FORENSIAWeb3 forensicsOpen workspace
Case file 01

Bybit: Multisig Wallet Takeover

No keys were stolen. Three signers approved what looked like a routine transfer. The call trace shows what it was: a delegatecall that ran someone else's code with the wallet's authority.

Date
February 21, 2025
Network
Ethereum
Reported amount
$1.5Bfrom one Bybit wallet
What happened
Tampered signing screen, then a delegatecall
Status
Attributed to North Korea by the FBI (reported)
This file rests on
7 recorded and 5 reported statementsacross 5 linked identifiers
7 chapters · choose one to jump the film to it
The investigation, step by step

Replay it yourself.

These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.

  1. The theft

    About one and a half billion dollars leaves a single Bybit wallet. It is described as the largest crypto theft on record.

    Reported by others
    • $1.5B left one Bybit wallet on February 21, 2025.Public reporting

  2. The signing session

    No keys were stolen. Three people approved what their screens showed as a routine transfer. What they signed was something else.

    Reported by others
    • The signing interface had been tampered with, so the signers saw a different transaction from the one they approved.Sygnia and Verichains incident reports

  3. The transaction

    The transaction itself is a call into the wallet carrying no value. Inside it, the wallet checks three signatures.

    Recorded · captured October 5, 2026
    • The call into the wallet carried a value of zero.
    • The trace holds five nested call frames.
    • Three of them are signature checks.
    Open this step in the workspace
    Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.

  4. The delegatecall

    Then the wallet makes a delegatecall to an unfamiliar contract. A delegatecall runs someone else's code with the caller's own authority and storage, so it can rewrite the wallet's rules.

    Recorded · captured October 5, 2026
    • One nested frame is a delegatecall to 0x9622…7242.
    • The function selector on that call is 0xa9059cbb.
    Open this step in the workspace
    Opens a live lookup on the Analysis view. Today’s capture may differ from the film’s.

  5. The drain

    Minutes later the wallet is emptied and the funds fan out across dozens of addresses.

    Reported by others
    • 401,347 ETH left, along with stETH, cmETH and mETH, split across roughly 40 wallets.Public technical reporting (CertiK incident analysis)
    Open this step in the workspace
    Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.

  6. The wallet today

    Looked up again long after, the wallet holds nothing and its code still resolves to a contract named Sweeper.

    Recorded · captured October 5, 2026
    • The wallet's balance is 0 ETH.
    • Verification-registry metadata points its logic at 0xbDd0…9516, named Sweeper.
    Open this step in the workspace
    Opens a live lookup on the Analysis view. Today’s capture may differ from the film’s.

  7. Who did it

    The chain shows what moved. Naming who moved it came from investigators, and the film says so.

    Reported by others
    • ZachXBT submitted an attribution to the Lazarus Group 4 hours 56 minutes after the theft, at 19:09 UTC.ZachXBT, via public reporting
    • The FBI attributed the theft to North Korea on February 26, 2025.FBI public service announcement I-022625-PSA
The number and the record

What the headline said. What a closer reading shows.

The headline said$1.5B

left one wallet

Public reporting
On a closer reading0 ETH

attached to the transaction that changed the wallet's rules

Recorded in the transaction
The incident on one map

Who called what, and where it went.

Recorded in the workspaceReported by others

Call · value 03 signature checksDelegatecallLogic resolves here now401,347 ETH0x0fa09C…2a6d2eSent the transactionThe Bybit wallet0x1Db92e…2dFCF4Signature checksThree, at 0x…00010x9622…7242Code run by delegatecallSweeper0xbDd0…9516 · logic todayAbout 40 walletsWhere the ETH went
Timeline

In the order it happened.

  1. The wallet is called with a zero-value transaction that contains a delegatecall.Recorded

  2. 401,347 ETH and staked-ETH tokens leave the wallet.Reported by others

  3. ZachXBT submits an attribution, 4 hours 56 minutes after the theft.Reported by others

  4. The FBI attributes the theft to North Korea.Reported by others

  5. The wallet holds 0 ETH and its logic resolves to a contract named Sweeper.Recorded

The cast

Every address and transaction in this case.

Grouped by their place in the records. A group says what an address did here, not who controls it. Supported identifiers open as live lookups.

Open the investigation

What was taken from

The wallet, bridge or addresses the value left.

  • The Bybit walletEthereum contract

    The multisignature wallet that was called. Searched again in the film to see where its logic points today.

    Investigate

Code involved

Contracts that were called or run along the way.

  • Code run with the wallet's authorityEthereum contract

    The contract the delegatecall executed inside the wallet's own context.

    Investigate
  • Where the wallet's logic resolves nowEthereum contract

    The implementation the wallet's proxy metadata points to in the film.

    Investigate

The transactions

The individual records each step of the case rests on.

  • The transaction that changed the walletEthereum transaction

    The call into the wallet with zero value. Its trace shows three signature checks, then the delegatecall.

    Investigate
  • Reported ETH drainEthereum transaction

    Identified in public technical reporting, not shown in the film.

    Investigate
Recorded and reported

Two kinds of statement, kept apart.

Recorded statements were read in the workspace on October 5, 2026. Reported statements come from the source named beside each one and were not verified by Forensia. Attribution in the film is reported by others, not observed by Forensia.

What the chain records7

  • Step 3

    The call into the wallet carried a value of zero.

  • Step 3

    The trace holds five nested call frames.

  • Step 3

    Three of them are signature checks.

  • Step 4

    One nested frame is a delegatecall to 0x9622…7242.

  • Step 4

    The function selector on that call is 0xa9059cbb.

  • Step 6

    The wallet's balance is 0 ETH.

  • Step 6

    Verification-registry metadata points its logic at 0xbDd0…9516, named Sweeper.

What others have reported5

  • Step 1

    $1.5B left one Bybit wallet on February 21, 2025.Public reporting

  • Step 2

    The signing interface had been tampered with, so the signers saw a different transaction from the one they approved.Sygnia and Verichains incident reports

  • Step 5

    401,347 ETH left, along with stETH, cmETH and mETH, split across roughly 40 wallets.Public technical reporting (CertiK incident analysis)

  • Step 7

    ZachXBT submitted an attribution to the Lazarus Group 4 hours 56 minutes after the theft, at 19:09 UTC.ZachXBT, via public reporting

  • Step 7

    The FBI attributed the theft to North Korea on February 26, 2025.FBI public service announcement I-022625-PSA

Keep going

The ideas behind this case, and what to read next.

Docs · 5 minHow to read a transaction

What each field means, which ones matter first, and the order to read them in.

Docs · 4 minAddresses, wallets and contracts

The three words people mix up most, and why the difference decides what a record can prove.

Docs · 4 minWhat on-chain data cannot tell you

The limits that hold no matter how good the tooling is.

Case · Ethereum · BridgeSingularityNET: Bridge Drain and Token Mints

8.72M FET, drained from the SingularityNET bridge.

Case · Ethereum · ExchangeBitget: Exchange Wallet Drain

$387.5M, left Bitget in under three hours.

Share and cite

Take the case with you.

The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.

FORENSIA

Web3 forensics that shows its sources. Read-only, public evidence, and a clear line where the proof ends.

Contact us

Leave your name and email and the Forensia team will write back.

How we handle your emailOr email us directly

By selecting Contact me you agree that Forensia may email you at this address about your enquiry. You can withdraw anytime. Name, email and consent are kept for up to 90 days, separately from investigations. No searched address is included in this submission.