Security is something I have been dealing with for the past 15–17 years. No matter how much you know, there will always be someone smarter, faster, or stronger. Yet, there is a set of rules and principles that should never be violated. The Bybit experience was particularly illustrative for me because the exchange's employees neglected all major security approaches—from fundamental and abstract principles to concrete, detailed measures. Thus, I will analyze several key aspects based on this hack. The Zero Principle of Security Years ago, I formulated this principle for myself: "Any system can be hacked. The only question is time, money, and effort." If hacking your system yields $1M while costing the attacker only $10K, the system will definitely be hacked. However, if hacking requires $1.1M, then the question becomes: why bother? Unless, of course, the motive is to harm a competitor or conduct a state-sponsored cyberattack. This principle was precisely what Bybit's employees violated. According to initial interviews, they believed their system was invulnerable. But the $1.4B price tag changed everything. Wherever you work, you must understand that anything can be hacked, anytime, and anyway. The only variables are money, time, and effort. Knowing this, let's move forward… Is a Hardware Wallet + Multisig Safe? Yes and no. Hardware wallets have always been attacked—Ledger and Trezor are prime examples. Other brands fare even worse. However, you can mitigate risks and reduce negative impacts when using hardware/multisig wallets. Here are some recommendations compiled from researchers and personal experience: Verify what you're signing: Always ensure that what you see matches what you're actually signing or transferring. If you notice discrepancies, stop, pause, and evaluate the situation carefully. Browser-based wallet connections are safer than direct ones: Why? Browser wallets have extensive contract databases and can sometimes provide false positives, but they highlight interactions with new and, especially, unverified contracts (which was relevant in this case). Update your wallet firmware: Install only official firmware, unless you're into ethical hacking. You can verify this on the manufacturer's website or via hash sums. Simulate transactions before signing: Always check for unexpected changes. The key concepts here are pre-check and interrupt. Use alternative verification sources: Some useful tools include: Etherscan Input Data Decoder PalmeraDAO Safe Interface (used after the Bybit hack) CirclesTools SafeViewer (explained in the linked page) Safe has also introduced alternative interfaces: PalmeraDAO App EternalSafe Onchainden App Add.: Safe API Safe Documentation Trezor features These precautions are just a start. Now, let’s compare them with lessons learned from the Radiant hack: Multilayer signature verification: Any anomaly, even minor, should trigger a security review. Independent transaction verification device: Generates verification codes that match hardware wallet data. Enhanced Ledger/Trezor security: Avoid blind signing for critical transactions. Audit repeated transaction failures: Recurrent issues should trigger a full transaction audit. Manual transaction data verification: Extract and decode transaction data before signing, ensuring functions and addresses match expectations. Dual message hash confirmation: Use Gnosis’ guide to verify transactions on hardware wallets. Did Bybit implement any of these? According to available data—no. The Human Factor: The Weakest Link Phishing, social engineering, and spam account for 80% of cyberattacks. The Bybit and Radiant cases prove this clearly. To mitigate risks, implement role separation: If you have multiple signers, they must have independent verification channels. Ownership changes should be more complex than transaction approvals. Cold wallets should never store more than acceptable loss thresholds (e.g., $1.5B is excessive for any exchange). Any transaction discrepancies should default to cancellation, not approval. Staff must receive ongoing security training—at least monthly. Appoint at least one security verifier with expertise in multisig wallets and advanced security tools. Again, public data does not confirm that Bybit followed any of these steps. Researcher Opinions Many experts have weighed in on this hack. Here are some key perspectives: @dhkleung @blainemalone @pcaversaccio SlowMist Report @koeppelmann Chainabuse Report Radiant Post-Mortem The key takeaway? While the attack appeared highly technical, it ultimately succeeded due to human error rather than technological vulnerabilities. Therefore, I highly recommend studying the Radiant and WazirX cases as well. It’s clear that script kiddies are adopting these techniques, meaning that not only exchanges but a wider range of crypto projects will be targeted next. Stay safe! Security is something I have been dealing with for the past 15–17 years. No matter how much you know, there will always be someone smarter, faster, or stronger. Yet, there is a set of rules and principles that should never be violated. The Bybit experience was particularly illustrative for me because the exchange's employees neglected all major security approaches—from fundamental and abstract principles to concrete, detailed measures. Thus, I will analyze several key aspects based on this hack. The Zero Principle of Security The Zero Principle of Security Years ago, I formulated this principle for myself: "Any system can be hacked. The only question is time, money, and effort." If hacking your system yields $1M while costing the attacker only $10K, the system will definitely be hacked. However, if hacking requires $1.1M, then the question becomes: why bother? Unless, of course, the motive is to harm a competitor or conduct a state-sponsored cyberattack. "Any system can be hacked. The only question is time, money, and effort." This principle was precisely what Bybit's employees violated. According to initial interviews, they believed their system was invulnerable. But the $1.4B price tag changed everything. This principle was precisely what Bybit's employees violated. According to initial interviews, they believed their system was invulnerable. But the $1.4B price tag changed everything. Wherever you work, you must understand that anything can be hacked, anytime , and anyway . The only variables are money, time, and effort. Knowing this, let's move forward… anything anytime anyway Is a Hardware Wallet + Multisig Safe? Is a Hardware Wallet + Multisig Safe? Yes and no. Hardware wallets have always been attacked— Ledger and Trezor are prime examples. Other brands fare even worse. Ledger Trezor However, you can mitigate risks and reduce negative impacts when using hardware/multisig wallets. Here are some recommendations compiled from researchers and personal experience: Verify what you're signing: Always ensure that what you see matches what you're actually signing or transferring. If you notice discrepancies, stop, pause, and evaluate the situation carefully. Browser-based wallet connections are safer than direct ones: Why? Browser wallets have extensive contract databases and can sometimes provide false positives, but they highlight interactions with new and, especially, unverified contracts (which was relevant in this case). Update your wallet firmware: Install only official firmware, unless you're into ethical hacking. You can verify this on the manufacturer's website or via hash sums. Simulate transactions before signing: Always check for unexpected changes. The key concepts here are pre-check and interrupt. Use alternative verification sources: Some useful tools include: Etherscan Input Data Decoder PalmeraDAO Safe Interface (used after the Bybit hack) CirclesTools SafeViewer (explained in the linked page) Safe has also introduced alternative interfaces: PalmeraDAO App EternalSafe Onchainden App Add.: Safe API Safe Documentation Trezor features Verify what you're signing : Always ensure that what you see matches what you're actually signing or transferring. If you notice discrepancies, stop, pause, and evaluate the situation carefully. Verify what you're signing Browser-based wallet connections are safer than direct ones : Why? Browser wallets have extensive contract databases and can sometimes provide false positives, but they highlight interactions with new and, especially, unverified contracts (which was relevant in this case). Browser-based wallet connections are safer than direct ones Update your wallet firmware : Install only official firmware, unless you're into ethical hacking. You can verify this on the manufacturer's website or via hash sums. Update your wallet firmware Simulate transactions before signing : Always check for unexpected changes. The key concepts here are pre-check and interrupt . Simulate transactions before signing pre-check interrupt Use alternative verification sources : Some useful tools include: Etherscan Input Data Decoder PalmeraDAO Safe Interface (used after the Bybit hack) CirclesTools SafeViewer (explained in the linked page) Use alternative verification sources Etherscan Input Data Decoder PalmeraDAO Safe Interface (used after the Bybit hack) CirclesTools SafeViewer (explained in the linked page) Etherscan Input Data Decoder Etherscan Input Data Decoder PalmeraDAO Safe Interface (used after the Bybit hack) PalmeraDAO Safe Interface CirclesTools SafeViewer (explained in the linked page) CirclesTools SafeViewer Safe has also introduced alternative interfaces: PalmeraDAO App EternalSafe Onchainden App PalmeraDAO App EternalSafe Onchainden App PalmeraDAO App PalmeraDAO App EternalSafe EternalSafe Onchainden App Onchainden App Add.: Safe API Safe Documentation Trezor features Safe API Safe Documentation Trezor features Safe API Safe API Safe Documentation Safe Documentation Trezor features Trezor These precautions are just a start. Now, let’s compare them with lessons learned from the Radiant hack: Multilayer signature verification: Any anomaly, even minor, should trigger a security review. Independent transaction verification device: Generates verification codes that match hardware wallet data. Enhanced Ledger/Trezor security: Avoid blind signing for critical transactions. Audit repeated transaction failures: Recurrent issues should trigger a full transaction audit. Manual transaction data verification: Extract and decode transaction data before signing, ensuring functions and addresses match expectations. Dual message hash confirmation: Use Gnosis’ guide to verify transactions on hardware wallets. Multilayer signature verification : Any anomaly, even minor, should trigger a security review. Multilayer signature verification Independent transaction verification device : Generates verification codes that match hardware wallet data. Independent transaction verification device Enhanced Ledger/Trezor security : Avoid blind signing for critical transactions. Enhanced Ledger/Trezor security Audit repeated transaction failures : Recurrent issues should trigger a full transaction audit. Audit repeated transaction failures Manual transaction data verification : Extract and decode transaction data before signing, ensuring functions and addresses match expectations. Manual transaction data verification Dual message hash confirmation : Use Gnosis’ guide to verify transactions on hardware wallets. Dual message hash confirmation Did Bybit implement any of these? According to available data—no. Did Bybit implement any of these? According to available data—no. The Human Factor: The Weakest Link The Human Factor: The Weakest Link Phishing, social engineering, and spam account for 80% of cyberattacks. The Bybit and Radiant cases prove this clearly. To mitigate risks, implement role separation: If you have multiple signers, they must have independent verification channels. Ownership changes should be more complex than transaction approvals. Cold wallets should never store more than acceptable loss thresholds (e.g., $1.5B is excessive for any exchange). Any transaction discrepancies should default to cancellation, not approval. Staff must receive ongoing security training—at least monthly. Appoint at least one security verifier with expertise in multisig wallets and advanced security tools. If you have multiple signers, they must have independent verification channels . If you have multiple signers, they must have independent verification channels Ownership changes should be more complex than transaction approvals . Ownership changes should be more complex than transaction approvals Cold wallets should never store more than acceptable loss thresholds (e.g., $1.5B is excessive for any exchange). Cold wallets should never store more than acceptable loss thresholds Any transaction discrepancies should default to cancellation, not approval . Any transaction discrepancies should default to cancellation, not approval Staff must receive ongoing security training—at least monthly . Staff must receive ongoing security training—at least monthly Appoint at least one security verifier with expertise in multisig wallets and advanced security tools. Appoint at least one security verifier Again, public data does not confirm that Bybit followed any of these steps. Again, public data does not confirm that Bybit followed any of these steps. Researcher Opinions Researcher Opinions Many experts have weighed in on this hack. Here are some key perspectives: @dhkleung @blainemalone @pcaversaccio SlowMist Report @koeppelmann Chainabuse Report Radiant Post-Mortem @dhkleung @dhkleung @blainemalone @blainemalone @pcaversaccio @pcaversaccio SlowMist Report SlowMist Report @koeppelmann @koeppelmann Chainabuse Report Chainabuse Report Radiant Post-Mortem Radiant Post-Mortem The key takeaway? While the attack appeared highly technical, it ultimately succeeded due to human error rather than technological vulnerabilities. human error Therefore, I highly recommend studying the Radiant and WazirX cases as well. It’s clear that script kiddies are adopting these techniques, meaning that not only exchanges but a wider range of crypto projects will be targeted next. Stay safe! Stay safe!
