ByBit hacked for 1.4Bln. Funds are Safu?

[Rikafip]

To all our sleuths on the forum, Bybit is offering 10% of the amount stolen (~140 million dollars) as a bounty reward for anyone who manages to help them recover stolen money.

Bybit, the world’s second-largest cryptocurrency exchange by trading volume, is calling on the brightest minds in cyber security and crypto analytics to join the global hunt for the perpetrators of crypto’s largest heist in history. With a reward of 10% of the amount recovered, the contributors stand to share a bounty of potentially up to 140 million USD in value in the scenario of a full recovery.

As part of the investigation and recovery efforts, Bybit is pledging 10% of recovered funds to reward ethical cyber and network security experts who play an active role in retrieving the stolen cryptocurrencies in the incident.

The total amount of the bounty is calculated based on verifiable recovery of the compromised ETH worth over $1.4 billion at the time of the incident.

[Cossyblack]

I decided to carryout some research about the Lazarus Group that hacked bybit and stole ETH worth over $1.4 Billion  and based on my research I found out that Bybit isn't the First Exchange that have been hack by this criminal group as they have been launching series of cyber attack on different exchanges over the years.

These are some of the Biggest Crypto Heists By Lazarus Group




1. Poly Network Hack
Poly Network is a cross-chain protocol, and its bridge/cross-chain contracts were exploited, highlighting the vulnerabilities of Bridges.  

Date: August 2021
Losses: $600 million
Techniques used: Exploitation of vulnerabilities in smart contracts.

2. Ronin Bridge Hack

Date: March 2022
Losses: $625 million

3. Nomad Hack

Date: August 2022
Losses: $190 million
Techniques used: Exploitation of smart contract vulnerabilities.

4. Atomic Wallet Hack

Date: June 2023
Losses: $100 million
Techniques used: Phishing and social engineering.

5. Stake.com Hack
Hacken wrote extensively on the Stake.com cack, an online crypto casino exploited by the Lazarus group—another example of private key leakage.

Date: September 2023
Losses: $41 million
Techniques used: Stolen private keys and social engineering.

6. CoinEx Hack
Date: September 2023
Losses: $70 million (estimated)
Techniques used: Social engineering and unauthorized access.

7. WazirX Hack

Date: July 2024
Losses: $235 million
Techniques used: Phishing and API exploitation.
Source

Inspite  of  all this attacks some Crypto users hasn't learnt anything, hasn't learnt that storing valuable assets on exchanges is highly risky and it's not safe. This bybit hacked is a  clear example for others to learn that Non custodian wallets is more safer than exchanges when it comes to storing of assets because it cannot be hacked

.

[Kavelj22]

hopefully bybit can vouch these funds and don't get stuck in a tether/usdc freeze situation, that could create more drama

Although Bybit Exchange confirmed the safety of users’ savings and that the reserve is able to cover the lost amount, this attack is one of the largest financial breaches in the history of cryptocurrencies, which once again highlights the security vulnerabilities targeting major digital platforms. It emphasizes the importance of strengthening security measures for companies operating in this field, especially with the escalation of sophisticated cyber attacks targeting digital assets. It may prompt regulators and investors to re-evaluate the level of security in cryptocurrency trading platforms, which may have long-term effects on the market and the future of digital assets.

[ajiz138]

I am not sure if he can convert his ETH into USDT as that then that address can be frozen by tether or if he tries to convert it in usdc, circle can freeze that address too.

He's an engineer so he knows that converting to stablecoins will definitely freeze his funds, so I think he's smarter and wouldn't do that.

He is a North Korea computer engineer ~ I have a feeling that sooner or later this hacker ParK Hyok will be arrested someday

Who's going to arrest him? If he works for the North Korean government, all he has to do is stay there. If he ever manages to leave the country, he'll probably apply for political asylum. I don't think he has much of a choice to do this "job" in North Korea.

No one can catch him because the hacker is protected by the North Korean government, he won't even be able to leave his country for sure if he leaves then his family will be the victim of the cruelty of the North Korean President.

I wonder why this topic is not in Exchanges board?

Because maybe what was hacked was only altcoin, not bitcoin.

[SmartGold01]

This is another bad news to the market and could cause a severe dump. Oh No!
After hovering around a specific price for long periods and, recently breaking out from 98k the market receive another affective news that could likely dump it again. $1.4b is large enough to cause panic in the market.

But wait, whenever an exchange hack experience what do we think about it, internal or external plot?

It is not going to affect bitcoin price. It was Ethereum they hacked and not bitcoin. The altcoins might suffer temporarily and this might affect or delay the anticipated altcoins season. Some of the funds would be recovered, especially if they try to convert it to centralized stable coins. Bybit is fairly a big exchange, I don't think this will affect the exchange.

Meanwhile, MS is planning to invest $2b in BTC, this news is trying to make the bitcoin market bullish.

This incident will affect the general market in the coming days although Bitcoin and Ethereum seem to be bullish for that weekend and that could make the effect of this hack unnoticed, Bybit has lost a lot in the hack and hopes their leverage on this to improve their security.

Booffing accounts activities is one of the scariest attacks and hot wallets are the major targets, but in this case, even some customer's accounts witnessed the attack as there were unauthorized withdrawals from individuals' wallets.

Of course even though the effect is not much it would definitely because I could recall then when FTX collapse the market suffered for long and wasn't able to recover if I am not mistakenly.
Even though it doesn't direct affect other coin like bitcoin, ethereum alone also has influence on the market as whatever that affect ethereum would affect every of its pairs on various exchange or trading platform as people could panic at that moment.

[alani123]

It's important to remember here that FTX had gaps in their books for billions upon billions, not just 1.5 billion. Bybit might scrape by, but surely it's best to withdraw. I'm very confident they'll survive just by the fact that they have a very liquid exchange and they were already able to get a loan by Ripple labs (allegedly).

The important takeaway after such a large heist for me is what could be done to prevent this. Could authorities play a more direct role in equipping crypto exchanges with cybersecurity supervision and protocols to prevent such failures? Because if nothing is done, then North Korea's military grade hacking is going to continue being a major cash flow for them. Banks already have many safeguards offered by governments. But here where crypto transactions are irreversible, things are even more tough.

[Wiwo]

Of course even though the effect is not much it would definitely because I could recall then when FTX collapse the market suffered for long and wasn't able to recover if I am not mistakenly.
Even though it doesn't direct affect other coin like bitcoin, ethereum alone also has influence on the market as whatever that affect ethereum would affect every of its pairs on various exchange or trading platform as people could panic at that moment.

Yeah still remember the effect of the FTX crash on the crypto market at that time, the fact is that the FTX case is far different and bigger than the Bybit case and these are two different incidents, Bybit suffered external attacks from hackers.

FTX's case was a bankruptcy meaning the whole financial system was shut down, so you can see the difference between the two of these cases and judge their impact on the general crypto-currency market.

[Becassine]

We've seen hackers spread eth across dozens of wallets and make swaps everywhere they can. Can anyone explain how they're going to “launder” so many cryptos and how they can get them back into FIAT eventually.

[NotATether]

To all our sleuths on the forum, Bybit is offering 10% of the amount stolen (~140 million dollars) as a bounty reward for anyone who manages to help them recover stolen money.

It's not going to be 10% of the amount stolen, it's going to be 10% of the amount recovered. This is to encourage anyone to get free money that would otherwise make them subject to criminal prosecution in Europe and elsewhere.

[NeuroticFish]

Did anybody follow this more closely in order to ELI5 what has happened there?
From my understanding - based on a few posts I've read on X - it was a mix of malicious smart contract, infected computer(s) and human mistake = signing transaction (with Ledger, LOL!) without properly checking it.

However, I would LOVE to read it confirmed and/or explained better.


PS. Are these guys genuinely considering a new hard fork on ETH? However, whether they revert or not, this is not going to end up nicely for ETH and its holders/believers.

[coolcoinz]

We've seen hackers spread eth across dozens of wallets and make swaps everywhere they can. Can anyone explain how they're going to “launder” so many cryptos and how they can get them back into FIAT eventually.

They think the smaller amounts they exchange the harder it is to track it. One of the ways to mix coins is to create a number of wallets containing "clean" coins and add some "dirty" coins to them.

Let's say you have 100 dirty coins. You create 100 wallets with clean coins in them and add 1 dirty coin to each wallet. Then you send 0.1 coin per transaction to pay for something, which will divide the existing coins in the wallet and create dust transactions with some clean and some dirty coins. If you repeat this enough times, you will eventually make these 100 dirty coins disappear in a stream of a million other clean coins. It's possible to find out who you are by tracking a single coin up to the point of exchange, but nation-backed hackers don't care about that. They only want to hide these coins enough so that the exchanges won't block them. They don't care about being traced to a specific account because if that account eventually gets blocked they will only lose 1% of the stolen money or less, but still manage to withdraw some.

[fillippone]

Did anybody follow this more closely in order to ELI5 what has happened there?
From my understanding - based on a few posts I've read on X - it was a mix of malicious smart contract, infected computer(s) and human mistake = signing transaction (with Ledger, LOL!) without properly checking it.

However, I would LOVE to read it confirmed and/or explained better.


PS. Are these guys genuinely considering a new hard fork on ETH? However, whether they revert or not, this is not going to end up nicely for ETH and its holders/believers.

I think the best explanation of what happened can be found here.

This is pretty simple to read, and as far as I can see, no Ledger device was involved.
They speak about computers, not Ledgers, and I don't see why they would do these procedures via a Ledger to start with.
I hate Ledger with all my heart, but this time, there is no reason to bash them (soon, another reason will emerge!)

[SatoPrincess]

Not to that person but it seems people love to learn the hard way. After the FTX situation, even Theymos had to pin this thread in the news section for everyone to see. Our dear friend, o_e_l_e_o made it a point to educate people on the dangers of leaving one’s coins in CEXs:

Recent events should make everyone withdraw all their coins to their own wallets
Recent events should make you withdraw all your coins to your own wallet: Part 2
Recent events should make you withdraw all your coins to your own wallet: Part 3

I’m surprised that with all that’s happened, so many people still put their trust in centralized exchanges. Bybit claim that they can cover the losses but I think this hack will have a huge impact on their business, I hope their competitors are taking notes and upgrading their cybersecurity.

[Kavelj22]

Governments around the world are raising concerns about North Korea’s cyber threats. The United States, Japan and South Korea have already issued a joint warning that the group will remain safe as long as it resides in the most isolated areas of the world. Even the strongest security systems are still struggling to deal with the Lazarus Group’s attempts. What happened should prompt cryptographers to strengthen their security systems. Because without better defenses, the risk of future attacks remains high.

[bbc.reporter]

It appears that after much extraction from the Libra scandal by people who were supposed to be trusted it, I reckon this hack by Lazarus would have dumped the whole cryptospace market if this occurrence happened during 2020 or 2021. It also gives much confidence for Bybit after Ben Chow shared a video of him on social media. He was relaxed and appears to have a plan already.

The market also has reacted very relaxed and did not dump crazily. This implies that the people are not anymore irrational or much of the people have no more to dump because most of their money has been extracted already heheheheeheh.

[sunsilk]

Now, the hackers are having hard time in cashing out the stolen funds. The reports said that they might be behind the scam pump and dump meme coins/tokens in the solana network.

If there are folks here that are into these meme coins and this network, please check it first because you might unnotice it that you're helping them to launder their money by buying the meme they made.

1. https://www.reddit.com/r/solana/comments/1iwauff/north_korea_made_a_pump_fun_memecoin_to_launder/?rdt=59516
2. Bybit hackers may be behind Solana memecoin scams — ZachXBT

[hugeblack]

In the past I thought LAZARUS GROUP was real but it is hard to imagine that one group (even government sponsored) is able to run mixers, execute hacks, and search for vulnerabilities in such a short period of time, their name is mentioned almost every 3 months.

If there are folks here that are into these meme coins and this network, please check it first because you might unnotice it that you're helping them to launder their money by buying the meme they made.

If they have the knowledge to find many vulnerabilities so quickly, I think they will be more creative in laundering these coins. There are already accusations of them running crypto mixers.

[IceLincoln]

Obviously the largest hack of crypto assets

Key info after the Bybit hack:

1. Arkham created and funded a bounty to help identify the person or organization behind Bybit hack.

2. Bybit has launched a $140M Recovery Bounty Program, offering incentives to experts who help track and retrieve stolen assets.

3. Bybit has seen total outflows of over $5.5 Billion: Due to the Hack, a lot of users withdrew their assets which were not Eth out of the exchange.
 
4. JAN3 CEO and BitMEX CEO push for Ethereum rollback: However, Ethereum Core developer Tim Beiko has stated that rolling back the ethereum blockchain to reverse the attack is technically impossible that is because the hacker followed protocol rules, making it a valid albeit malicious transaction.

5. Binance and Bitget transferred over 50,000 ETH to Bybit's cold wallets: Acting as rescue operatives, these exchanges extended a helping hand to their fellow exchange to reduce this crisis. It’s good they’re helping each other but I think they should do more on their security protocols.

6. This hack was the largest crypto heist in history.


JustNews

[JollyGood]

$1.4 billion dollars gone when ByBit least expected, that really is big news. It cannot be doubted because the evidence clearly shows the hackers are getting extremely efficient at what they do. It seems no matter what defences are put in place, the hackers circumvent them and play a waiting game to precise their attack.

Moving forward, it is safe to expect hacks will continue on a regular basis but as long as investors are storing their funds away from exchanges they will be safe.

[sunsilk]

If there are folks here that are into these meme coins and this network, please check it first because you might unnotice it that you're helping them to launder their money by buying the meme they made.

If they have the knowledge to find many vulnerabilities so quickly, I think they will be more creative in laundering these coins. There are already accusations of them running crypto mixers.

You're right. There are now some exchanges that are also being said that are being used for that.

These hackers know a lot of things and they are planning things ahead of time before people can realize that the money is already washed and been moved already.

The latest news about ByBit, it's said that they're nearly completed to recovery for filling their reserves.