Storia crypto
2025: the Bybit theft and the limits of a transaction signature
The FBI's attribution record documents a major theft; a valid signature alone does not establish informed approval.
Gli articoli di ricerca e le schede sono pubblicati in inglese. La navigazione è disponibile in sette lingue.
Persone e progetti
In questo articolo
The public attribution
The FBI's 26 February 2025 notice attributed approximately $1.5 billion stolen from Bybit on or about 21 February to North Korean TraderTraitor activity. The notice described conversions across assets and distribution across thousands of addresses, and supplied addresses associated with the theft.
That record establishes the agency's attribution and its published tracing leads. It is not a substitute for a full technical postmortem of every component involved. An address can be a useful indicator while the exact human operator or intermediate service role still requires additional evidence.
The signing question
The broader security issue is whether the people authorising a transaction can independently verify its actual effect. A signature proves authorisation by a key under a particular message format. It does not prove that an interface displayed the correct destination, call or resulting permissions.
This is why frontend integrity, Safe modules and typed-data review belong in a custody assessment. Requiring several signatures can reduce single-key risk while still leaving a shared display or software dependency. This analytical distinction is general; the FBI notice alone should not be cited as proof of a particular user-interface exploit.