The numbers are stark. On February 21, 2025, Bybit lost approximately $1.5 billion in Ethereum tokens. The attackers exploited a Safe multisig wallet. The code had been audited—multiple times. OpenZeppelin, a top-tier auditor, had reviewed the relevant contracts. The audit badge was proudly displayed. Yet the funds vanished.
This is not a failure of auditing. It is a failure of how we interpret auditing. The crypto industry has sold investors a dangerous lie: that an audited badge means the system is safe. The Bybit hack proves otherwise. The code was clean. The attack was not in the code.
I have spent the last decade in this space, first manually auditing smart contracts during the 2017 ICO craze, then running DeFi strategies through the 2020 summer and the 2022 crash. I have seen teams treat an audit report as a checkbox, a marketing tool, a stamp of approval from some distant authority. But every audit is a snapshot of a specific commit, a specific set of contracts, under specific assumptions. The moment you deploy on mainnet, that snapshot begins to decay. The moment you update dependencies, add a frontend, or let a developer’s laptop get compromised, the audit becomes a historical artifact, not a safety guarantee.
Bybit’s attack vector was quintessentially modern: a social engineering attack that compromised the signing interface. The signers believed they were approving a legitimate transaction. The screen showed the expected address. But the underlying transaction handed wallet control to the attacker. This is not a smart contract vulnerability. It is a failure of transaction intent verification. The audit badge promised that the code was safe. It delivered. But the code was not the problem.
The Context: Bybit and the Safe Multisig
Bybit is a centralized exchange, but its cold wallet infrastructure relied on Safe, the most widely used multi-signature wallet in crypto. Safe’s smart contracts have been audited by leading firms, including OpenZeppelin, and have been battle-tested with billions in assets. The attack did not exploit a flaw in Safe’s code. Instead, the attackers compromised the developer machine of a Safe team member or a third-party service provider, then used that access to manipulate the interface that the signers used to review transactions.
This is a classic supply chain attack. The code was secure. The signing devices were not. The signers were physically remote, relying on a screen to tell them what they were signing. That screen was lying.
Safe’s post-mortem explicitly attributed the incident to an infected developer machine. The company emphasized that the smart contracts themselves were not vulnerable. This is a crucial distinction that the market often fails to understand. When a protocol displays an audit badge, it is implicitly claiming that the entire system is secure. But the badge only covers the code. The system includes the frontend, the backend, the cloud accounts, the employee laptops, and the human judgment of the signers.
The Core: What Audits Actually Cover
Let me break down the technical reality. A smart contract audit is a manual or automated review of specific code at a specific point in time. The auditor examines the code for common vulnerabilities: reentrancy, integer overflow, access control, logic errors. They produce a report listing findings, categorized by severity. The protocol fixes those findings, and the auditor issues a final report. That report is then used to generate a badge.
But here is what the badge does not say:
- The audit covered only the contracts in a specific commit hash. Any subsequent change—upgrades, new features, even dependency updates—is not covered.
- The audit did not examine the frontend code, the backend infrastructure, the cloud configuration, or the employee devices.
- The audit assumed the transaction signing process was honest. It did not test for blind signing attacks or interface manipulation.
- The audit did not assess the operational security of the team. Private keys could be stored on an internet-connected device, employees could be phished, and the audit would not catch it.
According to a preprint from Oak Security, approximately one in six audit findings is rated critical or high severity. But those findings are code-level. The same preprint analyzed actual loss events and found that private key leaks and phishing alone accounted for 43.9% of the total value stolen. These are not issues an audit typically addresses. The top three categories of audit findings—access control, validation, and logic errors—account for only 37.6% of losses. The majority of losses come from attack vectors outside the scope of code audits.
This is not a knock on auditors. OpenZeppelin, Safe, Oak Security—they are all highly competent. They clearly state the scope of their audits. They use commit hashes, list specific contracts, and note the duration of the review. The problem is that once the report is published on the protocol’s website, the scope is often hidden. The badge becomes a generic seal of approval. Investors see the badge and assume the system is secure. They do not read the fine print.
I have seen this repeatedly in my own career. In 2020, I managed a $500k liquidity pool on Uniswap V2. The protocol had an audit badge. But I still lost 30% of my principal to impermanent loss and gas fee erosion. The audit did not protect me from market risk. The same is true for security. An audit does not protect you from operational failures, social engineering, or human error.
The Contrarian: Why Audit Badges Are Actively Dangerous
The conventional wisdom is that an audit is better than no audit. In theory, yes. But in practice, the existence of an audit badge can create a false sense of security that leads to worse outcomes. Investors relax their own due diligence. They assume the protocol is safe. They ignore warning signs. They trust the badge.
This is a classic moral hazard. The badge acts as a signal of safety, but the signal is weak. The market, however, treats it as strong. Protocols with audit badges attract more TVL, command higher valuations, and are less likely to be scrutinized by investors. The bad actors know this. They can obtain a cheap audit from a less reputable firm, display the badge, and use it to lure victims. The Bybit case is different: the audit was top-tier, but the attack still happened. That is even more dangerous because it proves that even the best audits cannot guarantee safety.
Institutional investors, in particular, are vulnerable to this delusion. In 2024, I was hired by a Shanghai-based family office to design a crypto allocation strategy. The board members were conservative, but they had read about audit badges. They wanted to see the badges before committing capital. I had to explain that the badges were not sufficient. I had to show them the Bybit post-mortem, the Oak Security data, and the reality of supply chain attacks. They were shocked. They had assumed that a top-tier audit meant the protocol was safe for treasury allocation.
This is not just a theoretical problem. The FBI and other regulators have issued warnings about the risks of relying solely on audit reports. In the wake of the Bybit hack, Safe itself issued a statement clarifying that the attack was not a contract vulnerability. But the damage was done. The market had already priced in the assumption that audited Safe wallets were invulnerable.
The Takeaway: What Should Replace the Audit Badge?
We need to move beyond the audit badge as the sole indicator of security. Here is what I recommend, based on my experience as a battle-tested trader and strategist:
1. Demand Scope Disclosure. Every protocol should clearly state what was audited: which contracts, which commit hash, which assumptions. The badge should link to the full audit report with scope details. If the badge is vague, treat it as a red flag.
2. Require Ongoing Monitoring. A snapshot audit is not enough. The protocol should have continuous monitoring for anomalous transactions, real-time alerts, and automatic pause mechanisms. Some teams are now using fork detection and on-chain surveillance. This is far more valuable than a static badge.
3. Insist on Transaction Simulation. For multi-sig wallets, signers should use tools that simulate the exact transaction before signing. This can detect discrepancies between the displayed intent and the actual execution. Several projects are building transaction simulation layers specifically for this purpose. Use them.
4. Evaluate Operational Security. Ask the team about their key management, employee security training, and incident response plan. Are private keys stored on hardware wallets? Are signers required to verify each transaction via an independent channel? If the team cannot answer these questions, the audit badge is meaningless.
5. Look for Insurance or Bonding. Some protocols now purchase insurance policies that cover losses from operational failures, social engineering, and even supply chain attacks. If the protocol has a significant insurance pool, it provides a second layer of protection. But note: insurance is not a substitute for security, it is a complement.
6. Treat the Audit as a Starting Point, Not an Endpoint. The audit is the baseline. It tells you that the code was written correctly at a certain time. It does not tell you that the system is safe now. The system is only as safe as its weakest link, and that link is often not the code.
The Ultimate Responsibility
At the end of the day, the responsibility for security lies with the users and the protocols, not the auditors. Auditors are not insurers. They are reviewers. They provide a service that is necessary but not sufficient. The crypto industry has been too quick to outsource security to a badge. We need to take it back.
I have seen the cost of complacency. In 2022, I watched TerraUSD crash in seconds. I had trusted the code. I had believed the audits. I lost 20% of my portfolio in that moment. I learned that the only real security is diversity of trust: multiple auditors, multiple layers of verification, and a healthy skepticism of any single signal.
The Bybit hack should be a wake-up call. The audit badge is a tool, not a shield. Use it as one piece of information, not the final word. If you are an investor, demand more. If you are a protocol, provide more. The market will eventually reward those who differentiate between the appearance of security and the reality of it.
Will we continue to rely on a badge that failed $1.5 billion? Or will we finally look beyond the code and see the full picture? The choice is ours.