OneKey Founder Yishi Wang: The Root of Bybit Theft Lies in Safe Frontend
Yishi Wang, founder of hardware wallet manufacturer OneKey, stated in an interview with Binance that the key vulnerability in the largest cryptocurrency hack in history, which resulted in approximately $1.5 billion in assets being stolen from Bybit in February 2025, was not in the Safe multi-signature contract itself, the cold wallet architecture, or Ledger hardware devices, but rather in the engineering aspect of the Safe official frontend website. The attacker used social engineering to compromise a Safe frontend engineer's device and implanted malicious code that only activated for Bybit addresses on the official website frontend.
According to technical reviews from multiple security agencies, the malicious code was implanted on February 19, 2025, in the AWS S3 storage bucket and frontend resource files used by Safe{Wallet}. The attack was triggered on February 21, 2025, when Bybit executed a multi-signature transfer; the malicious script was precisely designed to activate only when detecting Bybit's multi-signature cold wallet address (and a test address). Approximately two minutes after the attack was executed, the attacker proactively cleared the malicious code from AWS S3 to eliminate traces.
The transactions altered by the malicious script set the operation type to "delegatecall" (instead of a regular "call"), directing the transfer to a contract address (0x9622...7242) pre-deployed by the attacker. This contract disguised itself as a normal transfer() function, but actually executed an operation that modified the storage slot of Bybit's multi-signature proxy contract at position 0 (i.e., pointing to the masterCopy variable of the implementation contract), thereby completely taking over the wallet permissions and all assets within a single transaction.
The malicious frontend code operated in two steps—first secretly saving a copy of the original transaction data, then submitting the altered malicious parameters for signing by the signers. After signing was completed, the original data was "replaced" back into the displayed content, retaining only the valid signature corresponding to the altered transaction. This meant that the four multi-signature signers at Bybit always saw what appeared to be normal transfer details on the Safe web interface, but the hardware wallet (Ledger) displayed the undecoded EIP-712 raw encoded information. The device itself had no capability to recognize and indicate that this was a delegatecall operation, leading the signers to complete a "blind signature" without truly understanding the transaction content.
Wang emphasized that relying solely on the hardware wallet itself cannot solve the issues exposed by this type of attack. The real gap lies in the potential systemic deviation between "what users see before signing" and "what is actually executed on-chain." He believes that as institutional fund custody increasingly relies on multi-signature systems and browser-based operation panels, tools for transaction parameter parsing, address verification, and transaction simulation will become indispensable security measures to prevent frontend tampering attacks.
From the perspective of fund flow and accountability, the FBI has attributed this attack to the North Korean hacker group Lazarus Group (TraderTraitor). This incident is a typical targeted attack rather than a spontaneous market behavior, with assets being transferred out of Bybit's control after being stolen, now in the hands of the attackers. The affected parties are Bybit and its users, while hardware wallet manufacturers like OneKey have used this incident to reinforce narratives around "transaction readability, address verification, and on-chain simulation," driving market demand for paid security tools for multi-signature infrastructure.
Public information shows that OneKey recently completed a $150 million Series B financing led by YZi Labs (formerly Binance Labs), marking the largest investment by YZi Labs in the hardware wallet sector to date, with follow-on investments from existing shareholders Dragonfly, Ribbit Capital, and Coinbase Ventures. OneKey currently has a team of about 60 people, and its products have established partnerships with exchanges such as Binance, OKX, Bybit, and Bitget. User custody assets have grown 11 times over three years, and hardware wallet sales have increased at an annual rate of 300%.
ABAB AI Insight
OneKey's historical behavior path has been to insist on fully open-sourcing its hardware wallet code and continuously providing security-related content and judgments. This response to the Bybit incident continues that positioning. More noteworthy is the historical behavior of Safe{Wallet} and Bybit themselves—the attack did not exploit a vulnerability in the smart contract code but rather gained continuous deployment permissions through a social engineering attack on a frontend engineer's device. This type of "attacking the developer rather than the code" path is highly similar to previous DeFi supply chain attacks (such as NPM package poisoning, developer computers being implanted with malware), indicating that the attack surface in the cryptocurrency industry is shifting from on-chain contracts to off-chain people and infrastructure.
In terms of funding and resource mobilization, the North Korean Lazarus Group did not directly attack the multi-signature contract code worth billions of dollars but instead precisely targeted a lower-cost, easier-to-access aspect—a single engineer's terminal device. This represents a typical "cost-effectiveness" calculation for attacks: contract code is audited and tightly protected, while the personal device security level of a frontend engineer is far lower. Resources naturally flow to the weakest defensive link. After the incident, funds flowed back into the security solutions sector, allowing OneKey to complete a $150 million valuation financing led by YZi Labs, with existing shareholders following suit, which in some ways is the industry paying for the security capabilities needed after this incident.
A comparable historical case is the 2020 Twitter mass account hijacking incident—attackers similarly did not breach Twitter's core code system but obtained internal employee backend permissions through social engineering, then used that access to carry out large-scale fraudulent operations. The essence of the Bybit incident is the same, except this time the "internal permissions" became the frontend code deployment rights continuously deployed to millions of users' browsers. In terms of industry positioning, multi-signature wallet and hardware wallet manufacturers are currently transitioning from "protecting the private key itself" to "protecting users' understanding of transaction content," as the industry begins to realize that private key security is no longer the only attack surface.
This fundamentally reflects a change in regulation/industry standards—the security consensus in the cryptocurrency industry is shifting from a single dimension of "whether contract code has been audited" to requiring that the entire chain (frontend display, hardware decoding, transaction simulation) must guarantee the integrity of "what you see is what you sign." This change is occurring because underlying operations like delegatecall allow an apparently ordinary transaction to fundamentally alter the implementation logic and permission ownership of a contract. As long as there is a tamperable gap between the display layer and the execution layer, even the most thorough contract audits and the most expensive cold wallet architectures become meaningless. The industry is thus forced to extend security responsibility from merely "key management" to every link in the entire information chain.