Safe

Ethereum

Ronin

when

The recent&nbsp;<a href="https://bsc.news/post/the-biggest-bybit-s-1-4-b-crypto-hack-how-it-happened-and-what-s-next">Bybit hack</a>, which led to the theft of over&nbsp;$1.4 billion in Ether, has sparked controversy, with former Binance CEO&nbsp;Changpeng Zhao (CZ) criticizing the&nbsp;<a href="https://x.com/safe/status/1894768522720350673">post-mortem report</a> released by&nbsp;Safe{Wallet}. CZ labeled the report as&nbsp;vague and incomplete, stating that it failed to provide clear answers regarding how the breach occurred.
The&nbsp;Lazarus Group, a notorious North Korean hacking collective, is believed to have orchestrated the attack by&nbsp;compromising a Safe developer’s machine. The hackers inserted&nbsp;malicious JavaScript code into SafeWallet’s Amazon Web Services (AWS) infrastructure, deceiving Bybit’s signers into approving a fraudulent transaction.
<h2 dir="ltr" id="span-span-strong-safe-s-findings-what-the-report-says-strong-span-span">Safe’s Findings: What the Report Says</h2>
Safe’s forensic report concluded that the hack was executed through a&nbsp;compromised developer machine, allowing the attackers to submit a&nbsp;malicious transaction proposal. However, the report stated that the attack was&nbsp;not due to vulnerabilities in Safe’s smart contracts or frontend services.
<h3 dir="ltr" id="span-span-strong-key-takeaways-from-safe-s-report-strong-span-span">Key Takeaways from Safe’s Report:</h3>
<ul>
 <li>The attack targeted&nbsp;Bybit’s Safe Wallet via a&nbsp;compromised Safe developer machine.</li>
 <li>A malicious transaction was submitted, draining funds from Bybit’s wallet.</li>
 <li>External audits found&nbsp;no flaws in Safe’s smart contracts or source code.</li>
 <li>Safe has&nbsp;reconfigured its infrastructure, rotated credentials, and enhanced security.</li>
 <li>Users are urged to exercise&nbsp;caution when signing transactions.</li>
</ul>
Despite these measures, CZ&nbsp;was not convinced and raised multiple concerns about Safe’s explanation.
<h2 dir="ltr" id="span-span-strong-cz-s-criticism-more-questions-than-answers-strong-span-span">CZ’s Criticism: More Questions Than Answers</h2>
CZ <a href="https://x.com/cz_binance/status/1894787596443885698">openly criticized</a> the report, claiming it&nbsp;brushed over key details and left many critical questions unanswered. In a detailed response, he pointed out several&nbsp;gaps in the report’s findings:
<ul>
 <li>What does “compromising a Safe developer machine” mean?CZ questioned how the hackers gained access to this machine—was it&nbsp;social engineering, malware, or a different exploit?</li>
 <li>How did a developer’s machine have access to Bybit’s account?Was&nbsp;code deployed from the compromised machine to production?</li>
 <li>How did the hackers bypass the Ledger verification step at multiple signers?Were the signers&nbsp;blind-signing transactions, or was Ledger’s security bypassed?</li>
 <li>Why was the Bybit wallet specifically targeted?If Bybit’s wallet held&nbsp;$1.4 billion, why didn’t the hackers target other wallets?</li>
 <li>What lessons can other self-custody multi-signature wallet providers learn?CZ called for&nbsp;greater transparency and stronger security protocols to prevent similar attacks.</li>
</ul>
<h2 dir="ltr" id="span-span-strong-safe-co-founder-responds-strong-span-span">Safe Co-Founder Responds</h2>
In response to CZ’s criticism,&nbsp;Martin Köppelmann, co-founder of the&nbsp;Gnosis blockchain network (which developed Safe), <a href="https://x.com/koeppelmann/status/1894792743303479340">attempted</a> to clarify the attack. He explained:
<ul>
 <li>The&nbsp;interface was compromised, not the&nbsp;Safe code itself.</li>
 <li>Hackers&nbsp;modified the interface to trick Bybit into signing a fraudulent transaction.</li>
 <li>The malicious attack was&nbsp;specifically designed to target Bybit’s Safe Wallet.</li>
</ul>
To prevent future incidents, Köppelmann proposed&nbsp;improvements, including:
<ul>
 <li>Enhancing transaction verification on hardware devices.</li>
 <li>Introducing SafeNet, a professional co-signing service to add an extra layer of security.</li>
 <li>Encouraging the use of multiple Safe interfaces to reduce reliance on a single access point.</li>
</ul>
<h2 dir="ltr" id="span-span-strong-sygnia-and-verichains-what-their-investigations-revealed-strong-span-span">Sygnia and Verichains: What Their Investigations Revealed</h2>
To get an independent forensic analysis, Bybit&nbsp;hired Sygnia and Verichains, two leading blockchain security firms. Their investigation concluded that the&nbsp;root cause was a malicious JavaScript injection in Safe’s infrastructure.
<h3 dir="ltr" id="span-span-strong-key-findings-from-sygnia-and-verichains-strong-span-span">Key Findings from Sygnia and Verichains:</h3>
<ul>
 <li>The malicious JavaScript file was introduced on&nbsp;February 19.</li>
 <li>The code&nbsp;specifically targeted Bybit’s<a href="https://bsc.news/post/what-is-ethereum-eth-how-it-works-explained"> Ethereum</a> Multisig Cold Wallet.</li>
 <li>The attackers used&nbsp;social engineering to gain access to SafeWallet’s AWS infrastructure.</li>
 <li>Both firms recommended&nbsp;further investigations to confirm the full extent of the breach.</li>
</ul>
<h2 dir="ltr" id="span-span-strong-bybit-s-response-quick-action-to-protect-users-strong-span-span">Bybit’s Response: Quick Action to Protect Users</h2>
Despite the massive loss, Bybit&nbsp;replenished user funds and&nbsp;continued operations with minimal downtime. To meet withdrawal demands, Bybit&nbsp;borrowed 40,000 ETH from Bitget, which has since been repaid.
The Bybit hack is now&nbsp;one of the largest exploits in crypto history, surpassing the&nbsp;2022 Ronin Network hack and the 2021 Poly Network attack. The Lazarus Group has&nbsp;previously stolen billions from various crypto platforms, often using&nbsp;<a href="https://bsc.news/post/what-are-memecoins-guide-how-they-work-2025">memecoins</a> to launder stolen funds.
This incident highlights the&nbsp;ongoing vulnerabilities in crypto security, especially in&nbsp;self-custody and multi-signature wallets. As CZ pointed out, the industry must&nbsp;learn from these failures and implement&nbsp;stronger security measures to prevent future attacks.
Meanwhile, other crypto platforms remain under attack. Recently, Hong Kong-based crypto entrepreneur Joe Zhou reported a Binance-related scam attempt, where hackers tried to trick him into transferring funds to a fraudulent wallet.

Was $1.4B Bybit Hack Due to Negligence?

Table of Contents

BSCN

Other articles published on Mar 6, 2025

Ripple’s Bold Move: How XRP is Disrupting Cross-Border Payments in Portugal and Brazil

This $7 Billion In XRP Linked to Ripple Chairman Chris Larsen Sparks Discussion

NEOPIN Annual Update: 2024

RENDER and NEAR Approaches Falling Wedge Resistance – Could Breakout Spark a Rally?

Bitcoin (BTC) Share from White House Advisor David Sacks Before the Critical Summit!

BlackRock's Bitcoin Holdings Grow as Market Bounces Back

Join our free newsletter for daily crypto updates!