How a Compromised Laptop and One YAML Function Enabled Crypto's Largest Heist

The theft of $1.4 billion from Bybit's Safe multisig wallet, the largest crypto heist on record, did not require a zero-day exploit or any exotic technical breakthrough. Investigators have attributed the attack to TraderTraitor, a North Korean hacking unit operating within the broader Lazarus Group, which social-engineered a Safe developer into running a malicious Docker project and used the resulting foothold to compromise the wallet infrastructure trusted by the industry as a security benchmark.

Credit: Safe, Ben Zhou, Lukas Schor, Verichains, Sygnia, koeppelmann, Banteg, Andrew Mohawk

Disclosure timeline: On Wednesday, February 26th, Bybit CEO Ben Zhou disclosed findings that reframed the entire incident. Two independent forensic reports, from Sygnia and Verichains, established that this was not a breach of Bybit's own systems. Earlier reporting had pointed to Safe's infrastructure as the likely vector, shifting scrutiny away from Bybit and toward a compromised component within Safe itself.

By March 6th, Safe's own investigation, carried out jointly with Mandiant, confirmed this account and added further detail about how sophisticated the operation had been. The entry point was a compromised developer machine belonging to Safe{Wallet} staff, which TraderTraitor used as a launching point into the platform. Mandiant's timeline describes a 19-day operation engineered specifically to infect the interface used by Bybit's signers.

The mechanism: Attackers inserted malicious JavaScript into the Safe{Wallet} website, configured to activate only for Bybit's cold wallet signers — leaving every other Safe user unaffected and unaware. When Bybit's signers initiated what appeared to be a routine transfer, the injected code swapped the legitimate transaction for a delegate call to the attacker's contract, handing control of the wallet to the attackers in a single signed action. Verichains described it as JavaScript "designed to activate only when certain conditions were met," specifically targeting Bybit.

Mandiant's investigation found that the compromise stemmed from a Safe developer's laptop being breached, which allowed the attackers to hijack active AWS session tokens and bypass multi-factor authentication — collapsing what was meant to be a distributed security model into a single point of failure.

Timeline of the operation, per Mandiant's forensic findings:

• February 2, 2025: The attackers registered the domain getstockprice[.]com via Namecheap — one of several domains later tied to the operation.
• February 4, 2025: A Safe developer's (referred to as Developer1) MacOS workstation was compromised after they were socially engineered into running a Docker project called MC-Based-Stock-Invest-Simulator-main. The payload connected back to the newly registered domain, giving TraderTraitor its initial foothold. Mandiant noted that "similar stock-themed Docker projects have been utilized by UNC4899 in previous heist investigations," indicating this was a repeated tactic by the group.
• February 5, 2025: Within roughly a day of gaining access, the attackers attempted to register their own MFA device inside Safe's AWS environment — an attempt that failed. They pivoted instead to hijacking Developer1's existing, active AWS session tokens directly from the infected laptop, timing their activity to coincide with the developer's normal work hours to avoid detection.
• February 5–17, 2025: Over roughly twelve days, the attackers conducted reconnaissance inside Safe's AWS environment undetected.
• February 19, 2025: Malicious JavaScript was injected into Safe's website. The change was captured in a Wayback Machine snapshot taken two days before the funds were moved (the snapshot itself was not included in the published report).
• February 21, 2025, 14:13:35 UTC: Bybit's signers executed the compromised transaction, unknowingly transferring control of the wallet's assets.
• February 21, 2025, 14:15:13 UTC: Ninety-eight seconds later, the malicious code was already being removed from the site.

Two minutes after the exploit transaction was published, new JavaScript files with the malicious code stripped out were uploaded to Safe{Wallet}'s AWS S3 bucket, according to Sygnia's report. Had the Wayback Machine not archived the site beforehand, this evidence trail might not have survived.

The underlying vulnerability: At the center of the exploit sat a well-known weakness in the yaml.load function from PyYAML. The function was originally built to parse YAML data but, without additional safeguards, will deserialize untrusted input in a way that permits arbitrary code execution. The specific line involved was data = yaml.load(response.text, Loader=yaml.Loader). As developer Banteg put it, "you are one yaml.load away from losing everything." The underlying issue in PyYAML has been documented for years. Shortly after the incident, Banteg opened a pull request against PyYAML to remove the insecure "Loader" alias that enabled the attack.

Aftermath: Safe announced that its full stack — all supported networks and the Safe API — has been restored and is operating normally. The precise means by which the individual Safe employee's machine was initially compromised remains under investigation. Security researcher Andrew Mohawk noted the silver lining wryly: "Never let a good crisis go to waste. If you couldn't get security tickets prioritized, now is the time!"

The episode underscores that the failure here was not cryptographic. Smart contracts, multisig thresholds, and hardware wallets all performed exactly as designed — the compromise occurred at the level of the front-end interface feeding transaction data to signers. A single infected developer laptop, one exploited YAML deserialization pattern, and a targeted supply-chain-style injection were enough to move $1.4 billion, more than double the previous record for a crypto theft, out of what had been considered the industry's most trusted custody standard for a decade.