🚨 BybitForensics Update: $1.5 Billion Hack Traced to Safe{Wallet} Compromise 🚨
On February 21, 2025, Bybit experienced a significant security breach resulting in the loss of approximately $1.5 billion in Ethereum tokens. In-depth forensic investigations have now traced the root cause to a compromised Safe{Wallet} developer machine. This breach allowed North Korea's Lazarus Group to inject malicious code into Safe{Wallet}'s infrastructure, deceiving Bybit's signers into authorizing a fraudulent transaction.
Key Findings:
Compromised Developer Machine: The attack was initiated by compromising a Safe{Wallet} developer's machine, granting unauthorized access to Safe{Wallet}'s infrastructure.
Malicious Code Injection: Malicious JavaScript code was injected into Safe{Wallet}'s AWS infrastructure, specifically targeting Bybit's Ethereum Multisig Cold Wallet.
Transaction Deception: The injected code manipulated transaction data, leading Bybit's signers to unknowingly approve a malicious transaction, resulting in the transfer of $1.5 billion worth of assets to the attackers.
Current Status:
Funds Laundering: The stolen funds are being rapidly laundered through various channels, including decentralized exchanges and cross-chain bridges. Within 48 hours, over $160 million had been funneled through illicit channels.
FBI Involvement: The FBI has attributed the attack to North Korea's TraderTraitor group, also known as the Lazarus Group, and is urging private sector entities to block transactions associated with the stolen funds.
Bybit's Response:
Security Measures: Bybit has confirmed that its infrastructure remains secure and uncompromised.
Bounty Program: The exchange has launched a bounty program to aid in the recovery of the stolen assets and is actively collaborating with security firms and law enforcement agencies.
Industry Implications:
This incident underscores the critical importance of robust security measures, especially concerning third-party integrations. It highlights the need for continuous monitoring and verification of all components within the cryptocurrency ecosystem to prevent similar breaches in the future.
Stay vigilant and ensure your security protocols are up-to-date.
#BybitForensics #CryptoSecurity #LazarusGroup #SafeWallet
