The FBI attributed the theft of about 1.5 billion dollars in virtual assets from the exchange Bybit, on or about 21 February 2025, to North Korea. Investigators traced the attack to malicious JavaScript served from a wallet vendor's infrastructure. How the vendor's own systems were first breached is still reported as unclear.
What the FBI said
In a public service announcement dated 26 February 2025, the FBI attributed the theft to North Korea and used the name TraderTraitor for the activity. It said the actors quickly converted some of the stolen assets to Bitcoin and other virtual assets and spread them across thousands of addresses on multiple blockchains. The FBI expected further laundering and eventual conversion to fiat currency.
The bureau asked exchanges, bridges, RPC node operators, analytics firms and other virtual asset providers to block transactions with the listed addresses. It published about 50 Ethereum addresses it said were operated by or closely tied to the actors.
What investigators found about the attack path
Reporting by The Hacker News summarises statements from the wallet vendor and two investigators. The vendor, Safe Wallet, said the attack involved a compromised machine belonging to one of its developers, which led to a disguised malicious transaction proposal affecting a Bybit account.
Sygnia's forensic work on the three signers' hosts indicated the root cause was malicious code originating from the vendor's infrastructure. Verichains found that a harmless JavaScript file on the vendor's web app was replaced with malicious code on 19 February 2025, and that the code was built to activate during Bybit's next transaction on 21 February.
What is not confirmed
The article states that it is still unclear how the developer's system was breached. It reports a suspicion that an AWS S3 or CloudFront account or API key was leaked, and labels that a suspicion rather than a finding. It also reports that a lookalike domain was registered hours before the theft, per a security firm. Treat anything beyond these statements as unverified.
Lessons for teams that sign or ship
- A signing screen is not proof. If the interface shows what you are approving, and the interface is served by someone else, an attacker who changes the page can change what you see. Verify what you sign on a separate path.
- The front end is part of the supply chain. A web app served from a bucket or CDN is only as safe as the keys that can write to it.
- Protect the developer machine like production. The vendor said a developer machine was involved. Short lived credentials, device checks and limited deploy rights reduce what one laptop can do.
- Alert on unexpected changes to served assets. A file replaced two days before the theft is a detectable event if you compare hashes or watch deploys.
- Plan for the blast radius of a customer. A vendor that serves a high value customer is a high value target.
Where Safeguard fits
Safeguard's policies and gates can block unreviewed dependency and build changes, and its dependency scanning covers the libraries inside a front end. It does not verify wallet transactions. A free scan is at gold.safeguard.sh/scan.
Quick check
Who did the FBI say was responsible for the Bybit theft?
The FBI attributed it to North Korea and referred to the activity as TraderTraitor.
Is the original entry point into the wallet vendor known?
No. The reporting says it is unclear how the developer's system was breached. An S3 or CloudFront key leak is described as a suspicion only.
Sources
- FBI public service announcement I-022625-PSA, 26 February 2025
- The Hacker News, Bybit hack traced to Safe Wallet supply chain attack
Last reviewed: 19 October 2026.
