The $1.5 billion Ethereum theft from Bybit earlier this year has left a lasting mark on the crypto world. The attack not only exposed vulnerabilities in one of the largest exchanges but also triggered a deep introspection across the industry. Among those most affected was SafeWallet, the Ethereum smart account platform whose compromised infrastructure played an indirect role in the breach. What followed was a complete rearchitecture of its systems and a hard look at how the crypto ecosystem handles security.
The Day the Industry Stood Still
In February, hackers pulled off the largest crypto heist in history, draining roughly 401,000 ETH, worth about $1.5 billion, from Bybit. The incident shook the entire digital asset community. While panic briefly spread, Bybit and other industry players quickly mobilized to contain the damage and restore operations.
Investigations later revealed a troubling detail: the hackers had infiltrated a SafeWallet developer’s machine, injecting malicious JavaScript into the wallet’s interface. This exploit tricked Bybit’s multisignature process into approving a fraudulent smart contract, enabling the theft. Intelligence agencies and blockchain forensics firms attributed the attack to North Korea’s Lazarus Group, a name now synonymous with sophisticated crypto crimes.
A “Reckoning” for SafeWallet
For SafeWallet, the Bybit breach became a defining moment. CEO Rahul Rumalla described it as a “reckoning” that forced the company to rebuild its security architecture from the ground up. Speaking during a live Chain Reaction event, Rumalla reflected on how the team had to rethink not only its technical defenses but also the broader concept of self-custody.
“A lot of users engage in what’s called blind signing, they don’t always understand what they’re approving, whether it’s on a hardware wallet or browser extension,” Rumalla said. “It starts with education, awareness, and setting better standards.”
He emphasized that in a self-custody world, security is a shared responsibility. “The design of self-custody is inherently fragmented. That’s what we started to re-architect.”
Breaking Down Security Layers
In the months that followed, SafeWallet dissected its entire infrastructure to identify weak links. The company’s engineers rebuilt security across multiple layers, from transaction-level validation and signer device protection to backend infrastructure and compliance standards.
“We broke it down by transaction-level security, signer device-level security, infrastructure-level security, but also standards and auditability. They all have to work together,” Rumalla explained.
Despite the scrutiny that followed the Bybit hack, Safe’s key partners remained supportive. Most understood that the breach had been enabled by a human and hardware compromise, not by a flaw in Safe’s smart contract protocols. The company’s next steps involved reinforcing internal access controls, verifying developer endpoints, and adopting more stringent review processes for any code interacting with client funds.
The Human Element in Cybercrime
While technology continues to advance, Rumalla believes the biggest threat today comes from human vulnerabilities rather than software bugs. “These attackers are in Telegram channels, DAO chats, even applying for jobs as IT engineers,” he warned. “They exploit the human element, not just code.”
This rise in social engineering tactics reflects a broader shift in cybercrime. Groups like Lazarus have infiltrated the crypto world by posing as legitimate developers, investors, or collaborators, embedding themselves in communities before striking. Reports suggest the group could steal over $2 billion in crypto assets in 2025 alone if left unchecked.
Balancing Security and Usability
Amid the crisis, one reassuring discovery for SafeWallet was that its core smart account protocol held firm. “The smart accounts were battle-tested,” Rumalla noted. “That gave us the confidence to strengthen everything built on top.”
Still, he acknowledged that the industry has long faced a trade-off between security and convenience. For years, user-friendly wallets often came at the expense of robust safeguards. Rumalla believes this mindset must change. “We can no longer accept that security has to mean complexity. It’s about evolving products that are both secure and easy to use,” he said.
As SafeWallet emerges from its toughest chapter, the company hopes to turn its painful lessons into progress for the broader crypto community. Its rearchitected platform aims to set new benchmarks for transparency, accountability, and user protection in self-custody wallets.
The Bybit incident may have been a costly wake-up call, but for SafeWallet and others in the ecosystem, it’s also a reminder that trust in crypto depends on constant vigilance, not just in code, but in people.
