Bybit Hack Caused By Malicious Code In Safe Wallet’s Infrastructure: Report

Early reports point to a third-party vulnerability as Bybit tries to find the remote and immediate causes of its security breach. While the interim investigation has absolved the exchange of blame, experts say the hack may be mitigated with watertight guardrails.

Safe Wallet Vulnerability Triggered Bybit Hack

As Bybit reels from its jarring $1.5 billion hack, the company enlisted Web 3 security outfit Verichains and Sygnia Labs to investigate the breach. Company CEO Ben Zhou took to X to share the results of the interim investigation report, pointing to Safe Wallet as the source of the Bybit hack.

Per the document, the root cause of the Bybit hack from malicious code in the wallet’s infrastructure. Bad actors replaced the original JavaScript file of the app.safe.global with compromised code to target Bybit’s Ethereum Multisig Cold Wallet.

Preliminary investigations say the attack on the top exchange was scheduled to hit during the next Bybit transaction. Both Verichains and Sygnia Labs’ analysts say Safe Global AWS S3 and CloudFront accounts were likely targets for hackers.

The report cites Wayback Archives as proof of a “cached malicious file” given Google Search’s integrations of the service. Safe Wallet’s official statement also confirms the origin of the breach, pointing to a compromised Safe developer machine.

“Bybit remains steadfast in our commitment to security and transparency,” said Zhou. “The preliminary forensic review finds that our system was not compromised.”

A Concerted Effort Underway To Recover Funds And Protect Customers

In the hours following the attack, Bybit transferred the funds from its Safe Wallet to limit its damage. The exchange has frozen $42 million worth of stolen funds from attackers in a collaborative effort by industry players.

Zhou has announced a bounty hunt designed to stifle the Lazarus Group’s ability to cash out from the attack. A positive development confirms that the firm has acquired 100% of Ethereum lost in the hack via a raft of loans and OTC deals from industry giants like Galaxy Digital and Wintermute.