Skip to main content
Incident intelligence/SS-IR-057CASE FILE OPEN
Symbolic editorial illustration for SS-IR-057SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAME
SS-IR-057 // INCIDENT REPORTReported

Bybit

$1.5 Billion Stolen Through Compromised Automated Wallet Infrastructure

EXECUTIVE BRIEF

North Korea's Lazarus Group exploited compromised infrastructure at Safe{Wallet}, a third-party multi-signature wallet provider used by cryptocurrency exchange Bybit.

FINANCE & MARKETS
FAILURE CHAINTRACE COMPLETE
  1. 01TRIGGERNorth Korea's Lazarus Group exploited compromised infrastructure at Safe{Wallet}, a third-party multi-signature wallet…
  2. 02MACHINE ACTIONOperational automation
  3. 03MISSING GATERisk-based SME approval before execution
  4. 04IMPACTFinancial harm
01 // INCIDENT SUMMARY

The short version

North Korea's Lazarus Group exploited compromised infrastructure at Safe{Wallet}, a third-party multi-signature wallet provider used by cryptocurrency exchange Bybit.

02 // KEY FACTS

Case telemetry

INCIDENT
SS-IR-057
DATE
February 21, 2025
SYSTEM
Bybit
LOCATION / SCOPE
Global
EVIDENCE
Reported
AI ROLE
Operational automation
HARM
Financial harm
SOURCES
1 cited record
03ENTRY POINT // WHAT HAPPENED

The event

North Korea's Lazarus Group exploited compromised infrastructure at Safe{Wallet}, a third-party multi-signature wallet provider used by cryptocurrency exchange Bybit. The attackers manipulated the automated signing process to steal approximately 400,000 Ethereum - worth $1.5 billion - in the largest cryptocurrency exchange hack in history. The multi-signature wallet system, designed to require multiple approvals before authorizing transfers, was subverted through its own automated infrastructure rather than through the signatures themselves.

04CAUSAL TRACE // AI'S ACTUAL ROLE

What the machine did

The multi-sig wallet infrastructure operated as an automated trust layer - if the signing infrastructure said the transaction was valid, the system executed it. The attackers compromised the automated infrastructure that presented transactions for signing, meaning signers approved transactions that looked legitimate on their screens but executed differently on-chain. The automation translated valid human approvals into malicious blockchain transactions.

Operational automationAutomation was a causal participant—not a decorative label for the system around it.
05BLAST RADIUS // CONSEQUENCES

Where the failure landed

$1.5 billion stolen - the largest crypto exchange hack ever. The FBI confirmed attribution to North Korea's Lazarus Group (TraderTraitor). Bybit replenished reserves within 72 hours through emergency funding from Galaxy Digital, FalconX, and Wintermute, but the stolen funds were laundered through mixers and cross-chain bridges. The incident exposed critical vulnerabilities in automated multi-sig wallet infrastructure.

06 // EVIDENCE STATUS

Reported

Documented in the cited public record. Follow the sources for the precise evidentiary posture.

SOURCE RECORD UPDATED 2026-07-09

07 // SOURCE LEDGER

1 cited record

  1. 01
08CONTROL FAILURE // MISSING GOVERNANCE

Risk-based SME approval before execution

The failure pattern in this case: High-stakes output had no accountable checkpoint.

09INTERVENTION POINT // HUMAN IN THE MIDDLE

The moment the path could change

The appropriate subject-matter expert reviews the evidence, exceptions, and affected people before the output becomes action.

AI PROPOSES→HUMAN OWNS THE DECISION→SYSTEM EXECUTES
10CONTROL DEPLOYMENT // AUTHORITYGATE

Risk routing · named approval · audit trail

AuthorityGate's framework requires out-of-band verification for high-value automated transactions. When a multi-sig wallet processes a $1.5 billion transfer, a human SME should verify the transaction details through a separate, independent channel - not through the same infrastructure that presents the transaction. The framework also mandates independent audit of automated intermediary systems that sit between human approval and execution.

RELEVANT KEYSTONE CONTROLHuman-in-the-Loop ValidationHow high-risk actions route to a named subject-matter expert who owns the go or no-go decision.
12 // THE ALTERNATIVE

Autonomy is a design choice.

See the operating model that keeps AI useful while preserving human authority at consequential moments.

Compare AgenticAI and AugmentedAI →