Safe Axes 14 Staff as $1.43B Bybit Hack Fallout Triggers Radical Reorg

Months after one of the largest crypto-related thefts in recent history shook the industry, Safe , a prominent self-custody infrastructure provider, has announced a major internal restructuring.

The company announced on April 16 that 14 employees have been laid off, with co-founder Lukas Schor citing escalating internal complexity.

The decision was made public via an emotional tweet from Lukas, who described the move as the “toughest day since starting Safe.”

Schor emphasized that this was not a reflection of the persons affected, noting that each had contributed meaningfully to the project.

“We take full responsibility for the decisions that led us here,” he wrote on X, referencing himself and fellow co-founders Richard, Christoph, and Tobias.

Schor made it clear that Safe is going above and beyond the legal requirements in handling the layoffs.

Affected team members will receive extended garden leave, increased severance packages, converted linear token vesting, and active support in finding new opportunities within the Ethereum ecosystem.

In his words, “Some of the best talent in crypto is now looking for a place to call home.”

However, the company is now reorganizing into three distinct divisions to better align with its objectives and the demands of the broader ecosystem.

These include a revenue-focused product company, an innovation-centric R&D lab, and an ecosystem-focused foundation.

According to Lukas, each team will have the autonomy to optimize for its core goal and will operate at its own pace, with its own accountability.

From Growth to Exposure: Safe’s Strategic Overhaul Post-Bybit Hack

While the layoff announcement is part of a long-term strategic pivot, it is difficult to dissociate it from the Bybit hack that occurred earlier this year.

In February, a $1.43 billion exploit occurred on Bybit , and an investigation traced it back to a compromised developer machine used by Safe.

Although Safe’s core smart contracts remained unaltered, the attack had a profound impact on the company’s backend systems.

According to a forensic report released by Safe in March, the breach occurred after a malicious Docker project disguised as a “stock investment simulator” was downloaded onto a Safe developer’s MacBook.

This project connected to a suspicious domain, allowing the North Korean-linked TraderTraitor group (also known as UNC4899) to install malware, steal AWS session tokens, and bypass multi-factor authentication.

The developer, who had higher access privileges due to their responsibilities, became the critical vulnerability in an otherwise well-secured environment.

In partnership with Mandiant, a cybersecurity firm now part of Google Cloud, Safe conducted a thorough forensic investigation.

The findings pointed to a highly sophisticated, state-sponsored attack. The group behind it, TraderTraitor, has been linked to multiple high-profile crypto thefts in recent years.

The fallout from the attack was immediate. In addition to reputational damage, Safe had to disable hardware wallet integrations and temporarily reset all infrastructure.

However, as Schor acknowledged, while these enhancements marked an important leap in infrastructure security, the internal burden from operational complexity continued to increase.

Security, Complexity, and the Cost of Scaling

As the broader Ethereum ecosystem matures, the role of foundational tools like Safe has become more critical and more scrutinized.

Projects building on top of Safe demand faster iteration cycles, more resilient services, and a robust development roadmap.

Schor admitted that as Safe scaled its team and expanded its scope, the coordination challenges began to weigh down progress.

“It started to affect our ability to move at the pace we expect of ourselves,” he said.

The company now believes that splitting into three independent units with clear mandates is the best way forward. Each will develop its own culture, cadence, and strategic direction.

For now, Safe is doubling down on its mission with a sharpened focus. While the 14 laid-off employees may represent a small portion of Safe’s overall workforce, their departure marks a key milestone in the company’s journey.