The February 2025 exchange breach: lessons for signing operations

In February 2025 approximately 1.5 billion dollars was taken from a single exchange, Bybit, in what remains the largest theft recorded in the industry. The contracts held. The keys were not brute forced. The loss came through the signing workflow, which is where institutional value is actually controlled.

The pattern

The attack compromised the interface presented to approvers. Signers reviewed what looked like a routine transfer and authorized a transaction whose real payload differed from the display. Multiple approvals were obtained under the same false premise, so the quorum requirement provided no protection. Chainalysis attributed the incident to actors linked to the Democratic People's Republic of Korea, consistent with a pattern of targeting the human approval path rather than the cryptography.

Controls that address it

Independent verification breaks the pattern. A signer should confirm the transaction on a device that does not share a compromise domain with the initiating interface, comparing the decoded call data rather than a rendered summary. Policy engines evaluated before signing should enforce destination allow-lists, value thresholds and contract interaction rules, so that a transaction outside policy cannot reach the quorum at all. Quorum composition matters: approvers drawn from a single team, using a single build of a single client, are a single point of failure with extra steps. High-value movements should require out-of-band confirmation on a channel established in advance, with the confirming party named. And approvers should be included in red-team exercises, because the control being tested is a human decision under time pressure.

Why monitoring alone would not have prevented it

Detection begins after broadcast. No monitoring control stops a validly signed transaction from settling. Stating that plainly matters, because the alternative is to sell monitoring as prevention and leave the actual gap unaddressed. Prevention lives in the signing path.

What monitoring still does

It compresses the time between loss and response. An outflow pattern inconsistent with baseline can be detected within minutes of settlement, classified and routed to a named owner rather than to a distribution list. That owner can trigger a defined sequence: freeze what is freezable, notify counterparties and exchanges where the funds are heading, engage analytics providers to trace and label the destination addresses, brief the supervisor within the applicable reporting window, and preserve the evidence for the investigation. Recovery outcomes in large thefts correlate with the speed of that first hour.

The operating conclusion is unglamorous. Institutions should treat the approval workflow as production infrastructure with its own threat model, its own change control and its own exercises, and should assume the display layer will be attacked because it has been.