Bybit hack forensics show SafeWallet compromise led to stolen funds

Key Points

  • Bybit hack forensics show SafeWallet compromise led to stolen funds
  • North Korea’s Lazarus Group was behind the attack
  • More than $1.4 billion worth of Ether was stolen
  • Bybit quickly replenished users’ crypto assets and maintained operations

Summary

The recent Bybit exploit, which saw over $1.4 billion worth of Ether stolen, was traced back to compromised credentials of a SafeWallet developer, according to forensic investigations by Sygnia and Verichains. The attack, executed by North Korea's Lazarus Group, involved malicious JavaScript code injected into SafeWallet’s Amazon Web Services infrastructure. Despite the significant breach, Bybit's infrastructure remained uncompromised. In response, SafeWallet has taken extensive measures to secure its systems, including rebuilding and reconfiguring all infrastructure and rotating all credentials. Bybit managed to restore its reserves through loans, asset purchases, and deposits, ensuring no significant downtime and maintaining full backing on client assets. However, the incident has led to a notable drop in investor confidence, affecting Ether and the broader crypto market.

cointelegraph
February 26, 2025
Crypto
Read article

Related news