Largest Robbery in History? $1.9 billion Stolen in February Cyber-Attack
In the February cyber-attack, attributed to the Lazarus Group, a North Korean state-backed cybercriminal group, a sophisticated social engineering and supply chain attack was executed to steal over $1.9 billion from Bybit’s Ethereum multi-signature Cold Wallet. This is believed to be the largest robbery in history.
Bybit is a cryptocurrency exchange headquartered in Dubai, United Arab Emirates. Founded in 2018 by Ben Zhou, it has grown into one of the largest crypto trading platforms worldwide.
According to the ongoing investigation, the root cause of the attack was the deployment of malicious code on SafeWallet, a widely used smart contract-based multi-signature wallet. The attackers used this code to manipulate Bybit’s transaction approval process.
What Are Multi-signature Wallets?
For those unfamiliar with the technology, large companies in the crypto industry store their funds in multi-signature wallets. These wallets require approval from multiple authorized signers for any transaction.
For example, if a multi-signature wallet is configured with five signers and a 3/5 approval threshold, a transaction will only be executed if at least three out of five authorized persons approve it. This added security measure makes it significantly harder for a single compromised key to result in unauthorized transactions — which is why the attackers had to manipulate the user interface to trick multiple signers.
It should be noted that this attack aligns with concerns raised in a 2022 joint cybersecurity advisory issued by the FBI, CISA, and the U.S. Treasury Department. The advisory warned that nation-state-backed threat actors (referred to by the FBI as “TraderTraitor”) were actively targeting organizations in the blockchain and cryptocurrency industry, including:
- Cryptocurrency exchanges
- Decentralized finance (DeFi) protocols
- Play-to-earn cryptocurrency video games
- Cryptocurrency trading firms
- Venture capital funds investing in cryptocurrency
- Individual holders of large crypto assets or valuable NFTs
These threats often involve a mix of social engineering, phishing campaigns, malware deployment, and supply chain attacks, similar to the tactics seen in the Bybit breach.
Figure 1. Bybit attack preliminary conclusions. Source – https://x.com/benbybit/status/1894768736084885929
The Attack Step-by-Step.
- Intelligence Gathering & Spearphishing
Hackers typically begin with intelligence gathering, profiling key targets (e.g., crypto firm developers) using public sources like LinkedIn, GitHub, industry forums, and past breach data. Attackers then send a large volume of spearphishing messages via various communication platforms, mimicking recruitment efforts. They offer high-paying jobs to lure victims into downloading malware-laced cryptocurrency applications, a method previously used by the Lazarus Group.
- Malware Deployment
Once victims install the malware, it executes JavaScript-based shellcode, establishing a Command & Control (C2) beacon and dropping an encrypted payload onto the system.
- Gaining Access & Exfiltration
With remote access, the attackers exfiltrate details such as:
- System details (OS, network configuration, user privileges).
- Stored credentials (SSH keys, browser-saved passwords, API keys, and other stored authentication tokens or session cookies).
- Gaining Access to SafeWallet’s AWS S3 Bucket
Using the discovered credentials from the developer’s machine, the hackers gained access to SafeWallet’s AWS S3 bucket. This allowed them to exfiltrate critical configuration files and potentially manipulate the multi-signature wallet’s backend systems.
- UI Manipulation & Theft
The hackers then deployed malicious JavaScript on the SafeWallet frontend, manipulating the interface so that Bybit signers believed they were approving a legitimate transaction when, in reality, they were signing off on a fraudulent transfer. After completing the theft, attackers removed the malicious code to evade detection.
- Laundering the Stolen Crypto
The stolen assets included:
- 401,347 ETH (worth about $1.5 billion)
- 8,000 mETH (worth about $29.9 million)
- 90,375.5479 stETH (worth about $337.8 million)
- 15,000 cmETH (worth approximately $56.1 million)
Figure 2. Attacker’s transactions in Etherium blockchain
Figure 3. Attacker’s initial wallet trace
The stolen funds were dispersed across multiple initial wallets and then fragmented into thousands of addresses. The attackers used Decentralized Exchange (DEXs), cross-chain bridges, and no-KYC swap services to convert Ethereum into Bitcoin and DAI, preparing to launder the assets into fiat.
As the new U.S. administration announces plans to expand the cryptocurrency industry, it becomes even more critical for crypto companies to actively partner with security firms and conduct regular Adversary Emulation (ADEM) tests.
About the author:
Buniyod Shamsiev is a Sr Security Consultant with the Layer 8 Security Offensive Security Team. With decades of experience in cybersecurity and law enforcement data analysis, Buniyod specializes in security assessments and application penetration testing.