Multisig wallets are only as secure as the software displaying transactions to signers, not the cryptography protecting them. On February 21, 2025, attackers drained roughly $1.5 billion in ether from Bybit's cold storage wallet despite every signer using a hardware wallet and following security checklists. The Safe smart contract itself never broke. Instead, a compromised frontend showed signers a routine transaction while they were actually approving a malicious contract upgrade.

What Actually Happened to Bybit's Safe Multisig Wallet?

Bybit was moving 401,000 ETH from cold storage to a warm wallet, a routine operation the exchange had performed many times before. Forensic analysis by Checkpoint Research and incident responder Sygnia revealed that attackers, later attributed to North Korea's Lazarus Group, had compromised a developer machine inside the Safe{Wallet} organization. From there, they hijacked Amazon Web Services (AWS) session tokens and swapped a JavaScript bundle served from Safe's frontend at app.safe.global, which was hosted on AWS S3 and CloudFront.

The malicious script didn't touch the Safe smart contract at all. Instead, when it detected it was loaded on a page tied to Bybit's cold wallet address, it silently rewrote the pending transaction. What the signers saw on their screens was a routine ETH transfer. What they were actually approving was a delegatecall that upgraded the Safe's implementation contract to one containing backdoor functions, described in incident reports as sweepETH and sweepERC20. The signers used Ledger hardware wallets, which should have been the control preventing this attack. It didn't matter, because a hardware wallet can only show you what the software feeding it chooses to display. Ledger's own postmortem calls this "blind signing," and it's the crux of the whole problem: the interface, not the cryptography, was the attack surface.

"The incident stemmed from a compromised developer machine and a disguised transaction, not a flaw in the Safe multisig contract logic itself," stated the Safe Ecosystem Foundation in its February 28, 2025 statement.

Safe Ecosystem Foundation

Once the malicious upgrade was approved, attackers drained close to 401,000 ETH equivalent to 51 separate addresses in minutes.

Is Bybit an Isolated Case, or Part of a Broader Pattern?

Bybit wasn't alone. CleanSky's 2026 security analysis tracked roughly $1.8 billion in combined losses across three major multisig incidents between February 2025 and June 2026. Every one of them was running multisig wallets, and none of them were caused by smart contract bugs. All were operational security failures that a properly configured multisig with the right guardrails would have caught.

• Bybit Cold Wallet (February 2025): Approximately $1.4 billion to $1.5 billion lost to a compromised Safe{Wallet} frontend that enabled blind-signed contract upgrades.
• Drift Protocol (April 2026): Approximately $285 million lost after attackers abused pre-signed durable-nonce transactions with no expiration policy, effectively replaying stale signed approvals.
• Humanity Protocol (June 2026): $36.4 million lost when the keys controlling its multisig were concentrated on a single compromised laptop.

CertiK's Hack3D report tallied $1.315 billion stolen across 344 on-chain incidents in the first half of 2026 alone, with wallet compromise the single costliest category at over $444 million, averaging more than $13 million per incident. That's the highest average loss of any attack category CertiK tracks.

How to Build a Secure Multisig Setup in 12 Steps

The core lesson from Bybit, Drift, and Humanity Protocol is that a multisig is only as distributed as its weakest shared dependency. For most teams, that weak dependency turns out to be the software stack everyone uses to interact with the contract, not the contract itself. A comprehensive 12-step guide published by Dr. Heinrich Vogel in September 2026 walks teams through building a Safe multisig correctly, using these incidents as negative examples to design against.

• Hardware Wallet Diversity: Use 2 to 3 hardware wallets from at least two different vendors. Mixing brands means a single vendor-side firmware bug doesn't take down every signer at once. Ledger Nano X/S Plus or Trezor Safe 5/7 both work.
• Clean Browser Environment: Run a modern browser (Chrome 128+, Firefox 130+, or Brave) with no unnecessary extensions installed. Extension-based wallet phishing is a real vector, so maintain a clean profile for treasury work.
• Transaction Simulation: Wire up transaction simulation so signers can verify what they're actually approving before signing, not just what the interface claims they're approving.
• Timelock Guards: Add a timelock guard for large transfers, creating a delay window during which the transaction can be reviewed or cancelled if it appears malicious.
• Real-Time Monitoring: Build a small Python monitor that watches your Safe's pending transactions from the command line, independent of any web app.
• Testnet Validation: Deploy a real Safe on a public testnet first, verify it independently of the web app, and do not skip the testnet phase to save time. That's precisely the corner-cutting that turns a treasury setup into next year's incident.

The full setup requires Node.js v20 LTS or newer, npm 10+, Safe's Protocol Kit SDK (version 4.x as of 2026), the ethers library v6.x, Python 3.11+ with the requests library, testnet ETH on Sepolia, an RPC endpoint for Sepolia and mainnet, and Safe's core smart contracts (currently tagged v1.5.0 in the safe-global/safe-smart-account GitHub repository). Budget 90 to 120 minutes for the full walkthrough if you're doing it for the first time, including waiting on testnet confirmations.

Why Safe Multisig Wallets Matter at Scale

By September 2026, Safe (the wallet standard formerly branded Gnosis Safe) secures more assets than any other non-liquidity protocol in decentralized finance (DeFi). Safe Foundation's Q1 2026 report put total assets secured at roughly $35.25 billion, spread across more than 61 million deployed accounts, and Safe's own materials cite a broader lifetime figure north of $60 billion moving through the ecosystem. Uniswap, ENS, Optimism, and Lido all park treasury funds in Safe accounts. If you run a decentralized autonomous organization (DAO), a protocol treasury, a company crypto account, or even a family fund big enough to worry about, you're going to end up on Safe or something like it.

The stakes are high because the attack surface has shifted. The multisig math is sound. The human and interface layer around it isn't. That's worth sitting with for a moment, because it cuts against the intuition most teams have when they adopt multisig in the first place. The whole pitch of an M-of-N wallet is that no single point of failure can drain the treasury. That's true at the smart contract layer. It stops being true the moment every signer is looking at the same compromised rendering of a transaction, or the moment those signers' keys all trace back to one physical laptop.

The 2026 security landscape shows that operational discipline, not just cryptography, determines whether a multisig actually protects assets. Teams that implement the 12-step framework, diversify their hardware, monitor pending transactions independently, and never skip testnet validation are building the kind of setup that would have caught the Bybit, Drift, and Humanity Protocol attacks before they happened.