- Bybit confirms suffering a large cyberattack
- Hackers stole approximately $1.5bn worth of Ethereum
- Their identities are not confirmed, but researchers speculate it was Lazarus
One of the biggest cryptocurrency exchanges in the world has suffered a devastating cyberattack in which it lost approximately $1.5 billion worth of Ethereum.
The attack against Bybit was confirmed by the company’s CEO, Ben Zhou, who said the threat actors siphoned the exchange’s reserves, and not customer funds.
Despite this being the biggest heist in crypto’s history, Zhou noted the company remains solvent and is under no existential threat, and commended the industry’s big players, which rallied behind the victims and offered help.
Lazarus
The attack itself was quite sophisticated. Bybit kept ETH in a multi-signature cold walleta method that’s considered the safest possible. It also means that to move any funds, multiple people would need to sign the transaction.
Apparently, the attackers somehow managed to compromise all of the employees involved in fund transfer, and when the company wanted to pull funds from cold storage into a “hot wallet” to support its everyday activities, the attackers were able to redirect the funds.
All of the involved people never knew what happened, because on their monitors, all of the information checked out.
The news sent shockwaves throughout the cryptosphere. Hundreds of thousands of people initiated withdrawals of their money from Bybit, in fears that the company would not be able to serve everyone (as was the case with Celsius back in 2021). Ethereum dropped roughly 4% on the news.
For the first time, in face of extremely bad news, the crypto industry showed incredible resilience. Usually, news such as this one would send not just Ethereum, but Bitcoin as well, and with them most other currencies tumbling, wiping out a significant portion of their value in a matter of hours. However, Ethereum lost “just” 4% (which is almost negligible in the crypto world) and rebounded relatively quickly. Bybit served all of its customers during the “bank run”, and continues operating normally.
The identity of the attackers is not yet confirmed, although some researchers believe this to be the work of Lazarus, an infamous North Korean state-sponsored threat actor. Indeed, Lazarus is known for targeting crypto businesses and, being on North Korea’s payroll, definitely has the means to pull off a heist such as this one.
Via The Guardian