Bybit's Signers Saw a Normal Transfer. Safe's New Answer Costs 40 Cents a Check.

Opening & At a Glance

On 21 February 2025, Bybit's signers sat down to approve a routine move from a cold wallet to a warm one. The Safe{Wallet} screen looked the way it always did. It was lying. Malicious JavaScript, planted two days earlier in Safe's own web front end, had swapped the payload for a delegatecall that replaced the wallet's contract logic. The signatures were valid. Roughly $1.5 billion in ETH was gone within minutes, and the FBI later pinned it on North Korea's TraderTraitor group.

Twenty months later, Safe has shipped its structural answer. On 15 October 2026 the Safe team launched Safenet Aegis, the first production release of a network that checks a transaction before it executes and, if you opt in, refuses to run it without a passing verdict recorded onchain. The pitch is simple: stop trusting the screen.

How Aegis Works, in Plain Terms

There are three moving parts. First, a rulebook. Safe calls it the Safenet Charter, approved by Safe{DAO} and versioned onchain, and it defines what "secure" means: no manipulated recipients or targets, no unapproved changes to a Safe's owners or threshold, no dangerous approvals, no delegatecalls to unintended targets, nothing touching known-malicious addresses. Economic attacks are out of scope for this release.

Second, the checkers. Sentinels are independent security firms that each run the proposed transaction against the Charter using their own threat intelligence. If they all say secure, it moves on. If they disagree, it goes to arbitration and gets no pass. If the network can't reach a reliable answer, the transaction is not treated as secure. Safe says no single Sentinel can wave through a bad transaction or block a good one.

Third, the stamp. Validators, who stake at least 3.5 million SAFE each, sign a single attestation using a threshold scheme so no one Validator holds the key. Then the optional Safenet Guard on your account does the part a UI warning never could: it lets a transaction execute only if it carries a valid attestation for that exact transaction. There's a delayed escape hatch so you don't lose control of your own Safe.

Hold that against Bybit for a second. The poisoned transaction was a delegatecall that rewrote the wallet's implementation. Delegatecall integrity and configuration changes sit right in the Charter's list. Nobody can prove after the fact that Aegis would have caught that exact payload, and Safe doesn't claim it. But it's aimed squarely at that class of failure. One of the launch Sentinels, BlockSec, published its own technical breakdown of the Bybit incident, which tells you the checkers know what they're looking for.

Confirmed vs Analysis — Keep the Labels Honest

The Price of a Verdict

My read: the architecture is right and the money is early. Moving the security verdict off the screen and onto the chain is the lesson the industry paid $1.5 billion to learn. A UI can be swapped in an afternoon. A Guard that checks an attestation for the exact transaction can't be talked out of it by a doctored webpage.

But look at what a wrong call costs a Sentinel. The bond is 800 USDC per check. And Safe phases slashing in: for the first three months, only the 0.40 USDC fee is at risk, not the full bond. That's a sensible way to avoid punishing operators while the system beds in. It also means "skin in the game" is, for now, closer to a fingernail. Nobody should read a bonded verdict as insurance on a treasury holding eight or nine figures.

The other soft spot is adoption. The Guard is opt-in, and the checks only become automatic once they land inside Safe{Wallet}'s signing flow, which Safe is targeting within Q4 2026. Safe's own announcement makes the point: security you have to go looking for is security most people never turn on. Until the integration ships, Aegis protects the teams careful enough to wire it up, which are often the teams least likely to need it.

Still, I'd rather see this than another warning banner. It pairs with the theme we covered in the CFTC's self-custody carve-out: if regulators keep treating your own wallet as the exit from the exchange world, the wallet has to grow up. Circuit breakers on self-custody are part of that.

Questions Readers Are Likely to Ask

Do I have to use Aegis to use a Safe? No. Checks can be requested and read without the Guard, and the Guard itself is opt-in.

Who changes the rules or the fee? Safe{DAO}. The Charter, the fee, any future DAO share, bond and slashing amounts, and the Sentinel and Validator sets all go through its governance. The DAO's cut of fees is 0% at launch.

Does it only work with Safe{Wallet}? Safe describes Safenet as usable by compatible wallet providers, with support for other account types such as EIP-7702 accounts being considered for a future version.

Closing & Sources

Confirmed: Safenet Aegis went live on 15 October 2026 on three chains, with four named Sentinels, a 0.40 USDC check fee and an 800 USDC per-check bond, and enforcement through an opt-in Guard. Opinion: it's the first serious attempt to make "the screen lied" a survivable event for a multisig. Whether it becomes real protection depends on two things that haven't happened yet: the wallet integration, and the day a Sentinel's full bond is actually on the line.

• Safe — "Introducing Safenet Aegis: Enforceable transaction security for Safes" (15 Oct 2026)
• Safenet docs — Sentinels, Safenet checks, Participant selection, Roadmap
• FBI — PSA "North Korea Responsible for $1.5 Billion Bybit Hack" (Feb 2025)
• Sygnia — Bybit investigation findings; BlockSec — Bybit incident technical analysis

Methodology Note: Editorial synthesis of Safe's 15 Oct 2026 announcement and Safenet documentation, with Bybit incident details from the FBI and published forensic reports. Fees, bonds and participant lists are as stated at launch and can be changed by Safe{DAO}. RogueGhost is not affiliated with Safe or any Sentinel. Not financial or security advice. Analysis labelled as analysis.