Hacking

This is Lazarus
They just stole $1.46 billion from #bybit
And they didn’t break the code — they broke the people
Here’s untold story of how they did it (and why no one is truly safe) 👇

1/10
Lazarus is a state-backed North Korean #hacking group
They’ve stolen billions from banks, crypto exchanges, and DeFi protocols
And now, they’ve pulled off the biggest #crypto heist in history
But how? Well...

2/10
There was no code exploit.
No leaked private keys.
Bybit’s own multisig signers approved the transactions.
They thought they were signing a routine transfer.
Instead, they were handing over their entire cold wallet...

3/10
But that raises a terrifying question.
How did Lazarus know exactly who to target?
A multisig wallet requires multiple signers.
If even one refused to sign, the hack would fail.
But they all signed.
That means Lazarus didn’t just hack Bybit…
They knew who to manipulate
4/10
There are only a few ways to get that kind of information.
• Inside job – Someone leaked the signer list.
• Social engineering – Lazarus studied their emails & behavior.
• Device compromise – One or more signers were infected with malware.
This means other exchanges are at risk too...

5/10
Today Lazarus stole 0.42% of all #Ethereum
It means they own
More than the Ethereum Foundation.
More than Vitalik Buterin.
And more than Fidelity.
But laundering that much ETH without detection isn’t easy...

6/10
In previous attacks, Lazarus has used:
• Bridging to other #blockchain
• On-chain mixing services
• OTC trading via illicit brokers
Would they try the same tactics again?

7/10
Investigators quickly flagged the 53 wallets holding the stolen ETH.
Any attempt to cash out or swap funds would immediately raise red flags.
But Lazarus are in no hurry...

8/10
In 2022, Chainalysis found Lazarus still held $55M from hacks six years earlier.
They don’t cash out fast. They wait.
And no one has ever gotten their money back.
Not once.
Lazarus doesn’t negotiate. They don’t return funds.
So what happens to users?

9/10
Bybit’s CEO, Ben Zhou, addressed the crisis publicly:
• “Client funds are 1:1 backed.”
• “We have enough liquidity to cover withdrawals.”
• “All other wallets remain secure.”
So far, no bank run...

10/10
But this isn’t the first time this happened
And it won’t be the last.
So how do you stay safe? Follow these simple steps:

Ransomware Attacks Surge, but Payouts Decline
Despite a significant rise in ransomware attacks in 2024, the total ransom payments from victims dropped by 35%, as more companies and individuals refused to comply with hackers' demands.
According to the Chainalysis Cybercrime Report, ransomware generated less revenue compared to the previous year, even though hacker activity intensified.
Declining Payouts Despite Increasing Attacks
🔹 Total ransomware payments in 2024 reached $813 million, down from a record $1.25 billion in 2023.
🔹 The first half of the year saw a 2.3% increase in successful extortion attempts.
🔹 The Dark Angels Group alone collected $75 million.
🔹 However, in the second half of the year, law enforcement efforts significantly disrupted ransomware operations.
Law Enforcement Crackdowns Disrupt Cybercrime Operations
🔹 Enhanced investigative techniques, sanctions, and asset seizures severely impacted cybercriminal networks.
🔹 The shutdown of the Russian crypto exchange Cryptex and Germany's crackdown on 47 Russian platforms weakened ransomware-related money laundering.
According to Jacqueline Burns Koven, Head of Cyber Threat Intelligence at Chainalysis, criminals became more cautious when moving funds through centralized exchanges (CEX). However, non-KYC platforms remain the preferred method for converting stolen crypto into fiat.

Ransomware Victims Increasingly Refuse to Pay
🔹 Less than 50% of ransomware attacks resulted in payouts.
🔹 Those who did comply paid up to $250,000 in ransom on average.
🔹 With improved tracking tools and stronger investigations, more victims chose not to pay, despite the growing frequency of attacks.
Cybercriminals Adapt to Heightened Security Measures
🔹 Hackers are evolving, developing new tactics to bypass security defenses and pressure victims into paying.
🔹 New ransomware variants are emerging, often derived from leaked, rebranded, or purchased code.
🔹 Attacks are now executed faster, with ransom negotiations starting within hours of data exfiltration.
Ransomware operations now range from state-sponsored hackers to ransomware-as-a-service (RaaS) groups and independent cybercriminals. One of the most notable recent cases was the data theft from cloud service provider Snowflake.
While ransomware tactics continue to evolve, enhanced cybersecurity efforts and law enforcement actions are making it harder for cybercriminals to profit. 🚨

#CyberSecurity , #hacking , #cryptohacks , #cybercrime , #CryptoNewss

Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“