SafeWallet’s investigation concluded that the Bybit hack was conducted by North Korean state-sponsored cyber actors associated with the Lazarus Group

Claim

Name

SafeWallet’s investigation concluded that the Bybit hack was conducted by North Korean state-sponsored cyber actors associated with the Lazarus Group

Types

Quotes that support claims

Safe, which was spun off from Gnosis, is the largest multi-signature wallet provider in DeFi, and released a statement from its Safe{Wallet} arm stating, “This attack targeted to the Bybit Safe was achieved through a compromised Safe{Wallet} developer machine resulting in the proposal of a disguised malicious transaction.”Safe clarified that the exploit compromised a single wallet and that Safe’s smart contracts remain unaffected.

Mandiant’s forensic analysis also confirmed that the hackers were North Korean state actors who took 19 days to prepare and execute the attack.

Additionally, the report revealed that the attackers used ExpressVPN to mask their origins while conducting operations. It also highlighted that the attack resembles previous incidents involving UNC4899, a threat actor associated with TraderTraitor, a criminal collective allegedly tied to DPRK.

Referenced by

Summary

Crypto news