How should a team run multisig approvals for a company treasury?

Why the rule exists

NIST describes separation of duty: no user should have enough power to misuse a system on their own.⁴ Its example is that the person who authorises a pay cheque should not also be the one who prepares it.⁴ The two-person rule is one way to enforce this.⁴

A Safe with a threshold above 1 works in a similar way. No single account can move funds.⁵

A typical approval

1. Propose. One owner creates the transaction and proposes it to the others.⁶
2. Check. Each signer checks the recipient, the amount, the data, the operation type and the nonce. The nonce is the transaction's number in the queue.¹
3. Sign. Signatures can be collected off-chain until enough owners have signed.⁷
4. Run. The Safe carries out the transaction only if enough owners have signed.⁸

What to check before signing

Safe's help centre sums it up in one line: "If you can't verify it, don't sign it."¹

• The operation. Usually it should be a simple "call". Safe says a "delegate call" is dangerous and should be checked with a technical person.¹
• Why that matters. A delegate call runs another contract's code as if it were the account's own.⁹
• A second device. Safe suggests signing on a different device from the one showing the Safe app.¹
• A second tool. It suggests checking the transaction data with more than one tool and device before signing.¹
• Known contracts. It suggests keeping a list of trusted contracts that you deal with often.¹

The Bybit theft

On or about 21 February 2025, about $1.5 billion in crypto was stolen from the exchange Bybit.² The FBI said North Korea was responsible.²

Bybit says the theft happened during a routine transfer from one of its Ethereum multisig cold wallets.³ It says the transaction and the Safe interface were spoofed, letting the hacker change the wallet's smart contract logic.³

Safe said its smart contracts were not affected. It said the attack was carried out by compromising a Safe{Wallet} developer's machine.¹⁰

Sygnia, a security firm that examined the Bybit signers' computers, reports that code serving Safe{Wallet}'s web interface had been altered.⁹ The altered code was set to target a specific Bybit cold wallet.⁹ It swapped the transaction for a delegate call to a contract the attackers had set up in advance.⁹ That contract let the attackers move funds without multisig approval.⁹

Sygnia says two earlier thefts, at WazirX and Radiant Capital, show "some level of similarity": signers saw normal-looking details while harmful transactions were signed.⁹ It says they may have used a similar method, but the method was not fully uncovered or made public.⁹ It found no sign that those two came from inside Safe{Wallet}'s own systems.⁹

Habits that limit the damage

• Separate Safes. Safe says some organisations keep different assets in different Safes, each with its own signers and threshold.⁵
• Allowances, with care. A module can set an amount that can be spent without other owners' approval.¹¹ But a malicious module can take over a Safe.¹¹
• Watch for big outflows. The Ronin bridge theft went unnoticed for six days, and Ronin says it had no proper system for watching large outflows.¹²