How the $1.5 Billion Bybit Hack Could Have Been Prevented - Ep. 791
Episode publishedPodcast: UnchainedUnchained
Transcript preview
Preview only
Imagine, like, if one developer had access to the bank's website and allowed people to transfer anything, that would be very stupid. And it it's not it doesn't happen anymore. It it you will never hear of anything like that. So why are we still having those scenarios in the in our industry is, like, is very crazy. Hi,
everyone. Welcome to Unchained, your no hype resource for all things crypto. I'm your host, Laura Shin. We are now featuring quotes from listeners on the show. Today, we have one from Crypto Culkin on X responding to the recent episode on the Bybit hack with Taylor Monahan and Jonty about how the Lazarus Group is targeting people, not products. Crypto Culkin wrote, humans are still the weakest link in cybersecurity. Sometimes you just need a single human error and the hackers are in. Having good processes, for example, maker checker slash dual control, mitigate the risk, but it can never be ze
Laura. How's it going? You
know, crazy news week is a good way to put it. This week on Wednesday, Bybit published two forensic investigation reports into how it had gotten hacked for $1,500,000,000 worth of ether and ether pegged tokens. This does appear to be the largest hack in history, and the fact that whatever money gets laundered is going to fund North Korea's nuclear weapons program is bad for the world and also bad for the crypto industry. Mudep, before we dive into the details of this hack and what the reports found, I know you have extensive experience with North Korean crypto hackers and in particular, the La
Yeah. For sure. So Lazarus Group is notorious for, like, the biggest crypto heist, especially, like, in the recent times. There have been a couple of big crypto hacks, like the, like, Poly Network, which were not Lazarus, but all of that money was, returned. So, like, by far, Lazarus is the biggest entity which has had crypto entities and not returned the money. Like, nobody even comes close to, like, 10% of their hard amount or anything. So they are, the biggest threat actor in this space. I've been doing security in this space for almost ten years. So, obviously, like, it's my job to be fami
Honestly, when you said that, it's so funny because, of course, if you are not in North Korea, then your fear is that after you do a crime, you will be thrown into prison by a government. But when the government is the criminal, then it, it all gets reversed, which is, yeah, how North Korea ends up being this biggest hacker in crypto. So let's now talk about this Bybit hack and about these two forensics reports that were published this week. How does it seem North Korea's Lazarus Group perpetrated this hack?
Yeah. So this was a well thought a well thought out execution and specifically targeted towards Bybit. The way they did it was, they compromised one of the developers working on SAFE, the multisig wallet used by Bybit and a bunch of other crypto companies. So once they, compromised this person, their details for how they did it have not been made public yet, but they compromised this person's laptop, through which they got access, to Safe's AWS account. And in the AWS account, they pushed a malicious version of, the, Safe Wallet website. And this malicious version was specifically coded to onl
So I know you said there that we don't really know how they got access to the SAFE developers. Well, actually, it's yeah. How they got access to the SAFe developers systems, which is what allowed them to access SAFe's AWS account. But from what you know of Lazarus Group, what are kind of typical strategies they would use to have done that?
Y
Keep exploring with a free account.
A free account preserves the short preview. Upgrade to Pro for the full transcript and episode chat.