Attackers drained approximately $1.5 billion from Bybit after a signed Safe multisig transaction used `delegatecall` to overwrite the wallet proxy's `masterCopy` storage slot. The change redirected the proxy from the legitimate Gnosis Safe implementation to malicious code without altering the wallet's visible address. The attackers then invoked functions that swept the wallet's ETH and ERC-20 holdings, highlighting the need to simulate transactions and monitor critical storage and proxy implementation changes.