Most Safe signers treat the hash on their hardware wallet as the final check. It isn’t.
That single misunderstanding is how $1.5 billion left Bybit in February 2025 and it’s still how most multisig transactions get approved today.
The gap almost nobody talks about
Your Ledger or Trezor shows you a hash before every signature.
That hash only answers one question: “Has this transaction been altered since it was created?”
It does not answer the more important question:
What does this transaction actually do?
Those are two completely different checks.
Most people only perform the first one.
What actually happened at Bybit
The transaction that drained Bybit looked routine.
Signers saw a clean hash.
Their hardware wallets confirmed it matched.
What the hash did not reveal was that the transaction contained a delegatecall that rewrote the Safe’s own implementation.
Once enough signatures were collected, control was gone and the funds followed.
The hash was correct.
The intention was not.
This is the exact failure mode that keeps repeating across large multisigs.
How a Safe transaction hash is actually built
A Safe transaction hash is not a simple fingerprint of the whole thing. It is the combination of two separate hashes:
Domain hash — which Safe and which chainMessage hash — the destination, the value, and the exact calldata
Your hardware wallet only shows you the final combined result.
If either half is wrong, the hash changes. That is why it works as an integrity check.
But if the transaction is malicious by design, the hash will still be correct.
Integrity and safety are not the same thing.
What proper verification looks like
Before any signature, the transaction should be independently decoded.
You need to see:
The exact destination contractThe native value being sentThe decoded function call (or the selector if full decoding fails)How many confirmations already existWhether your signature will be the final one that executes the transaction
Here is a real pending transaction examined during testing:
Nonce 10
Already collected 1 of 2 required signatures
Destination: a specific contract
Value: 0
Call: renounceOwnership
In plain language, this transaction permanently removes ownership of that contract.
There is no undo. There is no recovery path.
The hash verified cleanly.
The risk was still flagged as Medium because the full arguments could not be decoded and required manual review.
A matching hash and an unclear call are two separate signals.
Either one is a valid reason to stop.
The questions that actually matter
Before you sign, these are the only questions worth asking:
What does this call actually do?Am I the final signature required?Is this action permanent or reversible?Is the target contract the one I believe it is?
If any of those answers are unclear, the correct action is to stop.
Why this has to become routine
Most people only slow down for large or unusual transactions.
That is the wrong approach.
The process should be identical whether the transaction moves ten dollars or ten million.
The day the check saves you is almost never the day you expected it to.
Especially dangerous are transactions that already have one confirmation out of two.
In that state, your signature does not just add to a pending list, it executes the transaction.
That is the moment the verification actually counts.
The quiet pattern behind most multisig losses
Looking across major incidents, a consistent pattern appears:
The hash was correctThe hardware wallet showed no warningThe decoded intention was never independently checkedOne or more signers assumed “hash matches = safe to sign”
That assumption is still widespread.
It is also still expensive.
Final note
A matching hash is necessary.
It is not sufficient.
The difference between those two statements is the difference between a normal day and a permanent loss.
Treat every signature as if it could be the final one, because one day it will be.
Full breakdown with the exact verification steps here: how-to-verify-safe-transaction-before-signing
Why a Perfect Hash Still Cost Bybit $1.5 Billion was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.