFA device failed while ordinary use of the session succeeded. That is Elastic's emulation, not a forensic finding from the real incident, but it is consistent with what Safe described.
Timeline
| Date | Event |
|---|---|
| 2 February 2025 | Domain used by the malicious Docker project is registered, per Safe's findings. |
| 4 February 2025 | Safe developer's macOS laptop compromised after running the Docker project. |
| 19 February 2025 | Safe{Wallet} JavaScript resources last modified with the malicious code, per Sygnia. |
| 21 February 2025 | Bybit's cold wallet transfer is manipulated and about $1.5 billion is stolen; the code is removed two minutes later. |
| 26 February 2025 | FBI attributes the theft to North Korea's TraderTraitor; Bybit says a Safe developer's credentials were compromised. |
| 6 to 7 March 2025 | Safe publishes preliminary findings with Mandiant: developer laptop compromise and hijacked AWS session tokens. |
| 16 March 2025 | Sygnia publishes its investigation findings. |
How it happened: the identity attack path
- A developer workstation as the way in. The developer ran a Docker project that led to compromise of their macOS laptop. The attackers now had everything the developer's machine could reach.
- A live cloud session, not a password. The developer was signed in to AWS. Rather than steal a password and face MFA, the attackers took the active AWS session tokens. Those tokens were already MFA-authenticated.
- Persistence blocked, access not. Their attempt to register their own MFA device failed. So they worked within the life of the hijacked sessions, operating from VPN addresses.
- Elevated privileges on production assets. The developer had elevated access. That included, directly or indirectly, the ability to change JavaScript in the S3 bucket that served Safe{Wallet}'s web application.
- Code changed where signers would trust it. The attackers inserted JavaScript that activated only for Bybit's contract or one other address, so other Safe users saw normal behaviour.
- A legitimate approval, a malicious transaction. Bybit's signers approved what looked like a routine transfer. The signatures were real; the transaction was not what they believed it to be.
- Evidence removed. The malicious code was replaced two minutes after the theft.
Impact
- Financial: about $1.5 billion in virtual assets stolen, per the FBI; more than 400,000 ETH and stETH, per BleepingComputer.
- Laundering: the FBI reported rapid conversion and dispersal across thousands of addresses on multiple blockchains.
- Supplier: Safe{Wallet}'s infrastructure was used to attack one of its customers, and Safe had to investigate its AWS environment and front-end publishing.
- Industry: the incident showed that a multisignature wallet is only as strong as the interface its signers use to read transactions.
What this means for NHI governance
The Bybit theft is usually told as a crypto story. Underneath, it is a cloud identity story. The decisive credential was not a private key for the wallet. It was an AWS session belonging to one developer, with enough privilege to change production code. That session was a bearer credential: whoever held it was the developer, as far as AWS was concerned, and MFA had already been satisfied.
Three points stand out for anyone governing non-human identities. First, developer machines are credential stores. Cached cloud sessions, access keys, SSH keys and tokens live there, and a single malicious package or project can collect them. Second, the right to publish production front-end code is a privileged action. It should not ride on a developer's everyday session; it should need a separate, tightly scoped identity, ideally used only by a pipeline with its own controls. Third, MFA protects authentication, not the session it produces. Safe's control that blocked new MFA device registration worked, but the attackers did not need it. Short session lifetimes, binding sessions to a device and alerting on use from new networks would each have raised the cost.
North Korean operators have repeatedly targeted developers and their credentials. Our timeline includes the Mastra npm supply chain attack attributed to Sapphire Sleet and cloud credential abuse such as the TruffleNet campaign using stolen AWS credentials.
Recommendations
- Separate publishing rights from developer sessions. Only a pipeline identity with narrow permissions should write to buckets or CDNs serving production code. See our Cloud Workload Identity Guide.
- Shorten and bind cloud sessions. Use short-lived sessions for privileged roles, require fresh MFA for sensitive actions, and alert on session use from new IP ranges or commercial VPNs.
- Apply just-in-time access to production. Developers should request time-bound elevation for production changes, not hold it standing. Our Privileged Access Management Guide covers zero standing privilege.
- Treat developer endpoints as credential stores. Keep long-lived keys off laptops, run untrusted code in isolated environments, and monitor for access to credential files. See our guide to the secret sprawl challenge.
- Protect the integrity of what signers see. Use subresource integrity, change alerts on production assets and independent verification of transaction details before signing.
- Know which suppliers can change your critical flows. Map the third-party identities and code paths that sit between your staff and your assets.
Frequently asked questions
How was Bybit hacked?
Attackers compromised a Safe{Wallet} developer's laptop, hijacked the developer's AWS session tokens and used them to change JavaScript in Safe's web interface. When Bybit's signers approved a routine cold wallet transfer, the altered code sent the funds to the attackers.
Who was behind the Bybit hack?
The FBI attributed it to North Korea, which it tracks as TraderTraitor. The same cluster is also known as UNC4899 and is associated with the Lazarus Group.
Did MFA fail in the Bybit hack?
Not directly. According to Safe's findings, the attackers tried to register their own MFA device and failed. They instead hijacked sessions that had already passed MFA, which is why session lifetime and binding matter as much as the login itself.
Related NHI Mgmt Group resources
Mastra npm supply chain attack · CircleCI breach · TruffleNet stolen AWS credentials · Hacked AWS accounts fuel crypto mining · Cloud Workload Identity Guide · All NHI breaches
How NHI Mgmt Group can help
Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target cloud sessions, access keys, tokens and the developer machines that hold them. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.
References
- FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack (26 February 2025)
- Bybit: Bybit Confirms Security Integrity Amid Safe{Wallet} Incident, No Compromise in Infrastructure (26 February 2025)
- Sygnia: Sygnia's Investigation into the Bybit Hack: What We Know So Far (16 March 2025)
- BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine (26 February 2025)
- The Hacker News: Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist (7 March 2025)
- Cryptonews: Safe Wallet Reveals Bybit Hack Details, and Calls for Community Action (6 March 2025)
- CryptoSlate: Safe's internal investigation reveals developer's laptop breach led to Bybit hack (6 March 2025)
- Elastic Security Labs: Bit ByBit, emulation of the DPRK's largest cryptocurrency heist (6 May 2025)
