The Bybit Heist: Lessons from the Largest Crypto Theft Yet

On February 21, 2025, cryptocurrency exchange Bybit disclosed the theft of roughly 1.5 billion US dollars in Ethereum, the largest digital-asset heist on record. Investigators attributed the operation to North Korean state-linked actors. What makes the incident instructive for every defender, not just those in finance, is how the theft happened.

It was not the blockchain that failed

The cryptography held. The attackers instead subverted the process around a multi-signature transaction. Reporting pointed to a compromise affecting the signing workflow, so that authorized approvers were shown a legitimate-looking transaction while the underlying instruction actually redirected funds to attacker-controlled addresses. In effect, humans approved something different from what they believed they were approving.

The transferable lessons

• Trust the interface, own the risk. If the screen an approver sees can be manipulated, multi-party approval provides false comfort.
• Supply-chain and workstation integrity underpin high-value operations.
• Patient, well-resourced adversaries will target the process, not the math.

Applying this outside crypto

Nearly all organizations authorize high-impact actions: large wire transfers, privileged configuration changes, code deployments, and vendor payment changes. The Bybit pattern maps directly onto business email compromise and fraudulent payment redirection, which continue to cause heavy losses for Canadian firms. Verify high-value actions out of band, and ensure the devices used to approve critical transactions are hardened and separated from general browsing and email.

Takeaway

Strong cryptography and multiple approvers do not help if the approval process itself is compromised. Verify high-value actions out of band, harden the endpoints that authorize them, and assume determined adversaries will attack the workflow rather than the encryption.