{"id":209540,"date":"2026-08-06T07:40:05","date_gmt":"2026-08-06T07:40:05","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=209540"},"modified":"2026-08-06T07:40:05","modified_gmt":"2026-08-06T07:40:05","slug":"why-a-perfect-hash-still-cost-bybit-1-5-billion","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=209540","title":{"rendered":"Why a Perfect Hash Still Cost Bybit $1.5 Billion"},"content":{"rendered":"

Most Safe signers treat the hash on their hardware wallet as the final check. It\u00a0isn\u2019t.<\/em><\/strong><\/p>\n

That single misunderstanding is how $1.5 billion left Bybit in February 2025 and it\u2019s still how most multisig transactions get approved\u00a0today.<\/p>\n

The gap almost nobody talks\u00a0about<\/h3>\n

Your Ledger or Trezor shows you a hash before every signature.
That hash only answers one question: \u201cHas this transaction been altered since it was created?\u201d<\/p>\n

It does not answer the more important question:
What does this transaction actually\u00a0do?<\/em><\/strong><\/p>\n

Those are two completely different checks.
Most people only perform the first\u00a0one.<\/p>\n

What actually happened at\u00a0Bybit<\/h3>\n

The transaction that drained Bybit looked routine.
Signers saw a clean hash.
Their hardware wallets confirmed it\u00a0matched.<\/p>\n

What the hash did not reveal was that the transaction contained a delegatecall that rewrote the Safe\u2019s own implementation.
Once enough signatures were collected, control was gone and the funds followed.<\/p>\n

The hash was correct.
The intention was\u00a0not.<\/p>\n

This is the exact failure mode that keeps repeating across large multisigs.<\/p>\n

How a Safe transaction hash is actually\u00a0built<\/h3>\n

A Safe transaction hash is not a simple fingerprint of the whole thing<\/em>. It is the combination of two separate\u00a0hashes:<\/p>\n

Domain hash<\/strong>\u200a\u2014\u200awhich Safe and which\u00a0chainMessage hash<\/strong>\u200a\u2014\u200athe destination, the value, and the exact\u00a0calldata<\/p>\n

Your hardware wallet only shows you the final combined result.
If either half is wrong, the hash changes. That is why it works as an integrity check.<\/p>\n

But if the transaction is malicious by design, the hash will still be correct.
Integrity and safety are not the same\u00a0thing.<\/p>\n

What proper verification looks\u00a0like<\/h3>\n

Before any signature, the transaction should be independently decoded.<\/p>\n

You need to\u00a0see:<\/p>\n

The exact destination contractThe native value being\u00a0sentThe decoded function call (or the selector if full decoding\u00a0fails)How many confirmations already\u00a0existWhether your signature will be the final one that executes the transaction<\/p>\n

Here is a real pending transaction examined during\u00a0testing:<\/p>\n

Nonce 10<\/strong>
Already collected 1 of 2 required signatures
Destination: a specific contract
Value: 0
Call: renounceOwnership<\/p>\n

In plain language, this transaction permanently removes ownership of that contract.
There is no undo. There is no recovery\u00a0path.<\/p>\n

The hash verified\u00a0cleanly.<\/p>\n

The risk was still flagged as Medium because the full arguments could not be decoded and required manual\u00a0review.<\/p>\n

A matching hash and an unclear call are two separate signals.
Either one is a valid reason to\u00a0stop.<\/p>\n

The questions that actually\u00a0matter<\/h3>\n

Before you sign, these are the only questions worth\u00a0asking:<\/p>\n

What does this call actually\u00a0do?Am I the final signature required?Is this action permanent or reversible?Is the target contract the one I believe it\u00a0is?<\/p>\n

If any of those answers are unclear, the correct action is to\u00a0stop.<\/p>\n

Why this has to become\u00a0routine<\/h3>\n

Most people only slow down for large or unusual transactions.
That is the wrong approach.<\/p>\n

The process should be identical whether the transaction moves ten dollars or ten million.
The day the check saves you is almost never the day you expected it\u00a0to.<\/p>\n

Especially dangerous are transactions that already have one confirmation out of two.
In that state, your signature does not just add to a pending list, it executes the transaction.<\/p>\n

That is the moment the verification actually\u00a0counts.<\/p>\n

The quiet pattern behind most multisig\u00a0losses<\/h3>\n

Looking across major incidents, a consistent pattern\u00a0appears:<\/p>\n

The hash was\u00a0correctThe hardware wallet showed no\u00a0warningThe decoded intention was never independently checkedOne or more signers assumed \u201chash matches = safe to\u00a0sign\u201d<\/p>\n

That assumption is still widespread.
It is also still expensive.<\/p>\n

Final note<\/h3>\n

A matching hash is necessary.
It is not sufficient.<\/p>\n

The difference between those two statements is the difference between a normal day and a permanent loss.<\/p>\n

Treat every signature as if it could be the final one, because one day it will\u00a0be.<\/p>\n

Full breakdown with the exact verification steps here: <\/em><\/strong>how-to-verify-safe-transaction-before-signing<\/a><\/p>\n

Why a Perfect Hash Still Cost Bybit $1.5 Billion<\/a> was originally published in Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":"

Most Safe signers treat the hash on their hardware wallet as the final check. It\u00a0isn\u2019t. That single misunderstanding is how $1.5 billion left Bybit in February 2025 and it\u2019s still how most multisig transactions get approved\u00a0today. The gap almost nobody talks\u00a0about Your Ledger or Trezor shows you a hash before every signature.That hash only answers […]<\/p>\n","protected":false},"author":0,"featured_media":209541,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-209540","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/209540"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=209540"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/209540\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/209541"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=209540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=209540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=209540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}