Bybit lost more than $1.4 billion in ETH after Lazarus-linked operators compromised Safe{Wallet} infrastructure and manipulated the multisignature transaction flow used for a routine cold-to-warm wallet transfer. The excerpt describes initial access through social engineering against a Safe{Wallet} developer, involving a crypto-themed Python/Docker project, getstockprice[.]com, IP 70.34.245[.]118, stolen AWS session tokens, AWS reconnaissance, and use of Mythic Poseidon. Attackers modified JavaScript hosted from Safe{Wallet}'s AWS S3 resources so Bybit signers saw apparently legitimate transaction data while the approved transfer was redirected to an attacker-controlled contract address. The operation matters for DPRK-focused tracking because it combines Lazarus-style developer targeting, cloud credential theft, supply-chain compromise, and high-value cryptocurrency theft against a major exchange.