Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes.

North Korean hackers have executed the largest cryptocurrency theft in history, draining $1.5 billion from Dubai-based exchange Bybit by compromising its multisignature cold wallet system. The attackers stole over 400,000 ethereum and staked ethereum coins without exploiting code vulnerabilities or ...

Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes.

Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes.

Attackers infiltrated Bybit Exchange’s Ethereum cold wallet infrastructure to steal $1.46 billion in digital assets through sophisticated interface manipulation and social engineering tactics. The incident represents the largest theft from a centralized crypto exchange since Mt. Gox’s 2014 collapse, exposing critical vulnerabilities in institutional-grade multisignature (multisig) systems previously considered impenetrable. Security firm TRM Labs attributes the attack with “high confidence” to North Korean state-sponsored hacking collective Lazarus Group, known for stealing over $3 billion in crypto assets since 2018. Bybit detected unauthorized activity involving one of our ETH cold wallets. The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing… — Bybit (@Bybit_Official) February 21, 2025 Next-Generation Interface Manipulation The breach occurred through a precisely planned attack on Bybit’s Ethereum multisig cold wallet during a routine transfer to operational warm wallets. Attackers deployed advanced interface spoofing techniques that displayed legitimate transaction details to authorized signers while embedding malicious smart contract logic in the background. This approach circumvented Bybit’s 3-of-5 multisig approval system by compromising three separate signing devices through what investigators describe as a “supply chain attack with social engineering components”. Blockchain forensic analysts identified the malicious contract as a modified version of Safe Protocol’s execTransaction function, which Check Point researchers had flagged in July 2024 as vulnerable to interface manipulation attacks. The altered code enabled attackers to maintain the appearance of standard transaction flows while secretly redirecting wallet control permissions. Attack Flow (Source: Checkpoint) Bybit’s security team detected anomalous activity within 47 minutes of the unauthorized transfer, immediately isolating affected systems and initiating protocol-wide security audits. The exchange confirmed that only one ETH cold wallet cluster was compromised, with all other cold storage vaults and user funds remaining secure. The exchange has partnered with Chainalysis, TRM Labs, and three unnamed blockchain analytics firms to trace the stolen funds across 12,438 wallet addresses. Preliminary analysis shows the attackers employing advanced obfuscation tactics, including: Cyclic transactions through privacy mixer Tornado Cash Cross-chain swaps to Monero and Zcash Layered routing through decentralized exchanges North Korean Lazarus Group TRM Labs’ attribution to North Korean operatives stems from three key factors: Code Similarity : 78% match between the attack’s smart contract logic and Lazarus Group’s 2023 Harmony Bridge exploit Infrastructure Patterns : Use of Russian bulletproof hosting services historically favored by DPRK cyber units Funds Movement : Early test transactions mirroring 2022 Ronin Bridge heist patterns The United Nations Office on Drugs and Crime estimates North Korea has stolen $1.7 billion in crypto assets since 2022, primarily financing its nuclear weapons program. Attackers Broken Safe Protocol Attackers exploited a vulnerability in Gnosis Safe’s execTransaction function first identified by Check Point researchers. The manipulated interface: Presented legitimate transaction details to signers Embedded malicious logic granting contract ownership Bypassed EIP-712 signature verification through parameter manipulation This allowed simultaneous authorization of both the genuine warm wallet transfer and hidden contract ownership transfer. As investigations continue, this breach is crucial for digital asset security, proving that even the most robust technical safeguards remain vulnerable to human-factor exploitation. Update: Bybit prioritized user withdrawals. Within the first 10 hours after detecting the breach, the exchange processed over 350,000 withdrawal requests—a historic high for any crypto platform. By 1:45 AM UTC on February 22, 99.9% of these requests had been completed successfully. As of now, fewer than 2,100 pending requests remain, with the exchange working diligently to finalize them. Update: Deposits & withdrawals on Bybit have fully recovered to normal levels, as confirmed by on-chain data. pic.twitter.com/Cc0MwPFmWS — Bybit (@Bybit_Official) February 23, 2025 “We’ve worked tirelessly to ensure our users can access their funds without further delays,” Zhou stated in an update. “This is a testament to our commitment to transparency and user security.” Free Webinar: Better SOC with Interactive Malware Sandbox for Incident Response and Threat Hunting –  Register Here The post Record Breaking Crypto Hack – Attackers Stolen $1.46 Billion From Bybit Exchange appeared first on Cyber Security News .

Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes.

Use your bitcoin to get a loan from Unchained, the bitcoin native financial services company with multisignature security & great customer service.