Cryptocurrency Exchange Bybit Hit with $5.5 Billion Security Breach
Attackers Linked to North Korea’s Lazarus Group Drain Funds from Ether Cold Wallet
Cryptocurrency exchange Bybit has recorded outflows exceeding $5.5 billion following a $1.4 billion security breach that targeted its ether cold wallet. Hackers reportedly linked to North Korea’s Lazarus Group drained funds from the exchange, prompting Bybit to take immediate action to secure withdrawals and stabilize operations.
Investigation under Way
According to DeFiLlama, assets tracked in Bybit’s wallets fell from $16.9 billion to $11.2 billion in the wake of the attack. Bybit CEO Ben Zhou explained that following the breach, the company’s team focused on processing withdrawals while continuing to assess the security incident.
Stolen Funds Stolen from Cold Wallet
The attackers reportedly stole 70% of Bybit’s customer ether holdings, necessitating the company to arrange a loan to maintain liquidity. However, Zhou added that the majority of users were withdrawing stablecoins rather than ether, which raised additional liquidity concerns.
Bybit Secures Additional Funds
Bybit had sufficient reserves to support the withdrawals, but issues arose when Safe, a decentralized custody protocol, temporarily shut down smart wallet functionalities to assess potential security risks. Safe provides smart contract wallets for digital asset storage and custody. With $3 billion in USDT in Safe wallets, Bybit faced mounting withdrawal requests. The security team worked overnight to develop manual verification tools to move stablecoins from Safe’s wallets and continue fulfilling withdrawals.
Authorities and Security Firms Track Stolen Funds
Bybit has engaged law enforcement agencies, including Singaporean authorities and Interpol, to investigate the attack. Chainalysis, a blockchain analytics firm, is also involved in the transfer of stolen ether.
Ethereum Rollback Discussion
During the discussion, Zhou mentioned that some in the industry, including BitMEX co-founder Arthur Hayes, suggested a rollback of the Ethereum blockchain to recover the stolen assets. Bybit’s team has contacted Ethereum co-founder Vitalik Buterin and the Ethereum Foundation to explore possible solutions. However, Zhou acknowledged that any blockchain rollback would require broad community consensus and could not be a unilateral decision.
Conclusion
Bybit’s security breach is a significant incident in the cryptocurrency world, with hackers linked to North Korea’s Lazarus Group draining funds from the exchange. The company has taken steps to secure withdrawals and stabilize operations, and authorities and security firms are working to track the stolen funds. The incident highlights the importance of robust security measures in the cryptocurrency space and the need for ongoing vigilance against threats from malicious actors.
Frequently Asked Questions
Q: What is the extent of the security breach?
A: The security breach has resulted in outflows exceeding $5.5 billion, with hackers draining funds from Bybit’s ether cold wallet.
Q: Who is responsible for the attack?
A: The attack has been linked to North Korea’s Lazarus Group, a state-sponsored hacking organization known for targeting cryptocurrency platforms.
Q: How is Bybit responding to the attack?
A: Bybit has taken immediate action to secure withdrawals and stabilize operations, and is working with law enforcement agencies and security firms to track the stolen funds.
Q: Is Bybit’s security compromised?
A: Bybit’s security team is still investigating the exact cause of the attack, but initial reviews of transaction signers have not identified any suspicious activity. The company is working to determine whether the issue lies with their own systems or those of Safe, a decentralized custody protocol.
