"Bit ByBit - emulation of the DPRK's largest cryptocurrency heist" published by Elastic. #Bybit, #SafeWallet, #TraderTraitor, #DPRK, #CTI https://www.elastic.co/security-labs/bit-bybit

"Bybit – What Do We Know So Far" published by Sygnia. #Bybit, #SafeWallet, #DPRK, #CTI https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

"How North Korean hackers executed history’s biggest $1.5 billion crypto heist" published by BBC. #Bybit, #SafeWallet, #Youtube, #News, #DPRK, #CTI https://www.youtube.com/watch?v=gpLYnKC3mGk

"Lazarus Group Bybit Heist: C2 forensics" published by Validin. #Bybit, #SafeWallet, #Lazarus, #DPRK, #CTI https://www.validin.com/blog/bybit_hack_infrastructure_hunt/

"In-Depth Technical Analysis of the Bybit Hack" published by NCCGroup. #Bybit, #SafeWallet, #DPRK, #CTI https://www.nccgroup.com/us/research-blog/in-depth-technical-analysis-of-the-bybit-hack/

#SafeWallet confirme que les pirates informatiques nord-coréens de #TraderTraitor ont volé 1,5 milliard de dollars dans le vol #Bybit

#CyberAttaque #CryptoMonnaies #Hackers #Hacking #Pirates #Informatique #AWS

https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html

#SafeWallet published the results of an investigation into #NorthKorea's theft of $1.4 billion worth of ethereum from #Bybit.

https://x.com/safe/status/1897663514975649938

#infosec #mandiant #cybersecurity #crypto #DPRK #TraderTraitor #LazarusGroup

"Investigation Updates and Community Call to Action" published by Safe.eth. #Bybit, #SafeWallet, #UNC4899, #DPRK, #CTI https://archive.is/OxemM

#NorthKorea has finished laundering all of the $1.4 billion worth of crypto it stole from #Bybit into other tokens almost entirely through #ThorChain who made $5.5 million in fees on the laundering effort 👏🏼👏👏🏾.

https://x.com/benbybit/status/1896798476945744010

#LazarusGroup #moneylaundering #crime #Infosec #cybersecurity #DPRK #SafeWallet

this interview w/one of the only #cybersecurity people in the crypto industry who has any idea what he's talking about goes through all the incredible failures at every level of both #Bybit & #SafeWallet (whose main product is #GnosisSafe, AKA "the most important smart contract in the industry"), from the most basic opsec to permissioning to whatever, is a fun time if you're interested in that kind of thing.

tl;dr the whole crypto industry is an absolute clown car. a clown car that stores $1.4 billion in a single account that the entire C-suite can access.

https://www.youtube.com/watch?v=W82FxAK9Acg

#infosec #LazarusGroup #NorthKorea #DPRK #crypto

"On hindsight and risk assessment" published by Privy. #Bybit, #SafeWallet, #DPRK, #CTI https://privy.io/blog/bybit-lookback

"Bybit’s $1.5 Billion Theft Unveiled: Safe{Wallet} Front-End Code Tampered" published by Slowmist. #Bybit, #SafeWallet, #DPRK, #CTI https://slowmist.medium.com/bybits-1-5-billion-theft-unveiled-safe-wallet-front-end-code-tampered-84b78f0fa9c2

"Dissecting the Bybit Cryptocurrency Exchange Malicious UI Spoofing Javascript" published by DanchoDanchev. #Bybit, #SafeWallet, #DPRK, #CTI https://ddanchev.blogspot.com/2025/02/dissecting-bybit-cryptocurrency.html

"BYBIT Interim Investigation Report" published by Sygnia. #Bybit, #SafeWallet, #DPRK, #CTI https://docsend.com/view/s/rmdi832mpt8u93s7

"Bybit Incident Investigation Preliminary Report" published by Verichains. #Bybit, #SafeWallet, #DPRK, #CTI https://docsend.com/view/s/rmdi832mpt8u93s7/

"Safe{Wallet} Statement on Targeted Attack on Bybit" published by Safe.eth. #Bybit, #SafeWallet, #DPRK, #CTI https://archive.is/I3UEz

#Bybit released the conclusions of their investigation into how they got rekt for $1.4 billion by North Korea's #LazarusGroup. Summary:

1. (background) Bybit were dumb enough to store billions of dollars in a single wallet contract using software from a company called SafeWallet (a "Gnosis Safe")

2. A dev machine of SafeWallet (name is lol) was compromised by Lazarus and used to access SafeWallet's cloud data stores (S3)

3. malicious JavaScript was pushed to the cloud drive and eventually distributed in a release (?).

4. The malicious JavaScript code targeted specifically the Bybit contract address to change the content of the transaction during the signing / approval process.

* Bybit reports: https://docsend.com/view/s/rmdi832mpt8u93s7#
* Full Statement from SafeWallet: https://x.com/safe/status/1894768522720350673

in a normal world Bybit could probably sue SafeWallet, but I'm sure SafeWallet barely exists as an entity.

#infosec #cybersecurity #safewallet #gnosissafe #ethereum #DPRK #NorthKorea #crime #hackers #blackhat