DT.gl
ED. 2026.11 · 24 AUDITS · ZERO TELEMETRY

Recent

↑ ↓ to move ↵ to open esc to close

INCIDENT LEDGER

COVER INVESTIGATION · DT-INC-2025-001 · CWE-494

Bybit $1.46B Safe Multisig UI Supply-Chain & Slot-0 Delegatecall Post-Mortem

Complete UTC timeline, EVM storage-slot forensics, calldata breakdown, and Safe Guard remediation for the $1.46 billion Bybit cold-wallet exploit (DT-INC-2025-001).

Loss at Exploit
$1.46B
Frozen / Recovered
$42.0M
Mutated Slot
0x00 (Proxy)
Contract Bugs
0 Solidity

On February 21, 2025, DPRK Lazarus Group operators drained 1.46 billion USD in ETH and liquid-staked derivatives from Bybit's Ethereum cold multisig without exploiting any smart contract bug. Compromising a Safe developer workstation allowed attackers to inject targeted AWS S3 frontend JavaScript that tricked three hardware-wallet signers into blind-signing an operation=1 DELEGATECALL overwriting proxy storage slot zero.

Read full forensic post-mortem → DT.gl Threat Lab · 18 min read · 3,600+ words

Featured Audits

Pillar 01 / Forensic Post-Mortems

Crypto Security & Incidents

Section hub (Crypto Incidents) →

Byte-level EVM exploit reconstructions, multisig UI supply-chain forensics, EIP-7702 delegation sweeps, and immutable contract law.

Pillar 02 / Silicon & Quorum Engineering

Wallets & Self-Custody

Section hub (Wallets & Custody) →

Hardware wallet secure-element trust models, ERC-7730 clear signing, RPC metadata isolation, stealth addresses, and Shamir quorum design.

Pillar 03 / Applied Cryptography & Endpoint OS

Privacy, PQC & Hardened OS

Section hub (Privacy & PQC) →

NIST FIPS 203/204/205 and HQC post-quantum migration, verified-boot mobile operating systems, metadata-resistant messengers, and FIDO2/MCP isolation.

Pillar 04 / Telemetry & RF Countermeasures

Anti-Tracking & Network Defense

Section hub (Anti-Tracking) →

Commercial RTB location data brokers, California DROP statutory deletion, cellular baseband lockouts, encrypted DNS, and TLS ECH architecture.

CLIENT-SIDE VERIFICATION LAB · CSP: script-src 'self'; connect-src 'none'

Zero-Telemetry Offline Workbenches

Six browser-isolated forensic utilities executing strictly inside local memory with network egress blocked at the HTTP Content-Security-Policy header layer.

0 NETWORK EGRESS
LABORATORY CHARTER // EMPIRICAL SCOPE

DT.gl is an independent digital trust and threat engineering laboratory auditing the intersection of self-custody cryptography, network transport metadata, and commercial surveillance. Every specification pairs primary protocol documentation from NIST, IETF, EIPs, and federal filings with reproducible grading rubrics and client-side verification tools isolated under strict connect-src none Content-Security-Policy headers.

Four-Layer Adversarial Threat Surface Audited by DT.gl LAYER 4 // EXECUTION & SIGNING DISPLAY (EVM / PSBT / MCP) Threats: Safe slot-0 DELEGATECALL spoofing, EIP-7702 0x04 sweepers, Permit2 drainers, Unicode U+E0000 MCP injection LAYER 3 // APPLICATION & WALLET TELEMETRY (RPC / UTXO / BROWSER) Threats: Batch eth_getBalance IP correlation, deterministic UTXO merges, WebGPU/Canvas/Audio fingerprinting LAYER 2 // NETWORK TRANSPORT & METADATA (DNS / TLS / CELLULAR) Threats: Cleartext SNI leaks, baseband IMSI catchers, recursive DNS resolver retention, TLS fingerprinting LAYER 1 // HARDWARE SILICON & PHYSICAL OPSEC (ENCLAVE / RF / DATA BROKERS) Threats: Closed-source Secure Element firmware bugs, RTB mobile advertising geofences, physical home coercion

Frequently Verified Technical Questions

How does DT.gl enforce zero telemetry on its interactive cryptographic and privacy tools?

Five standalone verification tools on DT.gl ship with HTTP Content-Security-Policy connect-src none headers enforced at the edge. Once the static HTML, stylesheet, and bundled TypeScript module finish loading, the browser kernel blocks every outbound fetch, XMLHttpRequest, WebSocket, and beacon call, guaranteeing raw calldata, seed entropy rolls, and files never leave local RAM.

Primary Reference: W3C Content Security Policy Level 3

Why do hardware wallet multisig signers still lose funds without private key extraction?

Modern high-value exploits target the coordinator display layer rather than breaking elliptic-curve keys. When a web interface or CDN bundle is compromised, signers who approve raw hashes without independent calldata decoding can unknowingly sign a Safe operation 1 DELEGATECALL or an EIP-7702 SET_CODE tuple that overwrites contract ownership in a single transaction.

Primary Reference: FBI IC3 TraderTraitor PSA

How do off-chain mobile data brokers create physical security risks for self-custody cryptocurrency holders?

Commercial SDKs embedded in everyday weather, navigation, and utility apps harvest GPS coordinates alongside Mobile Advertising IDs, while e-commerce KYC leaks expose residential addresses. Adversaries correlate leaked crypto-buyer email or phone records with commercial data-broker location feeds to target self-custody holders for SIM swaps and physical home-invasion coercion.

Primary Reference: FTC Data Broker Enforcement

Is DT.gl affiliated with the legacy Decentralize.Today publication?

No. DT.gl operates as an independent security specification and threat research laboratory with zero corporate, editorial, or authorial affiliation to Decentralize.Today. Where external encyclopedias, open-source documentation, and government reports cite legacy dt.gl URLs, DT.gl maintains dedicated archival context blocks alongside updated 2026 empirical benchmarks.