There is a phrase in crypto security I keep coming back to: don't trust, verify . On 21 February 2025 , one of the biggest exchanges in the world trusted the wrong thing, and lost around $1.5 billion in a few minutes.

It is the largest crypto theft ever recorded. And it did not require breaking any cryptography.

The setup

Bybit , a Dubai-based exchange, kept a large amount of Ethereum in a cold wallet , meaning offline storage protected by a multisig setup. Moving funds needed several authorised people to approve and sign.

That is a good design. Several humans, several keys, no single point of failure. On paper.

The wallet was managed through Safe{Wallet} , a popular multisig platform with a web interface.…