$BTC Summary of the causes behind three exchange hacks (in none of these cases were private keys directly stolen; all involved deception or intrusion into the signing approval process)
1. Bybit (2025-02, approximately $1.46 billion lost, Ethereum multisig cold wallet)
✅ Key point: The multisig wallet’s frontend interface was tampered with
Hackers compromised a developer’s computer at Gnosis Safe, the multisig wallet service provider, and injected malicious JavaScript code.
When Bybit employees were making routine fund transfers from the cold wallet, the screen UI showed a normal transfer. But the actual transaction data behind the scenes had been secretly altered: instead of transferring funds, the signature transferred control of the entire multisig wallet to a contract controlled by the hackers.
The signers signed using hardware wallets. By the time they discovered what had happened, all the assets in the cold wallet had been transferred out.
Key takeaway: The cold wallet’s private keys themselves were not leaked. People were deceived by the interface into signing a malicious transaction. The FBI attributed the attack to North Korea’s Lazarus (TraderTraitor) hacking group.
2. Bitget (2026-09, approximately $387 million lost, hot and warm wallets)
✅ Key point: A supply-chain vulnerability in third-party security software
Hackers exploited a zero-day vulnerability in a third-party security component purchased by Bitget to break into the exchange’s internal network and obtain high-privilege backend credentials.
They then forged fake withdrawal instructions and tricked the platform’s internal risk-control approval system, causing the exchange’s internal signing system to automatically approve the hackers’ withdrawal transactions.
The cold wallets were untouched, and no private keys were leaked. The hackers had only taken control of the backend approval pipeline, enabling them to move assets in bulk from hot wallets across multiple chains.
3. Binance (2026-10, approximately $6.3 billion lost, multi-chain hot wallets; preliminary investigation findings, full report not yet released)
✅ Key point: A DevOps engineer’s laptop was compromised + the EIP-7702 contract delegation mechanism
Entry point: Hackers compromised a DevOps engineer’s laptop, gained access to internal service containers, and were able to submit withdrawal transaction requests.
On-chain method: They used Ethereum’s new EIP-7702 feature to delegate authorization from Binance’s hot wallets to a sweeping contract deployed by the hackers.
There was no need to steal private keys; the wallets themselves authorized the hackers’ contract to automatically transfer out all the assets.
The cold wallets remained intact; only hot wallets were affected. The same North Korean hacking group is also strongly suspected.
✍✍✍✍
1. Bybit (2025-02, approximately $1.46 billion lost, Ethereum multisig cold wallet)
✅ Key point: The multisig wallet’s frontend interface was tampered with
Hackers compromised a developer’s computer at Gnosis Safe, the multisig wallet service provider, and injected malicious JavaScript code.
When Bybit employees were making routine fund transfers from the cold wallet, the screen UI showed a normal transfer. But the actual transaction data behind the scenes had been secretly altered: instead of transferring funds, the signature transferred control of the entire multisig wallet to a contract controlled by the hackers.
The signers signed using hardware wallets. By the time they discovered what had happened, all the assets in the cold wallet had been transferred out.
Key takeaway: The cold wallet’s private keys themselves were not leaked. People were deceived by the interface into signing a malicious transaction. The FBI attributed the attack to North Korea’s Lazarus (TraderTraitor) hacking group.
2. Bitget (2026-09, approximately $387 million lost, hot and warm wallets)
✅ Key point: A supply-chain vulnerability in third-party security software
Hackers exploited a zero-day vulnerability in a third-party security component purchased by Bitget to break into the exchange’s internal network and obtain high-privilege backend credentials.
They then forged fake withdrawal instructions and tricked the platform’s internal risk-control approval system, causing the exchange’s internal signing system to automatically approve the hackers’ withdrawal transactions.
The cold wallets were untouched, and no private keys were leaked. The hackers had only taken control of the backend approval pipeline, enabling them to move assets in bulk from hot wallets across multiple chains.
3. Binance (2026-10, approximately $6.3 billion lost, multi-chain hot wallets; preliminary investigation findings, full report not yet released)
✅ Key point: A DevOps engineer’s laptop was compromised + the EIP-7702 contract delegation mechanism
Entry point: Hackers compromised a DevOps engineer’s laptop, gained access to internal service containers, and were able to submit withdrawal transaction requests.
On-chain method: They used Ethereum’s new EIP-7702 feature to delegate authorization from Binance’s hot wallets to a sweeping contract deployed by the hackers.
There was no need to steal private keys; the wallets themselves authorized the hackers’ contract to automatically transfer out all the assets.
The cold wallets remained intact; only hot wallets were affected. The same North Korean hacking group is also strongly suspected.
✍✍✍✍