# Bybit Safe cold wallet masterCopy swap via phishing drains $1.5B

Phishing of Bybit Safe multisig signers led to a malicious delegatecall that replaced the cold wallet's masterCopy with a backdoor, draining ~$1.5B.

- Payout: Real-world hack
- Severity: critical
- Program: Bybit
- Credited: DeFiHackLabs
- Disclosed: 2025-02-21
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/Bybit_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250221-bybit
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:misconfiguration vuln:signature-replay

**Target:** Safe (Gnosis Safe) 1.1.1 multisig proxy cold wallet
**Root cause:** Safe signers were phished into signing a delegatecall to an attacker 'Trojan' contract whose transfer() overwrote slot 0 (masterCopy) with a backdoor contract; the Safe proxy then delegated all calls to the backdoor, which exposed sweepETH/sweepERC20.
**Steps:**
1. Phish Safe signers into signing execTransaction(trojan, 0, transfer(backdoor,0), DelegateCall, ...) with a valid threshold signature.
2. Trojan.transfer() executes in the Safe's storage context and writes backdoor address into slot 0 (masterCopy).
3. Subsequent calls to the Safe proxy delegate to the backdoor contract.
4. Call backdoor.sweepETH(attacker) and sweepERC20(token, attacker) for each held asset (ETH, mETH, cmETH, stETH).
**How found:** Post-mortem analysis (ZachXBT, SlowMist) traced the signed delegatecall payload and the Trojan/backdoor contracts; the PoC reconstructs the masterCopy overwrite by reading slot 0 before and after.
**Exploitation:** Attacker obtained signatures from Bybit's Safe signers via a phishing UI that displayed a benign-looking transaction while the payload was a DelegateCall to the Trojan contract. The Trojan overwrote the Safe's masterCopy slot to the backdoor, granting the attacker sweep functions to transfer 401,346 ETH, 8,000 mETH, 15,000 cmETH and 90,375 stETH to the attacker address.
**Insight:** Safe 1.1.1 proxies store masterCopy in slot 0; any signed DelegateCall to attacker code can rewrite it. When auditing multisig ops, treat any DelegateCall target as able to fully hijack the wallet's implementation, and check whether signer UIs render the actual to/data/operation rather than a spoofed summary.