Bybit’s $1.5 Billion Theft Clarified Wallet Control

The controller of a crypto wallet is whoever can produce the authorization its account or smart contract accepts—not whoever sees a balance beside a username. That distinction became unusually concrete on February 21, 2025, when attackers removed approximately $1.5 billion in virtual assets from a Bybit Ethereum cold wallet after its multisignature workflow approved a malicious transaction. The FBI later attributed the theft to North Korea. Customers had custodial account balances; Bybit controlled the on-chain wallet and bore the immediate loss.

What is the difference between custodial and self-custodial wallets?

A custodial wallet gives a service control of the keys or contract permissions, while a self-custodial wallet leaves transaction authority with the user. An exchange account is usually a claim recorded in the exchange’s private ledger. Depositing crypto transfers assets to addresses the exchange controls; withdrawing asks the exchange to send an on-chain transaction.

Self-custody changes that relationship. A private key, a group of multisignature keys or a smart-account authorization policy determines who can move the assets. The wallet application is merely an interface. A user can replace it and recover the same account elsewhere, provided the required keys or recovery credentials remain available.

The practical test is not whether a product calls itself a wallet. Ask:

• Can the provider block or delay a withdrawal?
• Can the user export, recover or independently exercise transaction authority?
• Can an administrator upgrade the wallet contract or change its signers?
• Whose approval would the blockchain accept if the user and provider disagreed?

Does self-custody remove counterparty risk?

Self-custody removes the wallet custodian, but it does not remove every intermediary. Wallet software can display misleading transaction details, remote nodes can provide incomplete data, and smart contracts can contain upgrade keys or privileged controls. A hardware wallet protects key material; it cannot guarantee that an opaque transaction matches the user’s intent.

Tokens can also embed custody one layer below the wallet. A bridged or wrapped asset may be controlled by its holder on the destination chain while depending on an issuer or bridge to safeguard the original asset. The Universal bridge backing dashboard offers an on-chain way to compare reported token issuance, reserve backing and liquidity pools. Such measurements can verify visible balances and contract activity, but not undisclosed liabilities, compromised keys or the enforceability of redemption promises.

Who pays when wallet control fails?

The party holding transaction authority usually determines where the loss lands first. With a custodian, the company absorbs a theft while it remains solvent; customers pay through frozen withdrawals, reduced recoveries or bankruptcy if the shortfall overwhelms it. The custodian benefits from pooled security, account recovery, compliance systems and simpler trading, funded through fees and the use of customer deposits.

With self-custody, a stolen key, exposed recovery phrase or mistaken signature generally produces a final loss for the user. In return, no exchange can unilaterally suspend access, rehypothecate the assets or make withdrawal conditional on its own solvency.

The Bybit theft did not prove that custody is always unsafe or that individual key management is automatically safer. It showed that “cold,” “multisig” and “self-custodial” describe components, not outcomes. Wallet control belongs to whoever can satisfy the full authorization path, including the humans, interfaces and contract permissions around the key. For material holdings, that path matters more than the label on the app.