Bybit hack forensics show SafeWallet compromise led to stolen funds
Published
Bybit and the SafeWallet developer confirmed that North Korea’s Lazarus Group was behind the attack.
By Matt BrienenA series of third-party forensic investigations into the recent Bybit exploit revealed that compromised SafeWallet credentials led to more than $1.4 billion worth of Ether
being stolen by North Korea’s Lazarus Group.
On Feb. 26, Bybit confirmed that forensic reviews conducted by Sygnia and Verichains revealed that “the credentials of a Safe developer were compromised [...] which allowed the attacker to gain unauthorized access to the Safe(Wallet) infrastructure and totally deceive signers into approving a malicious transaction.”
According to Sygnia’s report, the attack originated from a “malicious JavaScript code” injected into SafeWallet’s Amazon Web Services infrastructure.
The findings were also confirmed by the SafeWallet developer, which said it had “added security measures to eliminate the attack vector.”
“The Safe(Wallet) team has fully rebuilt, reconfigured all infrastructure, and rotated all credentials, ensuring the attack vector is fully eliminated,” the announcement said.