文章来源：Elliptic；编译：金色财经xiaozou
2025年2月21日，总部位于迪拜的加密货币交易所Bybit遭遇了约14.6亿美元的加密资产被盗事件。初步报告显示，攻击者使用了恶意软件诱骗交易所批准了将资金转移至窃贼账户的交易。
这是迄今为止规模最大的加密货币盗窃案，远超2021年Poly Network被盗的6.11亿美元（且该案中大部分资金最终被黑客归还）。事实上，这几乎可以确定是有...

<div>文章来源：Elliptic；编译：金色财经xiaozou2025年2月21日，总部位于迪拜的加密货币交易所Bybit遭遇了约14.6亿美元的加密资产被盗事件。初步报告显示，攻击者使用了恶意软件诱骗交易所批准了将资金转移至窃贼账户的交易。这是迄今为止规模最大的加密货币盗窃案，远超2021年Poly Network被盗的6.11亿美元（且该案中大部分资金最终被黑客归还）。事实上，这几乎可以确定是有史以来最大规模的单一盗窃案，此前该纪录的保持者还是萨达姆·侯赛因，他在2003年伊拉克战争前夕从伊拉克中央银行盗取了10亿美元。<img src="https://img.jinse.cn/7351375_watermarknone.png" title="7351375" alt="bHuwMVsBbltBu40yfaW6Bi1DbU1h27RR92VOjTUf.png">Elliptic公司分析了多种因素，包括对被盗加密资产洗钱路径的分析，判断此次Bybit盗窃案的幕后黑手是朝鲜的Lazarus集团。自2017年以来，与朝鲜有关的黑客已窃取了超过60亿美元的加密资产，据称这些资金被用于该国的弹道导弹计划。Lazarus集团已发展出强大而复杂的攻击能力，不仅能入侵目标组织窃取加密资产，还能通过数千笔区块链交易清洗赃款。盗窃发生后，Elliptic与Bybit、加密货币服务提供商及其他调查人员全天候合作，追踪被盗资金并阻止其变现。作为全球领先的加密资产交易和钱包筛查解决方案提供商，Elliptic的软件正在向全球客户发出警示，询问他们是否收到了此次盗窃的赃款。这已直接导致部分从Bybit被盗的资金被冻结。<img src="https://img.jinse.cn/7351376_watermarknone.png" title="7351376" alt="rPdMbA5OKnbgIHppYl2VbxPJg5iZXqQeAGPo78Cj.png">Lazarus集团的洗钱过程通常遵循一个典型模式。第一步是将所有被盗的代币兑换为“原生”区块链资产，如ETH。这是因为代币有发行方，在某些情况下可以“冻结”包含被盗资产的钱包，而ETH或比特币则没有中央机构可以冻结。这正是Bybit盗窃案发生后的几分钟内发生的情况，数亿美元的被盗代币（如stETH和cmETH）被兑换为ETH。攻击者使用去中心化交易所（DEXs）完成这一操作，可能是为了避免在使用中心化交易所洗钱时可能遇到的资产冻结情况。洗钱过程的第二步是对被盗资金进行“分层”，以试图掩盖交易路径。区块链的透明性意味着这些交易路径可以被追踪，但这些分层策略会使追踪过程复杂化，为洗钱者争取宝贵的变现时间。分层过程可以采取多种形式，包括：<ul><li>通过大量加密货币钱包转移资金</li><li>使用跨链桥或交易所将资金转移到其他区块链</li><li>使用DEXs、代币交换服务或交易所在不同加密资产之间切换</li><li>使用“混币器”，如Tornado Cash或Cryptomixer</li></ul>Lazarus集团目前正处于洗钱的第二阶段。盗窃发生后的两小时内，被盗资金被发送到50个不同的钱包，每个钱包持有约10,000 ETH。这些钱包正在被系统性地清空——截至UTC时间2月23日晚上10点，10%的被盗资产（现价值1.4亿美元）已从这些钱包中转移。一旦资金从这些钱包中转移，它们将通过各种服务进行洗钱，包括DEXs、跨链桥和中心化交易所。然而，一个名为eXch的加密货币交易所已成为此次洗钱的主要的自愿协助者。eXch以其允许用户匿名交换加密资产而闻名，这使其被用于交换来自犯罪活动的数亿美元加密资产，包括朝鲜实施的多次盗窃。自黑客攻击以来，价值数千万美元的Bybit被盗加密资产已通过eXch进行交换。尽管Bybit直接提出请求，但eXch仍拒绝阻止这一活动。被盗的ETH正在通过eXch和其他服务逐步转换为比特币。如果遵循以往的洗钱模式，我们可能会看到接下来使用混币器进一步混淆交易路径。然而，由于被盗资金规模巨大，这可能具有一定挑战性。朝鲜的Lazarus集团是现有最“专业”且资源最丰富的加密资产洗钱者，他们不断调整技术以逃避被盗资产被识别和扣押。自Bybit盗窃案发生后的几分钟起，Elliptic团队就与Bybit、客户及其他调查人员全天候合作，追踪这些资金并阻止朝鲜政权从中获益。</div>

历史上最大盗窃案： Bybit 黑客资金流向追踪

Elliptic; compiled by <Jinse Finance xiaozou>
On February 21, 2025, the Dubai-based cryptocurrency exchange Bybit suffered a theft of approximately $1.46 billion in cryptocurrency assets. Preliminary reports indicate that the attackers used malware to trick the exchange into approving the transfer of funds to the thieves' accounts.
This is the largest cryptocurrency theft to date, far exceeding the $611 million stolen from Poly Network in 2021 (most of which was eventually returned by the hacker). In fact, this can be almost certainly attributed to...

Jinse Finance; Bit; ETH; HT; AR; XCH; TOMI; Bybit

The biggest theft in history: Bybit hacker funds tracked

XWeChatTelegramSina WeibooCopy Link
North Korean hackers struck again.
Author: Slow Mist Security Team, Slow Mist Technology
Table of Contents
Toggle
- Background
- On-chain Tracking Analysis
- Attack Method Analysis
- Market Impact
- Conclusion
Background
On the evening of February 21, 2025 Beijing time, according to on-chain detective ZachXBT, a large-scale fund outflow occurred on the Bybit platform. This incident resulted in the theft of over $1.46 billion, making it one of the largest losses in recent years...

SlowMist: Hacker Methods and Questions Behind the Theft of Nearly $1.5 Billion from Bybit

The original culprit is the North Korean hacker group Lazarus Group
OneKey: It is highly likely that the computer of a Bybit employee was hacked
Security expert: The Bybit theft incident is not an isolated case, there have been multiple hacking incidents last year
The cryptocurrency exchange Bybit reported being hacked early this morning, with the theft of approximately $147 million worth of ETH and stETH, immediately causing a stir in the community. According to Arkham's analysis data, the hackers cashed out approximately $134 million worth of ETH (499,395 Bits) after the theft.

Is there something wrong with Bybit? Security experts: North Korean hacker Lazarus suspected of hacking into exchange employees' computers to gain multi-signature access to wallets

The price forecast in this article is based solely on the review of Bitcoin trading data over the past 24 hours and the basic fundamentals of the contract within the next 12 hours. The conclusion is for reference only and does not provide any price indication. DYOR.

Current market background:
- Price: $95,729, the market fluctuates in the range of $94,000 - $96,500.
- Long-short ratio: 0.72, the bullish advantage weakens, and the bearish force increases.
- Liquidation data: $104 million, mainly long positions.
- Funding rate: -0.0004% to 0.03%, close to neutral, slightly bearish.
- ...

The biggest theft in history: Bybit hacker funds tracked

Download app to participate in rewarding events