The February 2025 Bybit theft exposed a weakness in the transaction-signing process. Attackers compromised the Safe interface and deceived authorized signers into approving a malicious transaction. Multiple signatures could not protect the funds when signers relied on the same misleading display.
For custody teams, the incident points to controls that should work independently of a single interface:
Independent transaction checks: Verify the destination, amount, operation and contract call using a trusted channel separate from the interface that prepared the transaction.
Infrastructure controls: Restrict access to signing and deployment systems, protect credentials and monitor changes to software delivered to signers.
Transaction limits and response: Set limits and escalation paths before an incident. Reconciliation and post-transaction monitoring can help detect a loss, but cannot reverse an irreversible transfer.
Separate approval responsibilities: Multiple approvers help only when their checks are meaningfully independent. Multisignature wallets and MPC are different designs, and neither guarantees that an approved transaction is legitimate.
Risk-based review: Investigate unusual destinations, contract changes and high-value withdrawals before approval. A risk score should support, rather than replace, transaction verification.
Practice incident response: Give treasury teams clear procedures for suspicious requests, compromised systems and emergency communications. Test those procedures regularly.
Insurance limits: Private insurance can cover specified losses subject to exclusions, limits and claims procedures. It should not be presented as equivalent to deposit protection at an insured bank.
Security: A Shared Responsibility
Security depends on the whole signing process: the systems preparing a request, the information shown to approvers and the checks performed before funds move.
Self-custody changes who controls the keys and carries responsibility for them. It still requires a secure backup and careful verification of every signature; it does not remove every risk illustrated by the Bybit incident.
Sources: Safe: investigation statement, 28 February 2025; FBI: Bybit theft advisory, 26 February 2025
