合约

Safe: The developer's machine was compromised, leading to the theft of Bybit; there are no vulnerabilities in the contract and frontend code

ChainCatcher news, Safe responded on platform X to Bybit's hacking forensic report, stating that the forensic review of the targeted attack by the Lazarus Group on Bybit concluded that the attack on Bybit Safe was executed through compromised Safe{Wallet} developer machines, leading to disguised malicious transactions.Lazarus is a government-backed North Korean hacking organization known for its complex social engineering attacks on developer credentials, sometimes combined with zero-day vulnerabilities. The forensic review by external security researchers did not indicate any vulnerabilities in the Safe smart contracts or the source code of the front end and services.Following the recent incident, the Safe{Wallet} team conducted a thorough investigation and has now phased the restoration of Safe{Wallet} on the Ethereum mainnet. The Safe{Wallet} team has completely rebuilt and reconfigured all infrastructure and rotated all credentials to ensure the complete elimination of the attack vector.After the final results of the investigation are released, the Safe{Wallet} team will publish a complete post-mortem analysis. The Safe{Wallet} front end is still operational and has implemented additional security measures. However, users need to be extra cautious and vigilant when signing transactions.

Slow Fog: If Bybit upgrades the Safe contract to version 1.3.0 or higher and implements an appropriate Guard mechanism, it may avoid the theft of 1.5 billion dollars in assets

ChainCatcher message, Slow Mist stated that on February 21, 2025, Bybit's on-chain multi-signature wallet was targeted and breached, with nearly $1.5 billion in assets quietly lost through a transaction with a "legitimate signature." Subsequent on-chain analysis revealed that the attacker gained multi-signature permissions through sophisticated social engineering attacks, implanted malicious logic using the delegatecall function of the Safe contract, and ultimately bypassed the multi-signature verification mechanism to transfer funds to an anonymous address. "Multi-signature" does not equal "absolute security"; even a secure mechanism like the Safe multi-signature wallet can still be at risk of being compromised if lacking additional protective measures.Bybit is using version v1.1.1 (<1.3.0) of the Safe contract, which means they cannot utilize the Guard mechanism, a key security feature. If Bybit had upgraded to version 1.3.0 or higher of the Safe contract and implemented an appropriate Guard mechanism, such as specifying a whitelist address for receiving funds and conducting strict contract function ACL verification, they might have been able to avoid this loss. Although this is merely a hypothesis, it provides important insights for future asset security management.
ChainCatcher Building the Web3 world with innovators