Bybit $1.5B theft through a Safe{Wallet} developer machine

What happened

• 21 Feb 2025. A Safe developer’s macOS machine was compromised (TraderTraitor / Lazarus), and the AWS session was used to modify Safe’s S3-hosted front-end JavaScript.
• The FBI attributed it to North Korea. The largest crypto theft ever recorded.

Sources

• https://www.ic3.gov/PSA/2025/PSA250226
• https://x.com/safe/status/1897663514975649938

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.