Three approvals.
One view they all trusted.

Bybit’s 26 February 2025 statement described compromised credentials belonging to a Safe developer, which enabled access to Safe’s environment and deception of transaction signers. The company said its preliminary forensic reviews found no indication of compromise within Bybit’s infrastructure.

That account is different from a claim that the cryptographic signatures were mathematically broken. A valid signature can authorise an unwanted operation when the signer has been shown a deceptive representation of the action. The exact transaction must be understood, not merely approved through a familiar interface.

The original story focused heavily on the compromised developer and the malicious front end. Keep the lesson wider than individual blame. Release controls, privileged access, session protection, supplier assurance and independent transaction checks all help determine whether one compromised environment can influence a high-value decision.

An organisation should be able to explain what an approver actually verifies: the intended recipient, assets, permissions, amount and operation appropriate to the system. A familiar brand, device or screen should not be the only evidence that those details match the request.

Independent verification may require a separate trusted path, additional transaction policy or appropriately configured custody controls. The right arrangement depends on the platform and assets; a second screen showing the same compromised information is not necessarily independent.

The fresh management insight is about correlated assurance. Count the distinct failure modes a control can resist, rather than just the number of people who click approval. The same principle applies to payment changes, cloud administration and software releases outside crypto.

The signing workflow includes more than a wallet. It can depend on a software supplier, development and deployment systems, privileged sessions, endpoint protection and a delivery mechanism for the interface. Map these dependencies around the most consequential transactions.

MFA is valuable, but an already authorised session or a compromised endpoint can create different risks from a stolen password alone. Review the lifecycle of privileged access and the environment where it is used, rather than treating an MFA setting as the end of the assessment.

Use a realistic exercise to test a suspicious signing event. Include the supplier contact, transaction owner, security responders and leadership. The exercise should establish what can be paused, what evidence can be preserved and who can authorise the next step.

The FBI warned that the actors were rapidly converting and dispersing assets across many addresses and blockchains. A public transaction trail can support investigation and cooperation, but visibility does not guarantee that assets can be frozen, recovered or attributed to a real-world person.

Specialist analyses, including Elliptic’s and Chainalysis’s work, connect the on-chain activity and transaction controls to the broader incident. Keep their observations and recommendations attributed, and distinguish them from a finding that a particular service can reverse a completed transfer.

Bybit also publicised recovery incentives and community participation after the theft. Such initiatives can attract information and coordination; they are not a substitute for an incident plan, and any current programme terms should be verified before a person relies on them. Do not preserve a historical reward percentage as a standing offer.

• Preserve transaction identifiers, decision records and relevant system evidence.
• Use the incident response route and appropriate legal or law-enforcement contacts.
• Coordinate relevant counterparties without publishing sensitive credentials or investigative material.
• Assess continuing access and the risk of another transaction before normal operation resumes.

The FTX-claims fraud and the Bybit theft exposed different assumptions. In the former, the useful question is whether the seller has authority over the asset. In this case, it is whether the signers can establish the operation they are authorising through a trustworthy route.

Both cases argue for a clear link between evidence, authority and action. A board does not need to inspect low-level transaction data itself, but it should know whether management has defined the verification standard, funded it and tested its failure modes.