Bybit Hack Caused By Malicious Code In Safe Wallet’s Infrastructure: Report
Highlights
- Bybit’s initial investigation into its hack points to a vulnerability from Safe Wallet.
- The report says Bybit infrastructure remains uncompromised in the wake of the attack.
- Concerted efforts are underway to recover stolen assets from the North Korean hacking syndicate.
Early reports point to a third-party vulnerability as Bybit tries to find the remote and immediate causes of its security breach. While the interim investigation has absolved the exchange of blame, experts say the hack may be mitigated with watertight guardrails.
Safe Wallet Vulnerability Triggered Bybit Hack
As Bybit reels from its jarring $1.5 billion hack, the company enlisted Web 3 security outfit Verichains and Sygnia Labs to investigate the breach. Company CEO Ben Zhou took to X to share the results of the interim investigation report, pointing to Safe Wallet as the source of the Bybit hack.
Per the document, the root cause of the Bybit hack from malicious code in the wallet’s infrastructure. Bad actors replaced the original JavaScript file of the app.safe.global with compromised code to target Bybit’s Ethereum Multisig Cold Wallet.
Preliminary investigations say the attack on the top exchange was scheduled to hit during the next Bybit transaction. Both Verichains and Sygnia Labs’ analysts say Safe Global AWS S3 and CloudFront accounts were likely targets for hackers.
The report cites Wayback Archives as proof of a “cached malicious file” given Google Search’s integrations of the service. Safe Wallet’s official statement also confirms the origin of the breach, pointing to a compromised Safe developer machine.
“Bybit remains steadfast in our commitment to security and transparency,” said Zhou. “The preliminary forensic review finds that our system was not compromised.”
A Concerted Effort Underway To Recover Funds And Protect Customers
In the hours following the attack, Bybit transferred the funds from its Safe Wallet to limit its damage. The exchange has frozen $42 million worth of stolen funds from attackers in a collaborative effort by industry players.
Zhou has announced a bounty hunt designed to stifle the Lazarus Group’s ability to cash out from the attack. A positive development confirms that the firm has acquired 100% of Ethereum lost in the hack via a raft of loans and OTC deals from industry giants like Galaxy Digital and Wintermute.
- Cyber Hornet Seeks SEC Nod for S&P 500 and XRP ETF
- Cathie Wood’s Ark Invest Eyes Stake in Tether as USDT Issuer Targets $500B Valuation
- Kraken Secures $500M at $15B Valuation, Eyes IPO in 2026
- Bybit Lists Ripple’s RLUSD Following BlackRock and VanEck Integration
- SWIFT Plans Stablecoin and On-Chain Messaging Pilot on Linea, Challenging Ripple
- Solana Price Set for Q4 Surge as Canary Capital ETF Filing Meets Wyckoff Accumulation
- Avalanche Price Could Surge to $50 as Transactions Jump 200%
- CHMPZ Price Prediction:Will This Net-Zero Community Token be the Next Gem?
- Ethereum (ETH) Price Set for a rebound as Whales Accumulate $1.6B ETH and Outflows Hit $622M
- HYPE Price Prediction As Bitwise Files For Hyperliquid ETF – Is $55 In Sight?
- Shiba Inu Price Eyes Recovery From Demand Zone With Burn Rate Soaring Nearly 400%
Why Trust CoinGape
CoinGape has covered the cryptocurrency industry since 2017, aiming to provide informative insights Read more…to our readers. Our journal analysts bring years of experience in market analysis and blockchain technology to ensure factual accuracy and balanced reporting. By following our Editorial Policy, our writers verify every source, fact-check each story, rely on reputable sources, and attribute quotes and media correctly. We also follow a rigorous Review Methodology when evaluating exchanges and tools. From emerging blockchain projects and coin launches to industry events and technical developments, we cover all facets of the digital asset space with unwavering commitment to timely, relevant information.
