Theft of $1.4b from Bybit Traced to Hacked Safe User Interface

An autonomous examination has verified that North Korea's Lazarus Group breached Safe's infrastructure to manipulate Bybit's ethereum wallet.

A forensic analysis performed by Sygnia Labs and Verichain revealed that Bybit's security was not compromised despite an assault on its Ethereum (ETH) cold wallet on Feb. 21.

Last week, the Dubai-based cryptocurrency exchange reported the theft of over 400,000 ethereum, valued at around $1.4 billion, from its multi-signature wallet provided by Safe. Initial conjecture suggested that one of Bybit's signatories had been compromised by Lazarus. However, the post-mortem audit traced the origin of the issue to a developer machine belonging to Safe.

"They replaced the Gnosis Safe UI with JS code that specifically targeted Bybit's cold wallet," Haseeb Qureshi, managing partner at Dragonfly clarified.

This implies that Lazarus successfully infiltrated a Safe developer with access to unique frontend deployment credentials, enabling malicious actors to disguise harmful transactions.

Bybit Hack Forensics Report
As committed, here are the initial findings of the hack conducted by @sygnia\_labs and @Verichains
Screen captured the conclusion and here is the link to the full report: [REMOVED] pic.twitter.com/[REMOVED]

Safe acknowledged the findings, reiterating that Bybit's security was not breached while confirming the attack vector. The protocol also stated that its internal investigation found no weaknesses in the Safe smart contracts or source code.

Read More: "UK Proposes Law Expanding Judicial Authority in Cryptocurrency Evidence Retrieval"

In response to the recent event, the Safe{Wallet} team has carried out a comprehensive investigation and have now reinstated Safe{Wallet} on the Ethereum mainnet with a phased implementation. The Safe team has completely reconstructed, reconfigured all infrastructure, and rotated all credentials, ensuring the eradication of the attack vector.

Safe post mortem

Martin Koeppelmann, co-founder of Gnosis, the team responsible for Safe, expressed gratitude to Bybit CEO Ben Zhou for his leadership throughout the crisis. Koeppelmann underscored the necessity for additional security measures and reducing dependence on web2 technology to prevent future occurrences of similar incidents.

Safe always prioritizes security. Including securing its web frontend. It was still breached. We need to add more layers of security like:
* making it easy to verify transactions independently of what is displayed on the front end
* having additional processes to co-sign that also perform... https://t.co/[REMOVED]

Read More: "MSTR Shares Dip 5% due to Premium Slide to 1.6 following Bitcoin Price Decline"