Reversal: Safe admits that Bybit’s $1.5 billion theft was caused by Safe being hacked

Author: Safe.eth, Source: Twitter @safe; Compiler: Baishui, Golden Finance

Summary

• The findings confirm that Lazarus launched a targeted attack on ByBit.

• The Safe smart contract was not affected, and the attack was carried out by hacking into the Safe {Wallet} developer machine, which affected the accounts operated by Bybit.

• Safe{Wallet} has added security measures to eliminate the attack vector.

Full Statement

• A forensic review of the targeted attack launched by the Lazarus Group on Bybit concluded that the attack on Bybit Safe was achieved through the infected machine of the Safe{Wallet} developer, resulting in disguised malicious transactions. Lazarus is a state-sponsored North Korean hacking group known for conducting sophisticated social engineering attacks on developer credentials, sometimes in conjunction with zero-day exploits.

• Important! Forensic review by external security researchers did not indicate any vulnerabilities in the source code of the Safe smart contracts or frontend and services.

• Following the recent incident, the Safe{Wallet} team conducted a thorough investigation and has now restored Safe{Wallet} on the Ethereum mainnet in a phased manner. The Safe{Wallet} team has completely rebuilt, reconfigured all infrastructure, and rotated all credentials, ensuring that the attack vector is completely eliminated.

• The Safe{Wallet} team will publish a full post-mortem after the final results of the investigation are known.

• The Safe{Wallet} frontend remains operational with additional security measures in place. However, users need to exercise extreme caution and remain vigilant when signing transactions.

• Safe is committed to leading an industry-wide initiative to improve the verifiability of transactions, an ecosystem-wide challenge.

• Safe will continue to be committed to security, transparency, self-custody, and driving the industry forward.