Safe

would

The developer of SafeWallet has released a post-mortem report detailing the cybersecurity exploit that led to the $1.4 billion hack against Bybit in February.
According to a forensic <a data-ct-non-breakable="null" href="https://x.com/safe/status/1897663514975649938" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://x.com/safe/status/1897663514975649938">analysis</a> conducted by SafeWallet and cybersecurity firm Mandiant, the hacking group hijacked a Safe developer’s Amazon Web Services (AWS) session tokens to bypass the multifactor authentication security measures put in place by the firm.
SafeWallet’s AWS settings required team members to reauthenticate their AWS session tokens every 12 hours, which prompted the hacking group to attempt a breach by registering a multifactor authentication (MFA) device.
Following several failed attempts at registering an MFA device, the threat actors <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bybit-hack-forensics-show-safe-wallet-compromise-led-to-stolen-funds" rel="noopener noreferrer nofollow" target="null" text="null" title="null">compromised a developer’s MacOS system</a>, likely through malware installed on the system, and were able to use the AWS session tokens while the developer’s sessions were active.
Once the hackers gained access, they worked within the Amazon Web Services environment to set up the attack.
<figure><img alt="Cybercrime, North Korea, Cybersecurity, Hacks, Bybit, Lazarus Group" src="https://s3.cointelegraph.com/uploads/2025-03/01956cd2-6ea0-71bd-9006-365a204fdabc" title="">
 <figcaption style="text-align: center;">
 A timeline of the Safe developer security exploit. Source: <a data-ct-non-breakable="null" href="https://x.com/safe/status/1897663514975649938" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://x.com/safe/status/1897663514975649938">Safe</a>
 </figcaption>
</figure>
Mandiant’s forensic analysis also confirmed that the hackers were North Korean state actors who took 19 days to prepare and execute the attack.
The latest update reiterated that the cybersecurity exploit did not affect Safe’s smart contracts and added that the Safe development team put additional safeguards in place following what was the <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/biggest-crypto-hack-history-bybit-exploit-security-blo" rel="noopener noreferrer nofollow" target="null" text="null" title="null">biggest hack in crypto history</a>.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bybit-hack-leads-crypto-losses-february-certik" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Crypto lost to exploits, scams, hits $1.5B in February with Bybit hack: CertiK</a>
<h2 id="fbi-puts-out-an-alert-as-bybit-hackers-launder-funds">FBI puts out an alert as Bybit hackers launder funds</h2>
The US Federal Bureau of Investigation (FBI) published an online alert <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/fbi-urges-crypto-private-sector-block-bybit-lazarus-laundering" rel="noopener noreferrer nofollow" target="null" text="null" title="null">asking node operators to block transactions</a> from wallet addresses linked to the North Korean hackers, which the FBI said would be laundered and converted to fiat currency.
<figure><img alt="Cybercrime, North Korea, Cybersecurity, Hacks, Bybit, Lazarus Group" src="https://s3.cointelegraph.com/uploads/2025-03/01956cd4-4a91-7cc1-9a38-7d33c98378e3" title="">
 <figcaption style="text-align: center;">
 FBI warning about North Korean hackers behind Bybit hack. Source: <a data-ct-non-breakable="null" href="https://www.ic3.gov/PSA/2025/PSA250226" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://www.ic3.gov/PSA/2025/PSA250226">FBI</a>
 </figcaption>
</figure>
Since that time, the Bybit hackers <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bybit-hacker-launders-1-billion-stolen-funds" rel="noopener noreferrer nofollow" target="null" text="null" title="null">laundered 100% of the stolen crypto</a>, comprising nearly 500,000 Ether-related tokens, in only 10 days.
On March 4, Bybit CEO Ben Zhou said that around 77% of the funds, valued at roughly $1.07 billion, <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bybit-hack-280m-untraceable-1b-trackable-thorchain-okx-exch" rel="noopener noreferrer nofollow" target="null" text="null" title="null">are still traceable</a> onchain, while approximately $280 million have gone dark.
However, Deddy Lavid, CEO of the Cyvers cybersecurity firm, said cybersecurity teams may still be able to trace and freeze some of the stolen funds.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/north-korean-hackers-private-keys-flash-loan-attacks/" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Lazarus Group’s favorite exploit revealed — Crypto hacks analysis</a>

SafeWallet releases Bybit hack post-mortem report

Table of Contents

Cointelegraph

Join our free newsletter for daily crypto updates!