Safe

Ethereum

Ronin

when

The recent&nbsp;<a href="https://bsc.news/post/the-biggest-bybit-s-1-4-b-crypto-hack-how-it-happened-and-what-s-next">Bybit hack</a>, which led to the theft of over&nbsp;$1.4 billion in Ether, has sparked controversy, with former Binance CEO&nbsp;Changpeng Zhao (CZ) criticizing the&nbsp;<a href="https://x.com/safe/status/1894768522720350673">post-mortem report</a> released by&nbsp;Safe{Wallet}. CZ labeled the report as&nbsp;vague and incomplete, stating that it failed to provide clear answers regarding how the breach occurred.
The&nbsp;Lazarus Group, a notorious North Korean hacking collective, is believed to have orchestrated the attack by&nbsp;compromising a Safe developer’s machine. The hackers inserted&nbsp;malicious JavaScript code into SafeWallet’s Amazon Web Services (AWS) infrastructure, deceiving Bybit’s signers into approving a fraudulent transaction.
<h2 dir="ltr" id="span-span-strong-safe-s-findings-what-the-report-says-strong-span-span">Safe’s Findings: What the Report Says</h2>
Safe’s forensic report concluded that the hack was executed through a&nbsp;compromised developer machine, allowing the attackers to submit a&nbsp;malicious transaction proposal. However, the report stated that the attack was&nbsp;not due to vulnerabilities in Safe’s smart contracts or frontend services.
<h3 dir="ltr" id="span-span-strong-key-takeaways-from-safe-s-report-strong-span-span">Key Takeaways from Safe’s Report:</h3>
<ul>
 <li>The attack targeted&nbsp;Bybit’s Safe Wallet via a&nbsp;compromised Safe developer machine.</li>
 <li>A malicious transaction was submitted, draining funds from Bybit’s wallet.</li>
 <li>External audits found&nbsp;no flaws in Safe’s smart contracts or source code.</li>
 <li>Safe has&nbsp;reconfigured its infrastructure, rotated credentials, and enhanced security.</li>
 <li>Users are urged to exercise&nbsp;caution when signing transactions.</li>
</ul>
Despite these measures, CZ&nbsp;was not convinced and raised multiple concerns about Safe’s explanation.
<h2 dir="ltr" id="span-span-strong-cz-s-criticism-more-questions-than-answers-strong-span-span">CZ’s Criticism: More Questions Than Answers</h2>
CZ <a href="https://x.com/cz_binance/status/1894787596443885698">openly criticized</a> the report, claiming it&nbsp;brushed over key details and left many critical questions unanswered. In a detailed response, he pointed out several&nbsp;gaps in the report’s findings:
<ul>
 <li>What does “compromising a Safe developer machine” mean?CZ questioned how the hackers gained access to this machine—was it&nbsp;social engineering, malware, or a different exploit?</li>
 <li>How did a developer’s machine have access to Bybit’s account?Was&nbsp;code deployed from the compromised machine to production?</li>
 <li>How did the hackers bypass the Ledger verification step at multiple signers?Were the signers&nbsp;blind-signing transactions, or was Ledger’s security bypassed?</li>
 <li>Why was the Bybit wallet specifically targeted?If Bybit’s wallet held&nbsp;$1.4 billion, why didn’t the hackers target other wallets?</li>
 <li>What lessons can other self-custody multi-signature wallet providers learn?CZ called for&nbsp;greater transparency and stronger security protocols to prevent similar attacks.</li>
</ul>
<h2 dir="ltr" id="span-span-strong-safe-co-founder-responds-strong-span-span">Safe Co-Founder Responds</h2>
In response to CZ’s criticism,&nbsp;Martin Köppelmann, co-founder of the&nbsp;Gnosis blockchain network (which developed Safe), <a href="https://x.com/koeppelmann/status/1894792743303479340">attempted</a> to clarify the attack. He explained:
<ul>
 <li>The&nbsp;interface was compromised, not the&nbsp;Safe code itself.</li>
 <li>Hackers&nbsp;modified the interface to trick Bybit into signing a fraudulent transaction.</li>
 <li>The malicious attack was&nbsp;specifically designed to target Bybit’s Safe Wallet.</li>
</ul>
To prevent future incidents, Köppelmann proposed&nbsp;improvements, including:
<ul>
 <li>Enhancing transaction verification on hardware devices.</li>
 <li>Introducing SafeNet, a professional co-signing service to add an extra layer of security.</li>
 <li>Encouraging the use of multiple Safe interfaces to reduce reliance on a single access point.</li>
</ul>
<h2 dir="ltr" id="span-span-strong-sygnia-and-verichains-what-their-investigations-revealed-strong-span-span">Sygnia and Verichains: What Their Investigations Revealed</h2>
To get an independent forensic analysis, Bybit&nbsp;hired Sygnia and Verichains, two leading blockchain security firms. Their investigation concluded that the&nbsp;root cause was a malicious JavaScript injection in Safe’s infrastructure.
<h3 dir="ltr" id="span-span-strong-key-findings-from-sygnia-and-verichains-strong-span-span">Key Findings from Sygnia and Verichains:</h3>
<ul>
 <li>The malicious JavaScript file was introduced on&nbsp;February 19.</li>
 <li>The code&nbsp;specifically targeted Bybit’s<a href="https://bsc.news/post/what-is-ethereum-eth-how-it-works-explained"> Ethereum</a> Multisig Cold Wallet.</li>
 <li>The attackers used&nbsp;social engineering to gain access to SafeWallet’s AWS infrastructure.</li>
 <li>Both firms recommended&nbsp;further investigations to confirm the full extent of the breach.</li>
</ul>
<h2 dir="ltr" id="span-span-strong-bybit-s-response-quick-action-to-protect-users-strong-span-span">Bybit’s Response: Quick Action to Protect Users</h2>
Despite the massive loss, Bybit&nbsp;replenished user funds and&nbsp;continued operations with minimal downtime. To meet withdrawal demands, Bybit&nbsp;borrowed 40,000 ETH from Bitget, which has since been repaid.
The Bybit hack is now&nbsp;one of the largest exploits in crypto history, surpassing the&nbsp;2022 Ronin Network hack and the 2021 Poly Network attack. The Lazarus Group has&nbsp;previously stolen billions from various crypto platforms, often using&nbsp;<a href="https://bsc.news/post/what-are-memecoins-guide-how-they-work-2025">memecoins</a> to launder stolen funds.
This incident highlights the&nbsp;ongoing vulnerabilities in crypto security, especially in&nbsp;self-custody and multi-signature wallets. As CZ pointed out, the industry must&nbsp;learn from these failures and implement&nbsp;stronger security measures to prevent future attacks.
Meanwhile, other crypto platforms remain under attack. Recently, Hong Kong-based crypto entrepreneur Joe Zhou reported a Binance-related scam attempt, where hackers tried to trick him into transferring funds to a fraudulent wallet.

Was $1.4B Bybit Hack Due to Negligence?

Зміст

BSCN

Інші статті, опубліковані 6 бер. 2025 р.

Ripple’s Bold Move: How XRP is Disrupting Cross-Border Payments in Portugal and Brazil

This $7 Billion In XRP Linked to Ripple Chairman Chris Larsen Sparks Discussion

NEOPIN Annual Update: 2024

RENDER and NEAR Approaches Falling Wedge Resistance – Could Breakout Spark a Rally?

Bitcoin (BTC) Share from White House Advisor David Sacks Before the Critical Summit!

BlackRock's Bitcoin Holdings Grow as Market Bounces Back

Приєднуйтеся до нашої безкоштовної розсилки для отримання щоденних оновлень щодо крипто!