# Bybit, Gnosis, and Cold Storage

Source: https://x.com/cass_on_mars/status/1894915387805884565?a=g1YroRRlqvy1GGSI-bw&s=46
Kiwi News: https://news.kiwistand.com/stories/Bybit-Gnosis-and-Cold-Storage?index=0x6ae4198576af36da432cfa61fa3a5969f070783ec5a5141da448758b645e9184fca3b112
Submitted by thatalexpalmer.eth on 2026-10-30 UTC, 2 upvotes, 0 comments

Every day since the Bybit hack, I have heard more news surrounding it that has made me want to pull my hair out. Lots of shifting blame, which for a $1.4 billion hack carries little surprise -- nobody wants to be holding the "responsible party" title. But I've been involved in building and maintaining cold storage systems, like the one at Coinbase, and coming from a place of experience with the rigor (and paranoia) involved in the design of proper cold storage for exchanges, none of this discourse is sitting right with me. What went wrong? Who is to blame? Everything. Everyone involved.

What is Cold Storage?

Let's talk about what cold storage actually means. Prior to the advent of cryptocurrency and still to this day, cryptographic systems employed for national security purposes have a blend of requirements, sometimes public, sometimes FOIA'd or declassified, sometimes leaked, and many that have yet to be seen by the public eye. These requirements typically refer to classified or sensitive information in plaintext as red signals, and the encrypted version in ciphertext as black signals. Red/black separation guidelines exist, based on the degree of sensitivity of the plaintext, to manage risks associated with how that information is processed, what safeguards are involved with accessing the plaintext (and even the ciphertext), which algorithms are chosen, sometimes down to the physical furniture and design of the room in which this information is handled.

"Why is a raven like a writing desk?" They both talk.

When you consider every single possible avenue in which side channels -- ways in which sensitive information could be tangentially be exposed -- could exist, you end up exhaustively following each link in the process to its worst logical conclusion. You don't have to be a security professional to consider that a computer could be compromised, but some scenarios: the power draw of hardware potentially having a correlation of the data it is processing and thus being an information leak, or the sheer vibrations of a spinning disk drive transferring energy into the table it rests on is something that doesn't get considered by most people. Yet, these are actual threats and types of attacks that have historically been used in situations that involve highly classified information.

It is this exhaustive examination and elimination of side channels that leads to highly sensitive materials being accessible only in vaulted rooms, with extremely thick, impermeable walls, scrubbed and separated power mains that measure a constant draw, shielded cables that leak no EM radiation, with devices separated on different physical tables with vibration dampening feet. These devices are generally not connected to any network, but certainly not connected to the Internet. Even for lower security, but still classified information processing guidance, you will still see restrictions that seem almost arbitrary, unless you have gone through this exercise of running possible avenues of attack to their logical, even if seemingly unlikely, end.

How this relates to Cold Storage

Cold Storage, in the cryptocurrency world, refers to a private key (or several) which has no exposure to the Internet (otherwise, it would be considered "hot" storage). For the purpose of describing fund movements, "sweeping" to cold storage would therefore be movements that go from "hot" or unknown classification addresses to these "cold" addresses. "Restoring" from cold storage would be either the release of a "cold" storage key to "hot" systems, or transferring all funds on the associated address to a "hot" address. An "airgap" specifically means that there exists no exposure link between "cold" and "hot" systems, to the extent that outputs of a "cold" system may require manual re-typing of the output generated in order to satisfactorily meet the separation required, however this has had relatively loose interpretation. Due to the variability in interpretations of all of these terms, this has lead to many different ideas of what cold storage means:

Definition 1: Single-use, formal custodial process, strict responsibilities, true airgap, offline.

A rigorous, compartmentalized, secure private key generation and management process which mirrors the traditional red/black separation guidance for handling sensitive information where private keys (red signals) never leave a secure environment, and even the production of signature outputs (black signals) would require loading a key on a device in some way, which results in the treatment of private keys as subsequently "warm" or "hot" keys, never to be used for cold storage custody purposes again. All hardware used to generate or use the "cold" key material is procured under strict security controls with deterministic generation of the OS image, with multiple authorizations required to modify it, second and tertiary department reviews to release the image and subsequently burn the image to a disc, and self-verifiable by operators that this entire chain of custody was correctly adhered to. Roles generally are firmly divided between many different parties, and the individuals fulfilling those roles are on a need to know basis, sometimes even within members of those roles themselves. All hardware used for this key generation process is then subsequently physically destroyed beyond any attempt to recover it.

Definition 2: Re-usable keys, formal custodial process, strict responsibilities, true airgap, offline.

An offline system in which multiple parties (either multi-sig or MPC) generate signatures in secure environments to move funds from controlled "cold" addresses to hot addresses. These secure environments are still air gapped, access is monitored and regularly audited, and all individuals entrusted with performing these operations are subject to background checks, likely have been required to obtain money transmitter licenses, and hardware used is procured and tightly controlled, but may be reused. Physical hardware security enclaves either directly generate signatures required to authorize movements in a multi-sig setting, or decrypt key shards required to engage in a multi-party computation of a signature. Depending on the nature of the logical wallet, this may require some communication link between parties during this process, but should be over a private network link that has no exposure to the Internet.

Definition 3: Re-usable keys, informal custodial process, mixed responsibilities, no airgap, online.

This is an online system in which multiple parties (either multi-sig or MPC) generate signatures on their own managed hardware, using physical hardware security enclaves to either generate signatures for multi-sig, or decrypt key shards required to produce MPC signatures with a resulting additional output of a new encrypted share to store, making future compromise of a single previous share useless to an attacker. The physical hardware security enclaves are connected over USB, do not transmit the private key in whole, and may have a verification step in which the requested signature data is able to be compared against what they have been presented via any GUI, but is connected to the Internet, which carries significantly greater risk.

Definition 4: Re-usable keys, self-custody process, mixed responsibilities, partial airgap, online.

A personal hardware wallet that transmits information only via QR codes or some visual or audial-confirmation error-correction-code based channel.

Definition 5: Re-usable keys, self-custody process, mixed responsibilities, no airgap, online.

A personal hardware wallet that connects over USB, bluetooth, or NFC.

Which definition of "cold storage" is correct?

While the first example is clearly different from the last to a casual observer, the subtleties of the first three examples may not be immediately apparent without the diagrams. In any case, the ambiguity has lead to mixed interpretations from individuals in the cryptocurrency space arguing any of these are "cold" storage, but that as you approach closer to the first or second definition, you are significantly improving your risk management. For consumers, definition 5 may be plenty fine for managing up to six figures of cryptocurrency, depending on personal risk tolerance. For an exchange, especially an exchange that must comply with various regulations in different jurisdictions that do have explicit definitions of "cold" storage, there is no room for ambiguity, and often definition 1 or 2 is where they must land, although stricter regulators may explicitly require definition 1 due to key reuse.

The important distinction, is that for the operations of a cryptocurrency exchange, if they are following neither definition 1 nor 2, but a less strict definition (3-5), it is reasonable and fair to argue that their "cold" custody is not actually cold, is not actually safe for billions of dollars of crypto assets, and regardless of how this is compromised, they deserve blame for mishandling customer funds.

The Bybit Attack, in Context

Last Friday, attackers now determined to be Lazarus Group (A North Korean hacker group) leveraged an exploit which allowed them to steal approximately $1.5 billion of ETH and related assets from the cryptocurrency exchange Bybit. This is the largest crypto theft on record, and immediately lead to a live response from the exchange discussing the circumstances, taking action to ensure customer funds were protected, and assuring the public that they were over-capitalized to the point that no loss of customer funds would arise from this event. They began to relay findings from their investigation, which they summarized as their custodial cold wallet restore operations having been targeted by Lazarus Group, such that the attackers "masked the signing interface".

As more information surfaced, it was revealed that:

The "cold" wallet was a Gnosis Safe{Wallet} (a multi-sig smart contract wallet).

The operators who performed restorations did so on their regular work machines.

The operators used Ledger hardware wallets to perform those signatures.

(Most recently) The Safe{Wallet} UI used to interact with their specific smart contract wallet instance was the public UI published by Gnosis.

(Most recently) A single developer  at Gnosis was somehow used to publish a compromised UI in which when the requested smart contract was Bybit's, the signature request would be displayed as the expected information, but the actual request sent to the individual signers' wallets would contain the exploit request.

Questioning the definition

Given this information, and revisiting the definitions of cold storage, Bybit's cold storage process easily fits into the third definition. While the most recent findings have shifted the blame discourse to Gnosis, and indeed, there is a very large open question as to how the compromise of a single developer was able to release the exploit UI, it is important to not lose focus of the fact that Bybit had followed practices for cold storage that do not remotely pass the standards expected out of a cryptocurrency exchange.

While even adding a controlled process for deploying the Safe{Wallet} UI to a private instance would have avoided this attack, the fact of the matter is the keys to manage $1.4 billion in crypto assets were not airgapped in the first place. I do not intend to engage in victim blaming, it is ultimately the acts of Lazarus Group that resulted in this theft. However, under no circumstances should Bybit not be considered liable for utilizing an effectively "hot" wallet as a "cold" wallet. Armed with more information, it seems almost insane -- why did they run their cold storage operations like this?

The balancing act

Anyone who has had to tangentially interact with proper cold storage (even as a customer downstream of it) already knows that adding this much friction into the process of managing custody of assets makes things take significantly longer -- which typically is experienced by customers as extended waiting periods for withdrawals of crypto assets from an exchange. As an exchange, events in crypto can result in rapid movements, either price movements that require rebalancing of cold and hot wallets, or utility movements, where withdrawal demands spike and leave hot wallets empty faster than the previously predicted schedule of restores can appropriately fulfill. Providing a great customer experience while safeguarding assets properly means managing liquidity in ways that, for employees, frankly sucks. Nobody wants to get a 3am wakeup call to go to a physical location and perform cold wallet operations -- doing this too many times leads to very unhappy employees and risks corners may get cut. To counter-balance this, exchanges will often have staff on shifts to ensure all times are covered. But in an industry where flash crashes, god candles, and extremely high thrash utility events that demand liquidity happen unpredictably, but still quite often, it can be hard to meet those demands even with extra staffing.

This is typically where exchanges will do one of three things:

Accept the poor customer experience, because safeguarding assets matters most of all.

Accept greater risk and raise liquidity levels for hot wallets – at the possibility of a well-timed attack not being covered by adequate insurance.

YOLO all the cold wallets into a hot configuration.

With crypto, all it takes is one weak link. Only through safe practices and processes can these events be prevented.

"But <insert tech here> can solve this!"

No it can't. This is exactly the place where tech proposals generally makes things worse overall by increasing attack surface area, or at best only adds defence in depth in conjunction with following proper process. This was a question I was asked about in a previous stream, whether or not the Q MPC key management system we are releasing could be utilized to address this scenario: while MPC key management can add a deeper layer of defence in depth with rules in agreeing to produce an output (which is indeed a far better state than trusting a third party's UI), this would only be helpful in the transition step of restoring a cold key (or shards, in this case) to become hot, or performing locally-networked signing operations in a secure environment and most importantly, only in combination with following the strict, paranoid process, per definitions 1 or 2.

Stay safe out there.