The largest theft in the history of the asset class, and the contract was not broken. Attackers compromised a Safe{Wallet} developer's machine and pushed a tampered JavaScript bundle to the S3 bucket that served the signing interface. Bybit's signers saw a routine 30,000 ETH transfer on screen; the payload actually handed to their hardware wallets was a delegatecall into an unverified contract deployed three days earlier. Three people approved it. In a Safe, storage slot 0 is masterCopy — one SSTORE through a delegatecall replaces the wallet's entire implementation.
// operation = 0 → CALL value leaves the wallet, wallet storage untouched // operation = 1 → DELEGATECALL the target's code runs AS the wallet, on its storage execTransaction( to: 0x9622…7242, // unverified, deployed 3 days before value: 0, data: transfer(address,uint256), // reads harmless in the UI operation: 1 // ← DELEGATECALL ) // Safe storage layout: slot 0 == masterCopy (the implementation address) // The delegated code writes slot 0. The wallet is now the attacker's contract. → result: 401,000 ETH swept in the following transactions
operation = 1 reach a non-allowlisted target is a single-click total loss. Signers must verify the raw hash on the hardware device — never trust what the browser draws.Entries in the SAFE database that describe this failure. These share its failure class.
Every figure on this page comes from the post-mortems above, not from us. Losses are US dollars at the time of the incident.
Access control is one of the 203 classes the SaferICO scanner checks for. It will not review your signing process — but it will read your Solidity.