According to Wu, Bybit released a report on the hacker theft of coins: On February 19, 2025 UTC time, the JavaScript file of app.safe.global was replaced by malicious code, targeting Bybit's EthereumMultisig cold wallet. The attack is designed to be activated during the next Bybit transaction. Based on the findings of the Bybit signer machine and the cached malicious JavaScript payload found on the Wayback Archive, we tend to conclude that Safe.Global's AWS S3 or CloudFront account/AP|key may have been leaked or compromised. Safe's official statement said that the attack was achieved through a hacked Safe{Wallet} developer machine, resulting in disguised malicious transactions.
Disclaimer: Includes third-party opinions. No financial advice. May include sponsored content.See T&Cs.