Months after the Bybit hack raised alarm over custodial risks, Safe has laid off 14 employees, citing coordination challenges.
Safe, a self-custody crypto infrastructure provider, has laid off 14 team members as part of a major restructure, months after a $1.43 billion theft from crypto exchange Bybit was traced back to a compromised Safe developer machine.
In an X post on Wednesday, Safe’s co-founder Lukas Schor said the firm is “restructuring the teams and parting ways with 14 teammates, people we deeply respect, who’ve each contributed meaningfully to our journey.” Schor added that the decision was driven by growing complexity within the company and increasing expectations from projects building on Safe.
“Over the past year, complexity has grown. As the ecosystem evolved and opportunities expanded, we scaled our efforts to explore new paths. But that growth came with increased coordination challenges, and over time, it started to affect our ability to move at the pace we expect of ourselves.”
Lukas Schor
Schor said Safe is taking extra steps to support those leaving, listing extended garden leave, increased severance, improved token vesting terms, and job placement support within the Ethereum ecosystem.
The company will now operate through three new teams: a revenue-focused product company, an innovation-focused R&D lab, and an ecosystem-focused foundation, Schor explained. Each “will have autonomy” and be “more focused, more agile, and better aligned with what the ecosystem expects,” the X post reads.
The reorganization comes less than two months after the Bybit theft, which was linked to an attack on a Safe developer environment. In a March article on X, Safe revealed that the North Korean hacking group known as TraderTraitor compromised a Safe{Wallet} developer’s laptop, and used stolen AWS session tokens to bypass multi-factor authentication.
The breach occurred in early February, when a Docker project — posing as a “stock investment simulator” — was downloaded onto Safe developer’s Mac. The project communicated with a suspicious domain, leading to the malware’s installation.
