Bybit Hack: SafeWallet Report Reveals Details of $1.4 Billion Cybersecurity Breach

According to Cointelegraph, the developer of SafeWallet has released a comprehensive post-mortem report on the cybersecurity breach that resulted in a $1.4 billion hack against Bybit in February. The report, developed in collaboration with cybersecurity firm Mandiant, reveals that the hacking group managed to hijack a Safe developer’s Amazon Web Services (AWS) session tokens. This allowed them to bypass the multifactor authentication security measures that were in place. The forensic analysis indicates that SafeWallet’s AWS settings required team members to reauthenticate their AWS session tokens every 12 hours. This security measure prompted the hackers to attempt a breach by registering a multifactor authentication (MFA) device. After several unsuccessful attempts, the threat actors compromised a developer’s MacOS system, likely through malware, enabling them to use the AWS session tokens while the developer’s sessions were active. Once access was gained, the hackers operated within the AWS environment to orchestrate the attack. Mandiant’s analysis further confirmed that the hackers were North Korean state actors who took 19 days to plan and execute the attack. The report emphasizes that the cybersecurity exploit did not impact Safe’s smart contracts. In response to the breach, the Safe development team has implemented additional safeguards to prevent future incidents of this magnitude. In a related development, the U.S. Federal Bureau of Investigation (FBI) issued an alert urging node operators to block transactions from wallet addresses associated with the North Korean hackers. The FBI warned that the stolen funds would be laundered and converted into fiat currency. Since the alert, the Bybit hackers have successfully laundered 100% of the stolen cryptocurrency, which includes nearly 500,000 Ether-related tokens, within just 10 days. On March 4, Bybit CEO Ben Zhou reported that approximately 77% of the funds, valued at around $1.07 billion, remain traceable on the blockchain, while about $280 million have become untraceable. Despite this, Deddy Lavid, CEO of Cyvers cybersecurity firm, expressed optimism that cybersecurity teams might still be able to trace and freeze some of the stolen assets. The incident underscores the ongoing challenges in securing digital assets against sophisticated cyber threats.