The recent cyberattack on the centralized cryptocurrency exchange Bybit, resulting in the theft of over $1.4 billion USD worth of ETH, perpetrated by a known hacking group, has become the largest recorded cryptocurrency heist in history.<\/span><\/p>\n On February 21st, the cryptocurrency market was once again destabilized by news of a security breach at the Bybit exchange.<\/span><\/p>\n The perpetrators have been identified by on-chain analyst ZachXBT, in conjunction with investigations from various entities including Arkham Intelligence<\/a>, as the North Korean state-sponsored hacking group, Lazarus Group.<\/p>\n BREAKING: BYBIT $1 BILLION HACK BOUNTY SOLVED BY ZACHXBT<\/p>\n At 19:09 UTC today, @zachxbt<\/a> submitted definitive proof that this attack on Bybit was performed by the LAZARUS GROUP.<\/p>\n His submission included a detailed analysis of test transactions and connected wallets used ahead of\u2026 https:\/\/t.co\/O43qD2CM2U<\/a> pic.twitter.com\/jtQPtXl0C5<\/a><\/p>\n \u2014 Arkham (@arkham) February 21, 2025<\/a><\/p>\n<\/blockquote>\n The initial detection of the incident stemmed from the on-chain analysis conducted by ZachXBT, who identified suspicious outflows of $ETH and $STETH from the Bybit exchange. Someone then subsequently transferred these funds to a Safe wallet. The perpetrators proceeded to swap the entirety of these tokens for ETH.<\/p>\n The Safe wallet address used for the swap to ETH, prior to the distribution of funds across multiple other wallets, is: 0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e<\/a><\/p>\n After tracing these transactions, Bybit, alongside other centralized exchanges and various protocols, flagged and blacklisted the implicated addresses to prevent the liquidation of the illicit assets on the open market.<\/p>\n Source: DeBank<\/p>\n<\/div>\n The developments then gradually developed as the wallet addresses of the criminals began to find ways to launder those assets according to the announcement of ZachXBT on Telegram<\/a>. Specifically, the hacker group Lazarus Group began to launder money through eXch and Bridge assets to Bitcoin via Chainflip.<\/p>\n Ben Zhou, CEO of Bybit, recently issued a statement reassuring the community that the exchange\u2019s hot wallets remain secure, while attackers compromised only the cold wallets. The explanation for this incident lies in the manipulation of signature messages, which altered the smart contract logic of the ETH wallets. Consequently, the attackers gained control of the ETH cold wallets and transferred all ETH holdings to external addresses. Zhou further emphasized that all other wallets, excluding the affected ETH cold wallets, remain secure.<\/p>\n Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe<\/a> . However the signing message was to change\u2026<\/p>\n \u2014 Ben Zhou (@benbybit) February 21, 2025<\/a><\/p>\n<\/blockquote>\n Bybit gradually brought everything under control, and Ben Zhou himself announced that withdrawal transactions at Bybit had reopened as normal.<\/p>\nDetails of the Cyberattack<\/h2>\n
\n
Bybit response<\/strong><\/h2>\n
\n
![\"bybit-logo-white\"\/](\"https:\/\/nftevening.com\/wp-content\/uploads\/2024\/06\/bybit-logo-white-300x300.jpg\"){kind=logo}
<\/a><\/div>\n<\/div>\n