Crypto Catastrophe: How a Wallet Went from Safe to Sorry in a Billion-Dollar Heist!

by

In a twist that could make even the most seasoned soap opera writer raise an eyebrow, Bybit’s CEO, the ever-optimistic Ben Zhou, has unveiled the initial findings of the $1.4 billion Bybit hack. It appears that the dastardly attackers didn’t just waltz in through the front door of Bybit, but rather took a scenic route through the compromised infrastructure of Safe{Wallet}. Who knew wallets could be so… unsafe? 😏

Bybit Hack Forensics Report: As promised, here are the preliminary reports of the hack conducted by @sygnia_labs and @Verichains. Screenshotted the conclusion and here is the link to the full report:

— Ben Zhou (@benbybit) February 26, 2025

According to the report, the hackers, those crafty little devils, managed to snag a Safe developer’s credentials. With these shiny new keys, they inserted a malicious JavaScript into Safe{Wallet}’s app, effectively pulling the wool over Bybit’s Ethereum Multisig Cold Wallet. This nefarious code was cleverly hidden in the app.safe.global website on February 19, 2025, at precisely 15:29:25 UTC. It lay in wait like a cat with a laser pointer until Bybit decided to conduct a routine transaction on February 21, at 14:13:35 UTC, at which point it pounced! 🐱💻

Signers, blissfully unaware, saw a legitimate contract address, but behind the scenes, the JavaScript was playing a game of “let’s redirect funds to the hacker’s wallet.” This operation was so sophisticated it could have been mistaken for a well-rehearsed ballet, with investigations pointing fingers at the infamous North Korean-linked Lazarus Group. Bravo! 👏

Safe{Wallet} Responds

In the wake of this revelation, the crypto community erupted into a debate that could rival any good tavern brawl. Some users, with a wit sharper than a goblin’s tooth, suggested that Safe should consider rebranding as “Unsafe.” Others, more serious in tone, called for a complete overhaul of transaction verification measures. Because, you know, security is kind of important when billions are at stake! 💰

In a bid to save face, Safe{Wallet} issued a public statement, declaring that their smart contracts and front-end services were as untouched as a cat in a sunbeam. They explained that the attack stemmed from a compromised developer machine, which allowed the hackers to slip in disguised malicious transactions. Sneaky, sneaky! 🕵️‍♂️

— Safe.eth (@safe) February 26, 2025

According to Safe{Wallet}’s post, they’ve since rebuilt and reconfigured their entire infrastructure, implementing security measures that would make a fortress look like a cardboard box. They’ve resumed operations on the Ethereum mainnet, albeit with a phased rollout—because who doesn’t love a good suspenseful reveal? A full post-mortem report is expected once the dust settles. 🏰

Bybit Shows Resilience

Despite being the victim of one of the largest cryptocurrency hacks in history, Bybit has shown resilience that would make a phoenix look like a mere sparrow. They’ve quickly restored the stolen $1.4 billion in Ether, launching an aggressive counteroffensive against the hackers. With funds already scattered across over 11,000 cryptocurrency wallets, they’re on a mission to trace and retrieve the stolen loot. 🦸‍♂️

Bybit has introduced a wallet blacklist API to prevent transactions from flagged addresses and has enlisted the help of Web3 security firm ZeroShadow to track down the stolen funds. They’ve even announced a bounty program, offering up to $140 million for information leading to the freezing or recovery of stolen assets. Because nothing says “we mean business” like a hefty reward! 💸

Read More

2025-02-26 21:49