TL;DR
- The forensic investigation into the Bybit hack revealed that a SafeWallet developer was attacked, which allowed Lazarus Group to steal over $1.4 billion in ETH.
- Changpeng Zhao (CZ), former CEO of Binance, criticized the lack of clarity in SafeWallet’s response, pointing out the vagueness in the details of the attack.
- Despite the criticism, SafeWallet claims to have implemented new security measures and restored its platform, committing to improving it.
A forensic investigation into the Bybit hack revealed that the attack, which resulted in the theft of over $1.4 billion in ETH, was facilitated by a vulnerability in the SafeWallet system.
According to reports, a SafeWallet developer was targeted in an attack that allowed Lazarus Group hackers, a group backed by the North Korean government, to gain unauthorized access to the platform’s infrastructure. While SafeWallet has taken measures to fix the security breach, such as reconfiguring the entire infrastructure and changing credentials, the company’s response has been met with strong criticism, especially from Changpeng Zhao (CZ), former CEO of Binance.
CZ Slams SafeWallet’s Inaccuracy
CZ was highly critical of the lack of clarity in the statement issued by SafeWallet, particularly regarding the details of the attack. According to him, the statement used vague language that did not answer key questions. Among his main concerns, he highlighted how the attackers managed to compromise a SafeWallet developer’s machine and how this device had access to an account operated by Bybit. Additionally, he questioned how the Ledger verification failure occurred, which allowed a malicious transaction to be approved.
CZ also raised doubts about why only one address managing $1.4 billion in ETH was attacked and not other accounts. This fact has sparked questions about the attackers’ strategy and the security of other platforms using SafeWallet. According to the former Binance CEO, the lack of transparency in SafeWallet’s response leaves many questions unanswered.
The Bybit Attack Left More Doubts Than Answers
Despite the criticism, SafeWallet has stated that new security measures have been implemented and that the platform is operational again, with a promise to eliminate the attack vector. Furthermore, the company has reiterated its commitment to security and self-custody, aiming to improve transaction verifiability within the ecosystem.
This incident has highlighted the vulnerabilities that self-custody solutions may present and the importance of a quick and detailed response in crisis situations. CZ’s criticism underscores the need for clearer and more precise communication when dealing with attacks of such magnitude
