Curriculum·G206 Running a Security Review for a Small Team·about 31 min
Blind signing, and verifying the payload
By the end of this lesson you can
- →Define blind signing: authorizing a transaction whose real effect the signer cannot read or verify
- →Explain how Bybit lost about 1.4 billion dollars when signers blind-signed a disguised change of their wallet's logic
- →Compute why an opaque hash on a device offers no protection that a signer can actually use
- →Establish a rule against signing what cannot be decoded and verified against a stated intent
Graduate · enrolled learners
This lesson opens with Bybit, 21 February 2025.
- What happened
- Bybit is a large cryptocurrency exchange. On 21 February 2025 about 1.4 billion dollars was taken from a cold wallet, the largest theft in the industry's history. The wallet was a Gnosis Safe multisig, and its signers used hardware wallets. The attacker, attributed to the North Korea-aligned Lazarus group, had compromised the Safe interface so that the signers saw what looked like a routine transfer, while the transaction they actually authorized executed a delegatecall that replaced the Safe's logic with an attacker-controlled contract, handing over the wallet. Crucially, the signers were blind signing: their devices presented the transaction as an opaque hash rather than a decoded, human-readable action, so even a careful signer looking at the device had nothing to compare against their intent. They approved data they could not read, and the data did not do what the screen claimed.
- The decision point
- The last lesson's fix, verify the payload on the device, assumes the device shows a payload a human can verify. Bybit is the case where it did not: the signers were blind signing, approving a hash, and a hash tells a signer nothing about what the transaction does. Blind signing is authorizing an effect you cannot read, and it converts a hardware wallet from a verification tool into a rubber stamp, because the one thing the signer could check, does this match my intent, is exactly what an opaque hash denies them. The discipline is to refuse it: to sign only what can be decoded into a human-readable action and checked against a written intent, and to treat a transaction that can only be blind-signed as one that cannot be safely signed at all. A billion-dollar wallet approved on a hash is a billion dollars approved on trust in a screen.
- Recorded loss
- $1,400,000,000
What you will be able to answer
- →What is blind signing?
- →How was the Bybit cold wallet taken?
- →Why does an opaque hash give no usable protection?
- →What is the discipline against blind signing?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://rekt.news/bybit-rekt/
- https://www.elliptic.co/blog/bybit-hack-largest-in-history
- https://www.ledger.com/academy/topics/ledgersolutions/what-is-clear-signing
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The Bybit loss is reported at about 1.4 to 1.5 billion dollars, the largest crypto theft on record; the exact figure depends on asset prices at the time. The compromise of the Safe interface and the delegatecall that changed the wallet's implementation are documented in multiple investigations.
The precise degree to which each signer relied on blind signing versus a spoofed decoded display was analyzed after the incident; this lesson uses the well-supported point that the signers could not verify the true effect against their intent.