Wallet Frontend Security: Signing Interfaces After Bybit

Updated November 2026 6 min read

Quick answer. Attackers compromise a wallet frontend by changing its JavaScript via the hosting bucket or CDN, the build pipeline or a developer machine. Harden all three, add SRI and a strict CSP, and verify every transaction on the signer.

Watch: Wallet Frontend Security: Signing Interfaces After Bybit 1:41

Video transcript

The largest theft in crypto history did not break a smart contract. It changed what honest signers saw on screen, and they approved it.

On or about February 21, 2025, roughly 1.5 billion dollars was stolen from a Bybit multisig cold wallet. The FBI attributed it to North Korea.

Forensics found malicious JavaScript in Safe Wallet's AWS bucket, built to activate only for Bybit. Safe's contracts were unaffected. A developer machine was compromised.

A signing interface can be altered anywhere between source code and browser. Through the hosting bucket or CDN, the build pipeline, a developer endpoint, a third-party script, or a malicious dependency.

Each path has a control. Lock down buckets and alert on changes. Sign build provenance and pin CI actions. Protect developer logins. Add Subresource Integrity and a strict Content Security Policy.

Still, a web page cannot be the source of truth. Use typed signing with E I P 712, clear-sign on a hardware wallet, and compute the transaction hash on a separate machine. Treat any delegatecall as dangerous.

Guardian's offchain team, led by Carlos Polop, creator of HackTricks, pentests the whole path to a signature: the web app, the cloud and build pipeline, and the SDKs. Managed Security reviews multisig transactions before signing.

A contract audit will not catch this. Read the full guide, or talk to Guardian at guardian.security.

Wallet frontend security stopped being a nice-to-have on February 21, 2025.

The largest theft in crypto history did not break a smart contract. It changed what honest signers saw on screen, and they approved it.

This guide covers where signing interfaces get compromised, and the controls that close each path.

What happened at Bybit

On or about February 21, 2025, roughly $1.5 billion in virtual assets was stolen from a Bybit Ethereum multisig cold wallet.

In a public service announcement on February 26, 2025, the FBI attributed the theft to North Korea, activity it tracks as TraderTraitor.

Bybit’s own timeline put the loss at about $1.46 billion from a single cold wallet: 401,347 ETH, 90,375 stETH, 15,000 cmETH and 8,000 mETH.

The mechanism was the signing interface, not the chain.

Safe said that, according to Bybit, the Safe{Wallet} UI displayed correct-appearing transaction information, yet a malicious transaction with all valid signatures was executed onchain.

Forensic reviews commissioned by Bybit, from Sygnia and Verichains, found malicious JavaScript injected into app.safe.global and served from Safe{Wallet}’s AWS S3 bucket.

The code was designed to activate only for Bybit. Clean versions were uploaded about two minutes after the malicious transaction executed.

Safe said its smart contracts were unaffected and that the attack came through a compromised Safe{Wallet} developer machine.

In a March 2025 update, after a forensic investigation with Mandiant, Safe described the compromise of a developer’s laptop and the hijacking of AWS session tokens to bypass multi-factor authentication.

The Hacker News reported that the laptop was breached on February 4, 2025, through a Docker project the developer had downloaded.

The lesson is structural: a correct contract signed through a compromised interface still drains.

Guardian made the same point when it launched Vanguard: of the ten largest losses of 2026, $769M in total, $729M was offchain. See onchain vs offchain crypto hacks.

Where signing UIs get compromised

A signing interface can be altered anywhere between the source code and the browser. Each layer is a place to attack and a place to defend.

Layer	What goes wrong
Hosting (bucket / CDN)	Write access to the bucket or CDN lets an attacker swap a script.
Build pipeline	A compromised CI job, dependency or publish step ships a tampered artifact.
Developer endpoint	A phished or infected machine yields the credentials to push to any layer.
Third-party script	An analytics tag, widget or embedded SDK becomes a channel for injected code.
Dependency / SDK	A malicious release reaches every app that installs it (Ledger Connect Kit, 2023).

Harden the hosting

If the app is served from object storage behind a CDN, the bucket is a production system and is secured like one.

Least-privilege IAM. Separate who can read, deploy and change bucket policy. No single over-broad key should be able to overwrite the live site.
Versioning and Object Lock. Versioning makes a swap recoverable. Consider S3 Object Lock in compliance mode to preserve evidence and a clean rollback point.
Know its limit. Object Lock does not stop a new version being written over the same key. Tight write permissions stop the swap.
Origin lock-down. Serve only through the CDN with origin access control, deny public writes, and guard the CDN console like the bucket.
Change detection. Alert on any modification to the deployed assets.

At Bybit, the malicious code was modified two days before the theft and replaced with clean versions minutes after it. An alert on any change to the live bundle is the kind of signal that catches that window.

Build pipeline and developer machines

The pipeline and the laptops that drive it are the highest-value targets. They can sign off on tampered code as if it were legitimate.

Provenance (SLSA Build L2). Aim for a hosted build platform that signs provenance.
Hardened builds (Build L3). One run cannot influence another, and signing material stays away from user-defined build steps.
Pin CI actions. Pin third-party actions to a full-length commit hash, not a moving tag.
Scope CI tokens. Grant build tokens the minimum permissions and raise them per job.
Untrusted inputs. Pass them through environment variables, never interpolated into shell scripts.
Short-lived credentials. Use workload identity federation (OpenID Connect) instead of long-lived cloud keys stored as secrets.
Developer machines. Phishing-resistant authentication, short session-token lifetimes, device posture checks, and caution with untrusted projects and dependencies on build machines.

SRI, CSP and reproducible builds

These controls make a swapped file fail loudly instead of running silently.

Subresource Integrity (SRI). The integrity attribute pins a sha256, sha384 or sha512 hash on each script and stylesheet. The browser refuses any that do not match.
Cross-origin files. These also need a crossorigin attribute and CORS.
SRI’s limit. It covers the resources it names, not the top-level document. It is a layer, not the whole answer.
Content Security Policy. A strict policy such as script-src 'self' limits where scripts come from and blocks inline injection.
Integrity-Policy. This newer header can require that script requests carry integrity metadata at all.
Reproducible builds. If anyone can rebuild byte for byte, you can confirm the deployment matches the source.
Pinned dependencies. Lock versions and verify integrity hashes, so a compromised release does not walk into the next build.

Verify on the signer, not the screen

The deepest lesson of Bybit: a web interface cannot be the source of truth for what gets signed.

Typed signing. Use EIP-712 for structured, readable data, with a domain separator binding the signature to a contract and chain.
Clear-sign on hardware. The device, not the browser, decodes and shows the real transaction.
Independent hash check. For a multisig, compute the transaction hash from the raw parameters on a separate, trusted machine. Compare it to the device.
Offline tooling. Open tooling exists to compute a Safe transaction hash offline for exactly this comparison.
Treat delegatecall as dangerous. It can change contract behavior. Refuse one you cannot fully account for.

How Guardian covers the frontend

Guardian’s offchain security department is led by Carlos Polop, creator of HackTricks and the PEASS privilege escalation suite.

Its offchain pentests cover the whole path to a signature:

Web application testing of the signing interface and its backend
Cloud and infrastructure testing of buckets, CDNs, CI pipelines and vendor consoles
SDK audits of the libraries integrators install

For LayerZero’s OneSig, Guardian pentested the Electron desktop signer, attacking the client itself rather than assuming the signer sees what they approve.

It returned 82 findings, including seven Highs.

For USDT0, it pentested the web properties, reviewed Gasolina, the offchain signer and relayer service, and reviewed the full client stack.

Managed Security keeps this watched continuously. It maintains the threat model in real time, reviews every multisig transaction before it is signed, and watches the offchain surface around the clock.

Mapping this for the first time? A system review call is the fastest way to find where your signing path is exposed. See also crypto wallet pentesting.

Frequently Asked Questions

What happened in the Bybit hack?

On or about February 21, 2025, about $1.5 billion was stolen from a Bybit multisig cold wallet. The FBI attributed it to North Korea. Forensic reviews found malicious JavaScript in Safe{Wallet}’s infrastructure that showed signers a correct-looking transaction.

What is Subresource Integrity and does it stop this?

It pins a cryptographic hash on each script and stylesheet, so the browser refuses a file that does not match. It covers only those resources, not the top-level document. Use it with a strict CSP, reproducible builds and hardened hosting.

How should signers verify a transaction independently?

Do not trust the interface. Use EIP-712 typed signing, clear-sign on a hardware wallet, and compute the transaction hash from the raw parameters on a separate machine, then compare it to the device. Refuse any delegatecall you cannot account for.

Can a smart contract audit catch a frontend compromise?

No. A contract audit reviews onchain code. A frontend compromise lives in the web app, hosting, build pipeline and developer endpoints, which need web app and infrastructure pentesting, SDK review, and controls over who can publish the interface.

Sources

Cover the path to your signature

Guardian pentests the signing interface, its hosting, its build pipeline and the SDKs behind it, the offchain surface the Bybit theft exploited.

Talk to Guardian Explore audits and pentests