It appears to be a highly advanced assault on the Dubai-based platform Bybit:

Bybit representatives revealed the theft of over 400,000 ethereum and staked ethereum tokens mere hours after it occurred. The alert indicated that the digital assets were held in a “Multisig Cold Wallet” when, for some reason, they were transferred to one of the exchange’s hot wallets. From that point, the cryptocurrency was moved out of Bybit completely and into wallets managed by the unidentified intruders.

[…]

…an ensuing inquiry by Safe detected no indications of unauthorized infiltration of its systems, no breaches of other Safe wallets, and no clear weaknesses in the Safe codebase. As the investigators continued to probe, they ultimately identified the real cause. Bybit eventually stated that the deceitful transaction was “engineered by a sophisticated attack that modified the smart contract logic and concealed the signing interface, allowing the attacker to seize control of the ETH Cold Wallet.”

The statement on the Bybit site is nearly absurd. Here’s the headline: “Incident Update: Unauthorized Activity Involving ETH Cold Wallet.”

Learn more:

This breach establishes a new standard in cryptocurrency security by circumventing a multisig cold wallet without taking advantage of any smart contract flaw. Instead, it leveraged human trust and interface deception:

• Multisigs no longer serve as a security assurance if signers can be compromised.
• Cold wallets aren’t inherently secure if an attacker can manipulate what a signer perceives.
• Supply chain and interface manipulation attacks are evolving to become more sophisticated.

The Bybit breach has shattered long-held beliefs regarding cryptocurrency security. Regardless of how robust your smart contract logic or multisig safeguards are, the human factor remains the most vulnerable link. This incident demonstrates that interface manipulation and social engineering can circumvent even the most secure wallets. The sector must transition to an end-to-end prevention approach; each transaction must undergo validation.