🧨 Bybit Hack Replay – $1.43B Exploit Simulation

This repository reproduces the Feb 2025 Bybit cold wallet exploit, where ~$1.43 billion was drained via a malicious proxy upgrade. The replay simulates the attack using the Foundry framework.

---

🛠️ Project Structure

src/
├── WalletProxy.sol         # Upgradeable proxy with fallback delegatecall
├── GoodWallet.sol          # Legit wallet logic
├── MaliciousWallet.sol     # Attacker logic with sweepERC20()
├── TestToken.sol           # Mock ERC20 used for simulation

test/
└── BybitAttack.t.sol       # Full simulation of the malicious upgrade + drain

About the Exploit

This simulation recreates the key flow of the Bybit hack:

WalletProxy is initialized with a benign GoodWallet implementation.

Bybit mistakenly signs a malicious upgrade() call to MaliciousWallet.

The attacker calls sweepERC20() via proxy’s fallback() → delegatecall.

Tokens are drained to attacker-controlled address.

The exploit relies entirely on proxy delegatecall, not on bugs in the logic itself.

📎 Full Writeup 📘 Read the Full Notion Report (Visual, Step-by-step)

Covers:

Attack breakdown

Code-level explanation

Fallback mechanics

Mistake attribution

Who Was At Fault?

❌ Bybit Operations/Security Team: Signed a malicious upgrade, trusted spoofed UI

✅ Smart Contracts (Safe, Proxy): Functioned exactly as designed

❌ Internal security review missed the calldata logic

⚠️ Ecosystem Tooling: Poor calldata readability on UI

❗ This was a human error, not a contract bug.

Foundry

Foundry is a blazing fast, portable and modular toolkit for Ethereum application development written in Rust.

Foundry consists of:

• Forge: Ethereum testing framework (like Truffle, Hardhat and DappTools).
• Cast: Swiss army knife for interacting with EVM smart contracts, sending transactions and getting chain data.
• Anvil: Local Ethereum node, akin to Ganache, Hardhat Network.
• Chisel: Fast, utilitarian, and verbose solidity REPL.

Documentation

https://book.getfoundry.sh/

Usage

Build

$ forge build

Test

$ forge test

Format

$ forge fmt

Gas Snapshots

$ forge snapshot

Anvil

$ anvil

Deploy

$ forge script script/Counter.s.sol:CounterScript --rpc-url <your_rpc_url> --private-key <your_private_key>

Cast

$ cast <subcommand>

Help

$ forge --help
$ anvil --help
$ cast --help

📬 Contact

Simulated by @MKVEERENDRA. Feel free to fork, reuse, or extend this for other proxy or UI-based exploit simulations.

Let me know if you'd like me to generate a badge-style header, auto-link it to GitHub topics (`security`, `foundry`, `replay`, `proxy-hack`), or build an accompanying Markdown `attack_flow.md` file for deeper visualization.