本期编辑 | 吴说区块链
Bybit 被盗近 15 亿美金 人类历史上金额最大的盗窃案 朝鲜黑客是如何做到的？
2 月 22 日上午，Bybit CEO Ben Zhou 发推表示，自黑客攻击事件以来（10 小时前），Bybit 经历了我们见过的最多的提款数量，总共有超过 35 万笔提款请求，到目前为止，大约有 2100 个提款请求有待处理。总体 99.994% 的提款已完成。整个团队整夜保持清醒...

<div>本期编辑 | 吴说区块链<a href="https://mp.weixin.qq.com/s?__biz=MzI0ODgzMDE5MA==&amp;mid=2247509055&amp;idx=1&amp;sn=73967d36f53e969cb3f65a0b4a0be4f1&amp;scene=21#wechat_redirect" rel="nofollow">Bybit 被盗近 15 亿美金 人类历史上金额最大的盗窃案 朝鲜黑客是如何做到的？</a>2 月 22 日上午，Bybit CEO Ben Zhou 发推表示，自黑客攻击事件以来（10 小时前），Bybit 经历了我们见过的最多的提款数量，总共有超过 35 万笔提款请求，到目前为止，大约有 2100 个提款请求有待处理。总体 99.994% 的提款已完成。整个团队整夜保持清醒，处理和回答了客户的问题和疑虑。Bybit CEO BEN 表示，不幸中的万幸是还可以抗住，公司资产大于 15 亿美金；有一个冷钱包也在 safe 中有近 30 亿美金 USDT，但幸好没有遭到盗币；如果被盗了超过百亿，可能就要考虑卖公司的问题了；此前从来没有发生大的安全事故，可能让公司放松了警惕，还有很多需要升级的安全措施。Coinbase 主管 Conor Grogan 披露数据表示，Bybit 黑客（很可能来自朝鲜）已成为全球第 14 大 ETH 持有者，目前持有约 0.42% 的以太坊代币总供应量，超过了 Fidelity、以太坊联合创始人 Vitalik Buterin 的 ETH 持有量，并且是以太坊基金会 ETH 持有量的 2 倍以上。据 @EmberCN 监测，Bybit 黑客于 1 小时前尝试解质押 1.5 万枚 cmETH，但被 cmETH 提款合约退回。黑客随后在 DODO 平台进行了 cmETH 交易授权，但因流动性不足未能完成交易。分析认为这部分资产有望被拦截。除了这 1.5 万枚 cmETH，Bybit 的被盗 ETH 数量为 49.9 万枚（价值约 13.7 亿美元），被黑客分散存放在 51 个地址中。Lookonchain 发推称，据 CoinMarketCap 数据统计，Bybit 在遭黑客攻击前拥有 162 亿美元储备资产，被盗 14 亿美元资产占比约 8.64%。据 @EmberCN 监测，MEXC 热钱包向 Bybit 冷钱包转款 12,652 枚 stETH (约合 3375 万美元)。Bybit 目前应该是收到了 64,452 枚 ETH (约合 1.7 亿美元) 的借款支援。来自 Bitget、从 Binance 提款的某机构以及 MEXC。某巨鲸或机构从币安向到 Bybit 冷钱包转入 11,800 枚 ETH （价值 3,100 万美元）作为 Bybit 客户提款支持。Bitget CEO Gracy 表示，主动与 Bybit CEO BEN 交流并主动提供帮助，没有要求任何抵押、没有利息、没有时间限制、也没有需要任何承诺，Bybit 不再需要的时候转回即可，目前了解到的情况是 Bybit 流动性已经完善，不需要更多的支持。Bybit CEO BEN 说，Bitget 第一个给出援手，没有任何要求，还有抹茶和派网。OKX 总裁 Hong Fang 表示，与 Bybit 黑客相关地址已被添加到 OKX 的黑名单中，工程师团队正在密切监视这些地址，一旦有资金移动将立即采取行动。我们的团队也正在与 Bybit 团队联系，提供他们在 IT 安全和流动性支持方面的任何帮助。据 Taproot Wizards 联合创始人 Eric Wall 分析，Bybit 被盗事件已基本确认为朝鲜黑客组织 Lazarus Group 所为。据 Chainalysis 2022 年报告，该组织处置被盗资金通常遵循固定模式，整个过程可能持续数年。2022 年的数据显示，该组织仍持有 2016 年攻击所得的 5500 万美元资金，显示其并不急于快速变现。关于被盗资金的处置流程：第一步：将所有 ERC20 代币（包括 stETH 等流动性衍生品）转换为 ETH；第二步：将获得的 ETH 全部兑换为 BTC；第三步：通过亚洲交易所将 BTC 逐步兑换为人民币。分析指出，Bybit 目前通过借款方式补充约 15 亿美元的 ETH 缺口，这一策略可能基于收回被盗资金的期望。但鉴于确认为 Lazarus Group 所为，追回可能性极低，Bybit 将不得不购入 ETH 偿还贷款。长期来看，Bybit 购入 ETH 与 Lazarus Group 抛售 ETH 换取 BTC 的行为或将相互抵消，而 Lazarus Group 获取的 BTC 将在未来数年内逐步转换为卖压。Safe 在社交媒体上针对「ByBit 显示了看似正确的交易信息，然而在链上执行了一个具有所有有效签名的恶意交易」问题回应称：未发现代码库泄露：对 Safe 代码库进行了彻底检查，未发现泄露或修改的证据。未发现恶意依赖项：没有迹象表明 Safe 代码库中的恶意依赖项会影响交易流（即供应链攻击）；在日志中未检测到对基础设施的未经授权的访问；没有其他 Safe 地址受到影响。Safe 表示，目前其暂时暂停了 Safe{Wallet} 功能，以用户确保对 Safe 平台的安全性有绝对的信心。尽管调查显示没有证据表明 Safe{Wallet} 前端本身遭到入侵，但我们正在进行更彻底的审查。慢雾余弦表示，Safe 合约没问题，问题在非合约部分，前端被篡改伪造达到欺骗效果。这个不是个案。朝鲜黑客去年就搞定过好几家，如：WazirX $230M Safe 多签，Radiant Capital $50M Safe 多签，DMM $305M Gonco 多签。这种攻击手法工程化成熟。其他家也需要多注意，多签可能不止 Safe 存在这类攻击点。慢雾首席信息安全官 23pds 表示，Bybit 攻击者一次伪造签名攻击就拿走了 safe owner 权限，推测一定有不止一位的 macOS 或 Windows 电脑被控了，而且攻击者可能在内网呆了有段时间，能监控内部聊天、转账时间等信息。Ethena Labs 创始人@leptokurtic_ 表示，Ethena 处理了最大单日赎回，并在新闻爆发的第一时间内平仓了所有未实现的风险敞口。尽管 Bybit 作为全球第二大衍生品交易所代表了超过 20%的避险敞口，但 USDe 从未出现过低估押金的情况。希望此次事件能够验证为降低使用 OES 托管解决方案用户风险而做出的一些设计决策。Qi Zhou 表示，Bybit 被黑事件引发了大家对多签钱包安全性的深刻反思。在多签交易中，当第一笔交易提交后，后续签名者可能会盲目信任第一个人的交易数据，直接进行签名，而忽略了独立交叉检查的重要性。这种做法实际上违背了多签机制的设计初衷，导致安全隐患。 此次事件的影响非常深远。目前，大部分链上总锁定价值（TVL）的资产都托管在多签管理的合约中，包括跨链桥、DeFi 协议等核心基础设施。如果在合约管理过程中缺乏严格的审核和操作规范，类似的安全事件很可能会再次发生。因此，行业需要重新审视多签流程的安全性，确保每一步都经过独立验证，避免因信任盲区而引发风险。硬件钱包开发商 Keystone 表示，长期以来，对于诸如 Safe 这样的多签方案，硬件钱包用户往往只能“盲目”签署交易，而无法真正核验自己在确认什么。在前端受到攻击的情况下，硬件钱包就是用户的最后一道防线。现在，Keystone 联合 SlowMist、BlockSec、Offside Labs，希望与 Safe 合作，推动硬件钱包在 Safe 交易中的安全可视化，彻底解决盲签的历史遗留问题，让用户真正看清自己签署的内容。同时，也希望与交易所 Binance、OKX、Bitget、Bybit 等合作，为冷钱包的多签工作流打造更完善的安全方案，确保在更复杂的资产管理场景下，资产始终受到严格保护。据 SoSoValue 统计以及链上安全团队 TenArmor 的最新监测数据显示，Bybit 交易平台在过去 12 小时内（截止北京时间 2 月 22 日下午）共计流入资金超过 40 亿美元，具体包括 63,168.08 枚 ETH、31.5 亿美元的 USDT、1.73 亿美元的 USDC 和 5.25 亿美元的 CUSD。根据比较资金流入数据，此次资金流入已完全覆盖昨日因黑客攻击所导致的损失。同时，Bybit 交易所的各项服务，包括提现功能，均已恢复正常。Bybit CEO BEN 表示在被黑的关键时刻获得了这些企业的帮助：比特大陆旗下的 Antalpha、Bitget、Pionex、MEXC、Mirana、Sosovalue、Solana 基金会、TON 基金会、Blockchain Center Dubai、Ghaf Capital、Bitvavo、Tether、Galaxy。DWF Labs 合伙人 Andrei Grachev 在 X 上表示，Bybit 的黑客事件非常严重，必须进行彻底调查。目前 DWF Labs 尚未从 Bybit 提出任何提款请求，并表示如果需要，他们愿意提供 ETH 支持。他还提到，十分好奇 Vitalik 会如何处理此事，回顾十年前，Vitalik 曾推动以太坊在 DAO 黑客事件后回滚交易。OKX 总裁 Hong Fang 表示，与 Bybit 黑客相关地址已被添加到 OKX 的黑名单中，工程师团队正在密切监视这些地址，一旦有资金移动将立即采取行动。我们的团队也正在与 Bybit 团队联系，提供他们在 IT 安全和流动性支持方面的任何帮助。Mask Network 创始人 Suji Yan 表示已将一些 ETH 存回 Bybit，公开地址大概还有不到 1000 万美金，会持续支持希望可以共渡难关。Conflux 联合创始人 Forgiven 也表示注册了 Bybit 并完成 KYC，将 ETH 充值已表示支持，但不建议普通用户效仿，建议等 24–72 小时稳定后再重返 Bybit。火币联合创始人杜均也表示会充值 1 万 ETH 到 Bybit， 并且一个月内不会提出。北京时间 2 月 22 日下午，ZachXBT 表示，Bybit 事件中的 Lazarus Group 转移了 5000 个 ETH 到新地址，并通过 eXch（一个中心化混币器）洗钱，且通过 Chainflip 将资金桥接到比特币。Bybit CEO Ben Zhou 表示，其监测到黑客正试图通过 Chainflip 转移 BTC。希望跨链桥项目帮助 Bybit 阻止并防止进一步将资产转移到其他链。Bybit 将很快向任何帮助其阻止或追踪导致资金追回的资金的人发布赏金计划。2 月 22 日下午，据 @EmberCN 消息，已有 5 家机构/个人向 Bybit 提供总计 12 万枚 ETH（约 3.21 亿美元）的借款支援。Bitget：40,000 ETH（约 1.06 亿美元）；从币安提款的机构/鲸鱼：11,800 ETH（约 3102 万美元）；MEXC：12,652 stETH（约 3375 万美元）；币安或另一个从币安提款的机构/鲸鱼：36,000 ETH（约 9654 万美元）；0x327…45b 地址：20,000 ETH（约 5370 万美元）。据 Ethescan 浏览器，由 Mantle 支持的 mETH Protocol 通过管理权限从 Bybit Exploiter 4 中抢救回了 1.5 万枚 cmETH，价值约 4,276 万美元。在早先时候，mETH Protocol 表示 cmEH 提现已恢复。（被误认为是黑客销毁）mETH Protocol 在 X 上发文回应，针对 Bybit 安全事件，团队采取多项应急措施以减轻影响。首先，协议内置的 8 小时提款延迟机制成功为团队争取了宝贵的响应时间，及时暂停了 cmETH 提款，阻止了未经授权的提现行为。其次，mETH Protocol 对黑客的钱包地址进行了黑名单处理，有效阻止了进一步的 cmETH 转账及其在协议中的操作。此外，协议还减少了在 Mantle 网络 L2 上的 cmETH 流动性。最终，mETH Protocol 成功从黑客地址回收了 15,000 cmETH，恢复了 cmETH 供应的完整性。CZ 发文表示，有些人质疑我提出的停止所有提款作为标准安全预防措施的建议，我的目的是根据我的经验和观察分享一种实用的方法，但这两种方法都没有绝对的对错。我的指导原则始终是倾向于更安全的一面。发生任何安全事件后，暂停一切，确保我们完全了解发生了什么，黑客如何侵入系统，哪些设备被入侵，再三检查一切是否安全，然后恢复运营。当然，暂停提款可能会引起更多恐慌。我的推文是为了分享什么可能有效，我的目的是及时表示支持。我相信 Ben 根据他掌握的信息做出了最好的决定。Bybit CEO BEN 在 X 上发文表示，“我同意 CZ 的观点，如果此次黑客攻击是通过渗透我们的内部系统或热钱包被攻破，我们会立即暂停所有提现，直到找到问题的根本原因。但昨天被攻破的是我们的 ETH 冷钱包，这与我们的任何内部系统无关。因此，我可以果断决定让 Bybit 的所有提现和系统功能照常运行。” BEN 还强调，“在昨晚的危机中，Binance 和 CZ 以及许多合作伙伴和行业领袖都主动提供了帮助，我们对此深表感激”。据 GreekLive，尽管 Bybit 发生了 15 亿美元以太坊被盗事件，整体市场情绪仍保持谨慎乐观。市场认为黑客事件的影响可控，关键支撑位集中在 9.5–9.6 万美元区间。币安和 Bitget 已提供紧急流动性支持，交易者积极售出低波动率期权（29% 波动率），表明对进一步下跌的担忧有限。预期市场将快速恢复并回归均值。Tether CEO Paolo Ardoino 在 X 上表示，已冻结与 ByBit 黑客事件相关的 18.1 万 USDT。尽管金额不大，但这是一项正当的工作，Tether 将继续监控情况。Bybit 现正式启动“赏金追回计划”，面向全球网络安全和加密分析领域的精英发出号召，共同追查加密历史上最大规模盗窃案的肇事者。成功追回资金的贡献者将获得 10% 的奖励，赏金总额基于事件发生时价值超过 14 亿美元的被盗 ETH 的可验证追回金额计算。若全部资金追回，赏金总额可能高达 1.4 亿美元。Bybit CEO Ben Zhou 表示，“希望通过“赏金追回计划”正式奖励那些为我们提供专业知识、经验和支持的社区成员，我们不会止步于此。”有意参与“赏金追回计划”的个人或组织，请发送电子邮件至：bounty_program@bybit.com<a href="https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&amp;mid=2247501246&amp;idx=1&amp;sn=eafc7080cc28d1f8bf16c362f3ac2230&amp;scene=21#wechat_redirect" rel="nofollow">慢雾</a>文章：在本次事件中，Safe 合约没问题，问题在非合约部分，前端被篡改伪造达到欺骗效果。这个不是个案。朝鲜黑客去年就以此方式攻击了好几个平台。但疑问包括：攻击者可能事先获取了 Bybit 内部财务团队的操作信息，掌握了 ETH 多签冷钱包转账的时间点？通过 Safe 系统，诱导签名者在伪造界面上签署恶意交易？Safe 的前端系统是不是被攻破并被接管了？签名者在 Safe 界面上看到的是正确的地址和 URL，但实际签名的交易数据已被篡改？关键问题在于：是谁最先发起签名请求？其设备安全性如何？北京时间 2 月 22 日晚间，链上记录显示，疑似 Bybit 的地址（0x2E…1b77）在 10 小时前从 0xEC…B5E76 收取 1 亿枚 USDT，并在 7 小时前分别向 Galaxy Digital 和 FalconX 的 OTC 地址转入 5000 万美元，购得共计 3.69 万枚 ETH，并在 1 小时（北京时间 22:32）前存入了 Bybit。<a href="https://mp.weixin.qq.com/s?__biz=Mzk0OTI3NDAzMQ==&amp;mid=2247485411&amp;idx=1&amp;sn=8f5266fd1bd4ab09fefbeb7c5f3b4dd9&amp;scene=21#wechat_redirect" rel="nofollow">Cobo</a> 文章指出，Bybit 事件不仅暴露了具体的操作漏洞，更揭示了当前数字资产托管体系的架构性缺陷。Bybit 事件暴露出传统多重签名安全的根本缺陷 — — 没有独立的交易验证层，攻击者可以操纵界面、合约逻辑和交易数据来欺骗签名者。Bybit 事件暴露出传统多重签名安全的根本缺陷 — — 没有独立的交易验证层，攻击者可以操纵界面、合约逻辑和交易数据来欺骗签名者。Cobo 正在推动与各大硬件钱包厂商的深度合作，在保留其原有安全方案的基础上，构建独立的第三方签名审查通道。</div>

历史最大盗窃案第二日：Bybit 自救与行业集体支援；朝鲜黑客将如何变现；反思当下的安全模式

<The editor of this issue | Wu Blockchain>
Bybit was stolen of nearly $150 million, the largest theft in human history. How did the North Korean hackers do it?
On the morning of February 22nd, Bybit CEO Ben Zhou tweeted that since the hacking incident (10 hours ago), Bybit has experienced the most withdrawal requests we've ever seen, with a total of over 350,000 withdrawal requests, and so far about 2,100 withdrawal requests are still pending. Overall, 99.994% of the withdrawals have been completed. The entire team has remained awake all night...

<div>This issue's editor | Wu Blockchain<a href="https://mp.weixin.qq.com/s?__biz=MzI0ODgzMDE5MA==&amp;mid=2247509055&amp;idx=1&amp;sn=73967d36f53e969cb3f65a0b4a0be4f1&amp;scene=21#wechat_redirect" rel="nofollow">Bybit was stolen nearly $1.5 billion, the largest theft in human history. How did the North Korean hackers do it?</a>On the morning of February 22, Bybit CEO Ben Zhou tweeted that since the hacking incident (10 hours ago), Bybit has experienced the most withdrawal requests we've ever seen, with a total of over 350,000 withdrawal requests, and about 2,100 withdrawal requests are still pending. Overall, 99.994% of the withdrawals have been completed. The entire team has been awake all night, handling and responding to customer questions and concerns.Bybit CEO BEN said that the fortunate thing is that they can still withstand it, as the company's assets are greater than $1.5 billion; they also have a cold wallet with nearly $3 billion USDT in safe, but fortunately it was not stolen; if more than $10 billion was stolen, they might have to consider selling the company; they have never had a major security incident before, which may have made the company let its guard down, and there are still many security measures that need to be upgraded.Coinbase executive Conor Grogan disclosed data showing that the Bybit hacker (likely from North Korea) has become the 14th largest ETH holder globally, currently holding about 0.42% of the total Ethereum token supply, exceeding the ETH holdings of Fidelity and Ethereum co-founder Vitalik Buterin, and more than double the ETH holdings of the Ethereum Foundation.According to monitoring by @EmberCN, the Bybit hacker attempted to unstake 15,000 cmETH 1 hour ago, but was rejected by the cmETH withdrawal contract. The hacker then authorized a cmETH transaction on the DODO platform, but was unable to complete the transaction due to lack of liquidity. It is analyzed that this part of the assets is likely to be intercepted. In addition to these 15,000 cmETH, the amount of ETH stolen from Bybit is 499,000 (worth about $1.37 billion), which the hacker has dispersed across 51 addresses.Lookonchain tweeted that according to CoinMarketCap data, Bybit had $16.2 billion in reserve assets before the hacking attack, and the $140 million in stolen assets accounted for about 8.64% of that.According to monitoring by @EmberCN, the MEXC hot wallet transferred 12,652 stETH (about $33.75 million) to the Bybit cold wallet. Bybit should have now received a loan of 64,452 ETH (about $170 million) in support. This comes from Bitget, an institution that withdrew from Binance, and MEXC. A whale or institution transferred 11,800 ETH (worth $31 million) from Binance to the Bybit cold wallet to support Bybit customer withdrawals.Bitget CEO Gracy said that he actively communicated with Bybit CEO BEN and actively provided assistance, without requiring any collateral, interest, time limit, or any commitment, and Bybit can return it whenever they no longer need it. The current understanding is that Bybit's liquidity has been improved and no longer needs more support. Bybit CEO BEN said that Bitget was the first to lend a hand, without any requirements, and there were also Matcha and Dapp.net.OKX President Hong Fang said that the addresses related to the Bybit hacker have been added to OKX's blacklist, and the engineering team is closely monitoring these addresses, and will take immediate action if there is any movement of funds. Our team is also in contact with the Bybit team, providing them with any assistance in IT security and liquidity support.According to analysis by Taproot Wizards co-founder Eric Wall, the Bybit theft has been basically confirmed to be the work of the North Korean hacker group Lazarus Group. According to Chainalysis' 2022 report, the organization usually follows a fixed pattern in disposing of stolen funds, and the entire process may last for years. The 2022 data shows that the organization still holds $55 million in funds from the 2016 attack, indicating that they are not in a hurry to cash out quickly.Regarding the disposal process of the stolen funds: the first step is to convert all ERC20 tokens (including stETH and other liquidity derivatives) into ETH; the second step is to convert all the obtained ETH into BTC; the third step is to gradually convert the BTC into RMB through Asian exchanges.The analysis points out that Bybit has currently supplemented the ETH gap of about $1.5 billion through borrowing, which may be based on the expectation of recovering the stolen funds. But given that it has been confirmed to be the work of the Lazarus Group, the possibility of recovery is extremely low, and Bybit will have to buy ETH to repay the loans. In the long run, Bybit's purchase of ETH and Lazarus Group's sale of ETH to convert to BTC may offset each other, and the BTC obtained by Lazarus Group will be gradually converted into selling pressure over the next few years.Safe responded on social media regarding the issue of "Bybit displayed seemingly correct transaction information, but executed a malicious transaction with all valid signatures on-chain": No code repository leakage was found: a thorough check of the Safe code repository found no evidence of leakage or modification. No malicious dependencies were found: there are no signs that malicious dependencies in the Safe code repository will affect the transaction flow (i.e., supply chain attacks); unauthorized access to the infrastructure was not detected in the logs; no other Safe addresses were affected.Safe said that it has temporarily suspended the Safe{Wallet} function for the time being to ensure that users have absolute confidence in the security of the Safe platform. Although the investigation shows no evidence that the Safe{Wallet} front-end itself has been compromised, we are conducting a more thorough review.Slow Mist Cosine said that the Safe contract is not the problem, the problem is in the non-contract part, the front-end has been tampered with and forged to achieve a deceptive effect. This is not an isolated case. North Korean hackers have already dealt with several companies last year, such as: WazirX $230M Safe multi-signature, Radiant Capital $50M Safe multi-signature, DMM $305M Gonco multi-signature. This attack method has been industrialized and mature. Other companies also need to pay more attention, and multi-signature may not only exist in Safe.Ethena Labs founder @leptokurtic_ said that Ethena handled the largest single-day redemption, and closed out all unrealized risk exposures within the first moments of the news breaking. Although Bybit, as the world's second-largest derivatives exchange, represents over 20% of the hedging exposure, USDe has never experienced an undercollateralized situation. It is hoped that this incident will validate some of the design decisions made to reduce user risk in using OES custodial solutions.Qi Zhou said that the Bybit hacking incident has led to a deep reflection on the security of multi-signature wallets. In multi-signature transactions, when the first transaction is submitted, the subsequent signers may blindly trust the transaction data of the first person and sign directly, ignoring the importance of independent cross-checking. This practice actually violates the original design intent of the multi-signature mechanism, leading to security vulnerabilities. The impact of this incident is far-reaching. Currently, most of the on-chain total locked value (TVL) assets are managed by multi-signature contracts, including cross-chain bridges, DeFi protocols and other core infrastructure. If there is a lack of strict review and operational norms in the contract management process, similar security incidents are likely to occur again. Therefore, the industry needs to re-examine the security of the multi-signature process, ensuring that each step is independently verified to avoid risks caused by blind trust.Hardware wallet developer Keystone said that for a long time, for multi-signature solutions like Safe, hardware wallet users have often had to "blindly" sign transactions without being able to truly verify what they are confirming. In the case of front-end attacks, the hardware wallet is the user's last line of defense. Now, Keystone is working with SlowMist, BlockSec, and Offside Labs, hoping to collaborate with Safe to promote the security visualization of hardware wallets in Safe transactions, completely solving the historical problem of blind signing, and allowing users to truly see what they are signing. At the same time, it also hopes to work with exchanges like Binance, OKX, Bitget, and Bybit to build more complete security solutions for cold wallet multi-signature workflows, ensuring that assets are always strictly protected in more complex asset management scenarios.</div>Here is the English translation of the text, with the specified terms translated as requested:

According to statistics from SoSoValue and the latest monitoring data from the on-chain security team TenArmor, the <Bybit> trading platform has received over $4 billion in inflows in the past 12 hours (as of 2:00 pm Beijing time on February 22), including 63,168.08 ETH, $3.15 billion in <Tether> (<USDT>), $173 million in <USDC>, and $525 million in <CUSD>. Based on the comparison of inflow data, this inflow has fully covered the losses caused by the hacker attack yesterday. At the same time, all services of the <Bybit> exchange, including the withdrawal function, have resumed normal operation.<Bybit> CEO BEN stated that they received help from these companies at the critical moment when they were hacked: Antalpha under <Bit>coin, <Bitget>, <Pionex>, <MEXC>, Mirana, <Sosovalue>, <Solana> Foundation, <TRON> Foundation, Blockchain Center Dubai, Ghaf Capital, <Bitvavo>, <Tether>, and Galaxy.<DWF Labs> partner Andrei Grachev stated on <X> that the <Bybit> hacking incident is very serious and must be thoroughly investigated. Currently, <DWF Labs> has not made any withdrawal requests from <Bybit> and stated that they are willing to provide <ETH> support if needed. He also mentioned that he is very curious to see how <Vitalik> will handle this matter, recalling that 10 years ago, <Vitalik> had pushed for the Ethereum rollback of transactions after the <DAO> hacking incident.<OKX> President Hong Fang stated that the addresses related to the <Bybit> hacker have been added to the OKX blacklist, and the engineering team is closely monitoring these addresses. If there is any movement of funds, they will take immediate action. Their team is also in contact with the <Bybit> team, offering any assistance in IT security and liquidity support.<Mask Network> founder Suji Yan stated that he has deposited some <ETH> back into <Bybit>, and the public address still has less than $10 million, and he will continue to support them in hopes of getting through the difficult time. <Conflux> co-founder Forgiven also stated that he has registered with <Bybit> and completed KYC, and has deposited <ETH> to show his support, but does not recommend ordinary users to imitate, and suggests waiting 24-72 hours for stabilization before returning to <Bybit>. Huobi co-founder Du Jun also stated that he will deposit 10,000 <ETH> into <Bybit> and will not withdraw within a month.On the afternoon of February 22, Beijing time, ZachXBT stated that the <Lazarus Group> involved in the <Bybit> incident transferred 5,000 <ETH> to a new address and laundered the funds through <eXch> (a centralized mixer) and then bridged the funds to <BTC> through <Chainflip>. <Bybit> CEO Ben Zhou stated that they have detected that the hacker is trying to transfer <BTC> through <Chainflip>. They hope that the cross-chain bridge projects will help <Bybit> stop and prevent further transfer of assets to other chains. <Bybit> will soon release a bounty program to reward anyone who helps them stop or track down and recover the stolen funds.On the afternoon of February 22, according to @EmberCN, 5 institutions/individuals have provided a total of 120,000 <ETH> (about $321 million) in loan support to <Bybit>. <Bitget>: 40,000 <ETH> (about $106 million); an institution/whale that withdrew from <Binance>: 11,800 <ETH> (about $31.02 million); <MEXC>: 12,652 <stETH> (about $33.75 million); <Binance> or another institution/whale that withdrew from <Binance>: 36,000 <ETH> (about $96.54 million); address 0x327...45b: 20,000 <ETH> (about $53.7 million).According to the Etherscan browser, the <mETH Protocol> supported by <Mantle> has rescued 15,000 <cmETH>, worth about $42.76 million, from the <Bybit Exploiter 4>. Earlier, the <mETH Protocol> had stated that the <cmETH> withdrawal had been resumed (mistakenly thought to have been destroyed by the hacker).The <mETH Protocol> responded on <X>, stating that they have taken multiple emergency measures to mitigate the impact of the <Bybit> security incident. First, the protocol's built-in 8-hour withdrawal delay mechanism successfully bought the team valuable response time, temporarily suspending <cmETH> withdrawals and preventing unauthorized withdrawals. Second, the <mETH Protocol> has blacklisted the hacker's wallet addresses, effectively preventing further <cmETH> transfers and operations within the protocol. In addition, the protocol has also reduced the <cmETH> liquidity on the <Mantle> network L2. Ultimately, the <mETH Protocol> successfully recovered 15,000 <cmETH> from the hacker's address, restoring the integrity of the <cmETH> supply.<CZ> posted that some people questioned his suggestion of suspending all withdrawals as a standard security precaution measure. His intention was to share a practical approach based on his experience and observations, but both methods do not have absolute right or wrong. His guiding principle is always to lean towards the safer side. After any security incident, he suggests pausing everything, ensuring a full understanding of what happened, how the hacker infiltrated the system, and which devices were compromised, thoroughly checking everything for safety, and then resuming operations. Of course, suspending withdrawals may cause more panic. His tweet was to share what might be effective, and his intention was to express support in a timely manner. He believes Ben made the best decision based on the information he had.<Bybit> CEO BEN posted on <X> that "I agree with CZ's view. If this hacker attack was through the penetration of our internal system or hot wallet, we would immediately suspend all withdrawals until we find the root cause. But yesterday, the attacked wallet was our <ETH> cold wallet, which is unrelated to any of our internal systems. Therefore, I can decisively decide to allow all withdrawals and system functions of <Bybit> to operate normally." BEN also emphasized, "During last night's crisis, <Binance> and <CZ>, as well as many partners and industry leaders, actively offered help, and we are deeply grateful for that."According to <GreekLive>, despite the $150 million <ETH> theft incident at <Bybit>, the overall market sentiment remains cautiously optimistic. The market believes the impact of the hacking incident is manageable, with key support levels concentrated in the $95,000-$96,000 range. <Binance> and <Bitget> have provided emergency liquidity support, and traders are actively selling low-volatility options (29% volatility), indicating limited concerns about further downside. The market is expected to recover quickly and return to the mean.<Tether> CEO Paolo Ardoino stated on <X> that they have frozen 181,000 <USDT> related to the <Bybit> hacker incident. Although the amount is not large, this is a legitimate action, and <Tether> will continue to monitor the situation.<Bybit> has officially launched a "Bounty Recovery Program", calling on global cybersecurity and crypto analysis experts to jointly investigate the perpetrator of the largest crypto theft in history. Contributors who successfully recover the funds will receive a 10% reward, with the total bounty amount calculated based on the verifiable recovered amount of the stolen <ETH> valued at over $140 million at the time of the incident. If all funds are recovered, the total bounty could reach $14 million. <Bybit> CEO Ben Zhou stated, "We hope to formally reward those community members who have provided us with professional expertise, experience, and support through the 'Bounty Recovery Program', and we will not stop there."<Slow Mist> article: In this incident, the Safe contract was not the problem, the issue was in the non-contract part, where the front-end was tampered with to achieve a deceptive effect. This is not an isolated case. North Korean hackers have attacked several platforms in this way last year. But the questions include: Did the attacker possibly obtain the operation information of <Bybit>'s internal finance team in advance, mastering the timing of the <ETH> multi-signature cold wallet transfer? Through the Safe system, did they induce the signers to sign malicious transactions on the forged interface? Was the Safe front-end system compromised and taken over? The signers saw the correct address and URL on the Safe interface, but the transaction data they signed had been tampered with. The key question is: Who initiated the signing request first? How secure was their device?On the evening of February 22, Beijing time, on-chain records show that a suspected <Bybit> address (0x2E...1b77) received 100 million <USDT> from 0xEC...B5E76 10 hours ago, and transferred $50 million each to the OTC addresses of <Galaxy Digital> and <FalconX> 7 hours ago, buying a total of 36,900 <ETH>, and deposited them into <Bybit> 1 hour ago (10:32 pm Beijing time).<a href="https://mp.weixin.qq.com/s?__biz=Mzk0OTI3NDAzMQ==&amp;mid=2247485411&amp;idx=1&amp;sn=8f5266fd1bd4ab09fefbeb7c5f3b4dd9&amp;scene=21#wechat_redirect" rel="nofollow">Cobo</a> article points out that the Bybit incident not only exposed specific operational vulnerabilities, but also revealed the architectural defects in the current digital asset custody system. The Bybit incident exposed the fundamental flaw of traditional multi-signature security - the lack of an independent transaction verification layer, allowing attackers to manipulate the interface, contract logic and transaction data to deceive the signers. Cobo is promoting in-depth cooperation with major hardware wallet manufacturers, and on the basis of retaining their original security solutions, it is building an independent third-party signature review channel.

The second day of the largest theft in history: Bybit's self-rescue and industry collective support; how will North Korean hackers cash out; reflect on the current security model

Vietnam is becoming one of the countries with the highest level of interest in cryptocurrency, with about 17 million people owning this type of asset. Against the backdrop of an increasingly...

How will Vietnam tax cryptocurrencies?

Let's see how tariffs are "linked" to crypto asset prices, and the story behind it.

Written by: Crypto.com
Compiled by: Plain Blockchain

In the grand stage of the global economy, a policy in one field often creates unexpected ripples like a stone thrown into water. Tariffs, as a long-standing tool for regulating international trade, have long been familiar in their impact on traditional financial markets. But with the rise of this "new player" of crypto assets, what relationship exists between trade policies and digital asset prices?

In early February 2025, U.S. President Trump announced new tariffs on Canada and Mexico...

How tariffs could shake up crypto asset prices

Binance launches Binance Megadrop, a new token issuance platform with Airdrop and Web3 tasks. Users can register BNB into locked products and/or complete tasks in Web3 Wallet to...

Ethereum spot ETF had a total net outflow of $13.0915 million yesterday, the first net outflow after net inflows in the past 4 days

Download app to participate in rewarding events