Türkçe
Español
Last month, hackers breached the Bybit platform’s systems, leading to the theft of cryptocurrencies valued at $1.4 billion. According to a statement from Safe Wallet, the breach was critically influenced by the exploitation of an employee’s compromised computer and the misuse of AWS session tokens. In collaboration with cybersecurity firm Mandiant, Safe Wallet announced that it is restructuring its security protocols. The Federal Bureau of Investigation (FBI) identified a connection between the attack and the North Korean-linked TraderTraitor group.
Steps of the Attack and Investigation Process
The attack began with the compromise of a computer belonging to a Safe Wallet employee (Developer1) with high access privileges. Malicious software utilized by the hackers successfully bypassed the multi-factor authentication (MFA) system. Subsequently, the attackers gained access to Bybit’s Ethereum 
$1,630 hot wallet by seizing AWS session tokens. A significant portion of the stolen funds was in the form of Lido Staked Ethereum (stETH).
Mandiant’s technical analysis indicated that the attack was carried out by a sophisticated and organized cybercrime group. The FBI’s preliminary findings revealed that the attack methods were similar to tactics used by North Korea to secure financial resources. The investigation involves collaboration with blockchain analysis firms to trace the stolen funds.
Significant Security Measures Implemented
In response to the attack, Safe Wallet transformed its access controls into a layered system. Employee access to high-privilege systems is now restricted with real-time permission mechanisms and stringent audits. The duration of session token use within the AWS infrastructure has been shortened, and additional authentication steps are required for all transactions.
Bybit altered its management policy for hot wallets, transferring the majority of funds to cold wallets. The platform announced the establishment of an AI-based monitoring system capable of detecting abnormal activities in user accounts. Both companies stated they will conduct regular security tests with independent auditing firms.
