Is there something wrong with Bybit? Security experts: North Korean hacker Lazarus suspected of hacking into exchange employees' computers to gain multi-signature access to wallets

This article is machine translated
Show original
Here is the English translation of the text, with the specified terms preserved: The crypto exchange Bybit reported a hack early this morning, with the loss of around $147 million worth of ETH and stETH, immediately sparking outrage in the community. According to data from Arkham, the hackers converted the assets into around $134 million worth of ETH (499,395 ETH) and $42 million worth of cmETH (15,000 ETH), and distributed the funds across 53 addresses. Although Bybit suffered a devastating loss in this hack, with an Ethereum fund leakage of up to 500,000 ETH, relevant institutions and exchanges are still willing to contribute their efforts to help Bybit overcome the short-term withdrawal surge. Furthermore, on-chain experts have also helped identify the perpetrators of this incident and their modus operandi. Lazarus Group, a North Korean Hacker Organization, is the Culprit After the hacking incident, the on-chain analysis platform Arkham immediately issued a 50,000 ARKM bounty to reward anyone who could identify the perpetrators of the hack. The on-chain detective ZackXBT was the first to submit evidence of the culprits, and the mastermind behind the incident is the well-known North Korean hacker group "LAZARUS GROUP". When asked how much of the stolen funds Bybit could potentially recover through negotiation, ZackXBT stated that in an optimistic scenario, they might be able to recover 15-30% of the funds. OneKey: Bybit Employee Computers Were Likely Compromised Regarding the attack method, cybersecurity expert Yu Xian stated that the attackers first deployed a malicious contract on February 19th, and on February 21st, they used the three owners of the Bybit Safe multi-signature wallet to sign and replace the Safe contract with the malicious one, allowing them to steal the funds from the Bybit wallets. The cold wallet team OneKey further elaborated that the hackers likely confirmed that the three multi-signature computers of Bybit had been compromised, providing the necessary conditions for the attack. They then replaced the signing content during the daily transfer and signing operations of the multi-signature staff. Security Expert: The Bybit Theft is Not an Isolated Incident, There Have Been Multiple Hacks Last Year Yu Xian later tweeted that the Bybit theft incident is not an isolated case, as the North Korean hackers have successfully attacked multiple platforms using similar methods last year, including WazirX ($230 million), Radiant Capital ($50 million), and DMM ($305 million), all involving the exploitation of multi-signature mechanisms.

Source
Disclaimer: The content above is only the author's opinion which does not represent any position of Followin, and is not intended as, and shall not be understood or construed as, investment advice from Followin.
Like
Add to Favorites
Comments
Followin logo