Bybit loses $1.5B in hack

Society has devolved a bit when not long ago a heist like this would involve sieging Nakatomi Plaza, now it takes just finding a bug in someone's defective Python codes.

Re: Bybit loses $1.5B in hack

#7

Post by drak0n1c » Fri, Feb 21, 2025, 5:46 PM UTC

gosub100 wrote: post #4

[flagged]

In this case yes - everything went by the design and law of the underlying code. There was no exploited bug or vulnerability flaw besides human laziness here.

1) Their multi-signature wallet signing employees lazily clicked through in unison to approve a new smart contract without examining the contents to see if it was unusual.

2) Bad security architecture to keep too much in a single wallet that wasn't properly kept cold. There should have been a few fully cold wallets, that only rarely transact with mostly-cold intermediary "airlock" wallets which are also separated from the exchange operations and wallets. The signers also need to be different combinations of people for each of those wallets - preferably some of those signers being additionally liable 3rd party technical experts.

Re: Bybit loses $1.5B in hack

#8

Post by yapyap » Fri, Feb 21, 2025, 5:46 PM UTC

gosub100 wrote: post #4

[flagged]

“skibidi is toilet”

what r u talkin ab?

Re: Bybit loses $1.5B in hack

#9

Post by faefox » Fri, Feb 21, 2025, 5:48 PM UTC

[flagged]

Re: Bybit loses $1.5B in hack

#10

Post by Etheryte » Fri, Feb 21, 2025, 5:48 PM UTC

philipwhiuk wrote: post #3

It's obviously not a cold wallet if it's connected to the exchange.

Yeah this makes no sense whatsoever.

> [The hacker] took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address.

Did the hacker physically break into their office or what?