Safe review: the multisig that holds the treasuries, and the hack that was not its fault

A seed phrase is a single point of failure. One person, one backup, one compromise and everything is gone. For an individual with modest holdings that is an acceptable trade-off in exchange for simplicity. For a company treasury, a DAO or anyone holding serious value, it is indefensible.

Safe replaces it with a smart contract. You define who can sign, how many signatures a transaction requires, and what constraints apply to what they can do. Losing one key becomes an operational inconvenience rather than a catastrophe.

What the contract gives you

• Thresholds: 2-of-3, 3-of-5, or whatever matches your actual governance rather than your aspirational one.

• Signer rotation: replace a compromised or departed signer without moving a single asset.

• Modules: delegate narrow powers — a spending limit for day-to-day operations, a timelock on large transfers.

• Guards: rules every transaction must satisfy regardless of what the signers agree between themselves.

None of this exists in a hardware wallet. It is a different category of custody, and for organisational funds it is not optional — it is the minimum credible arrangement.

February 2025, in detail

Attackers compromised infrastructure associated with the Safe{Wallet} front end and served Bybit's signers a manipulated interface. The signers saw a transaction they expected to see. They approved something else entirely. Roughly $1.5 billion left a cold wallet.

What did not happen is as important as what did:

1. The Safe contracts behaved exactly as specified. No bug was exploited, no assumption was violated.

2. No private key was stolen. The signing devices were not compromised.

3. The multisig threshold was satisfied — by legitimate signers, signing the wrong payload.

The attack did not break the vault. It changed the label on the box the signers were putting in it.

The lesson generalises to every wallet in this library: what protects you is not where the key is stored, it is whether the thing you are approving is the thing you believe you are approving. Verify transaction details on an independent device, and for large transfers verify the destination address through a channel the attacker does not control.

Configuration is the hard part

A 2-of-3 with all three keys in one office is not a multisig, it is a burglary target with extra steps. A 5-of-9 across a group that cannot assemble on short notice is a fund that cannot move in an emergency. Both mistakes are common, and both look fine on the configuration screen.

1. Decide the threshold from a real threat model: who could be compromised, who could be unavailable, who could be hostile.

2. Keep signers geographically and organisationally separate, on different devices and different networks.

3. Rehearse a signer replacement before you need one, on a test deployment with no funds.

4. Set a guard or timelock on transfers above a threshold you choose while calm.

Costs

The protocol itself is free. Deploying the Safe costs gas, and every execution costs gas — more than a simple transfer, because contract execution is more expensive and multiple signatures must be verified on-chain. On Ethereum mainnet that adds up over a year of operations; on an L2 it is negligible.

Verdict

Using it as an individual

Safe is usually described as a team product, and it works well for one person too. A 2-of-3 with a hardware wallet, a phone wallet and a key held by someone you trust gives you something a seed phrase cannot: survivability. Lose the hardware device and you still have access. Lose the phone and you still have access.

The cost is gas on every transaction and a setup that takes an afternoon rather than two minutes. On an L2 that cost is negligible, which has made single-user Safes considerably more practical than they were when mainnet was the only option.

Modules, and the trade-off they carry

Modules extend what a Safe can do: recovery after a period of inactivity, allowances that let a bot spend within limits, automated payments. Each one is code with permission over the vault, and each one widens the surface.

The security of a Safe is the security of its contracts plus every module attached to it. A well-audited multisig with an unaudited module is an unaudited wallet. Add modules deliberately, audit what they can do, and remove the ones you stopped using.

Score: 8.3. The correct answer for shared custody, with a contract record that has survived enormous value and sustained adversarial attention. It scores where it does because the surrounding tooling has been compromised once at catastrophic scale, and because getting the configuration right requires more expertise than most teams bring to it.