ByBit Hack on a Two-Bit Blockchain

The afore-pictured downturn in our favorite token’s value would suggest some major breaking news in the crypto space. Did FTX crash again or something?

This time around, the truth is not nearly as exciting. That’s a good thing.

There were two big news stories last week. First, on February 20, the SEC ended a number of lawsuits against and/or investigations into major crypto exchanges and slashed the size of its task force from 50 attorneys to 30. Subsequently, $1.5 billion worth of our least favorite token, $ETH, was stolen from Dubai’s ByBit exchange, by far the biggest heist in crypto history.

Coincidence? Yeah, probably.

Despite ample X rumors that it was an inside job, there is little hard evidence that the ByBit situation had anything to do with fraud. Reporting says the money was stolen by a sophisticated hacker group out of North Korea known as the Lazarus Group, acting independently. (No, not our friendly neighborhood fine art printing shop.)

The rumors stem from a supposed social engineering tactic that deceived the participants of ByBit’s multi-signature execution. Crypto natives are convinced that at least one of the seasoned signers in charge of security — and, thus, auditing any transactions — should have noticed the issue.

But regardless of whether or not the major centralized exchanges (predominantly outside of the U.S.) are engaging in practices that defraud their trading customers, there is a real concern about the way in which the ByBit hack was conducted. It laid bare the fragility, not just of Ethereum, but of the core infrastructure underpinning most layer-2 security architectures: the multisig wallet.

A multi-signature wallet requires multiple private keys to authorize a transaction. It ensures that no one person can access funds without collaboration, requiring a predefined number of signers, such as 2-of-3, to approve any action. They are incredibly widespread, but evidently, far from foolproof. Multisig wallets can be vulnerable to key loss, hacking, or compromise of multiple signers.

Beyond that specific point of compromise, the hack exposes the downsides of these systems’ complexities. You could argue that complexity creates more barriers for cyber threats to overcome, but it also creates more attack surfaces for hackers to accomplish exactly what Lazurus did.

All in all, it’s just another data point in my advocacy for L1-only solutions to scale a decentralized world computer and empower internet users with privacy and data value rights. This attack is an example on the vulnerability of the systems that currently connect L1s to L2s. What it proves to me is that L2s are just middle-man leech systems, best reserved for the role of dApps, not secure protocol infrastructure.

With ETHDenver — and, consequently, a lot of headline-grabbing L2 announcements — on the horizon, my perspective is an unpopular one. But simply put, ETH is bad for the future of decentralization and empowering the end user. It lends itself to large institutions. And if we’re just going to recreate the Big Tech environment, what is the fucking point of any of this?

Which brings us back to the market side of things. The ByBit hack probably put downward pressure on Ethereum, and contagion runs rampant in the crypto space. (The average Bitcoin buyer probably doesn’t know there’s a difference between L1s and L2s to begin with.) But crypto bull markets are always volatile, and this time around, there isn’t a bubble that can be popped by a few bad actors. We got to the recent all-time highs through steady building and innovation, which I believe will bring us back to and beyond them.

In 2025, it’s not about the breaking news and bad actors. The technology solves real problems, and the teams focused on those use cases will outlive the charlatans and card houses. The cream always rises to the top.

—El Prof