ChainCatcher news, Safe announced that its joint security investigation with Mandiant (now part of Google Cloud) has made significant progress and confirmed that the theft incident on Bybit on February 21 was perpetrated by the North Korean hacker group TraderTraitor, which has previously targeted the crypto industry multiple times.The attackers compromised the laptop of a Safe{Wallet} developer and hijacked an AWS session token to bypass multi-factor authentication controls. This developer is one of the few with higher privileges to perform their duties.Safe calls on the Web3 ecosystem to collectively address the increasingly complex security threats and to enhance the optimization of transaction verification tools to improve user security. The official team has released a detailed transaction verification guide and plans to further optimize the user experience to reduce potential risks.

ChainCatcher news, the Bitrace on-chain security analysis team disclosed that the Loopring hacker has begun to transfer the stolen funds, with 30 ETH having been transferred to Thorchain. The Bitrace team issued an alert on social media, reminding the Loopring community to stay vigilant.Previous news, the Loopring smart wallet was hacked in June last year.

ChainCatcher news, according to Cointelegraph, the cryptocurrency exchange Bybit has confirmed that it has initiated a proposal requesting the decentralized finance (DeFi) protocol ParaSwap to return the transaction fees generated from trading with digital assets stolen from the exchange by the Lazarus hacker group.On March 4, a proposal was published on the ParaSwap decentralized autonomous organization (DAO) forum, requesting the freezing and return of 44.67 wETH worth nearly $100,000. The proposal initially raised skepticism, with several DAO members demanding verification of its origin. Bybit posted a verification message on its official X account on March 5, confirming that the proposal was initiated by them.This proposal for fund return sparked intense discussions among DAO members. DeFi researcher and ParaSwap DAO representative Ignas pointed out that profiting from a hacker attack gives a "bad image" to the DAO, and returning the funds would demonstrate support for industry peers. He added that retaining these funds could attract regulatory scrutiny and legal troubles. However, he also warned that refunds would set a dangerous precedent for DeFi: "Code is law. The DAO legally earned the fees through smart contracts. If we return the funds now, what happens in similar situations in the future? This would set a dangerous precedent."Opinions among ParaSwap DAO members are divided, with some supporting conditional refunds of the fees, while others voted against the refund. DAO member SEED Gov proposed three possible courses of action: full refund, rejection of the request, or negotiating a structured refund that includes retaining 10% as a bounty, consistent with Bybit's existing bug bounty program.

ChainCatcher news, according to PeckShield monitoring, the Delta Prime hacker transferred 310 ETH to Tornado Cash. Delta Prime was hacked in November 2024, resulting in a loss of approximately 4.8 million dollars.

According to ChainCatcher's message, Bybit CEO Ben Zhou disclosed that the total amount of funds stolen by hackers is $1.4 billion (approximately 500,000 ETH), of which 77% is still traceable, 20% is untraceable, and 3% has been frozen.Specific analysis shows that 83% (417,348 ETH, approximately $1 billion) has been converted to Bitcoin, distributed across 6,954 wallets. The hackers primarily converted ETH to BTC through THORChain, accounting for about 72% (361,255 ETH). Additionally, 16% of the funds (79,655 ETH) were lost through the ExCH platform, and 8% of the funds (40,233 ETH) were transferred via OKX Web3 proxy, of which about 5% is untraceable.Currently, 11 parties have assisted in freezing the funds, with Mantle, Paraswap, and ZachXBT contributing the most, collectively paying out a bounty of 2.179 million USDT.

ChainCatcher message, Infini founder Christian transferred 0.1 ETH to the hacker's address and attached a message stating, "We acknowledge your ability in discovering vulnerabilities in our protocol and would like to reach a white hat agreement: you may keep 20% of the stolen assets as a bounty, and please send the remaining portion to my address or our escrow wallet. If handled this way, we will not take further legal action."

ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, the 499,000 ETH stolen by the Bybit hacker is finally about to be sold out (today or tomorrow): there are now only 60,000 ETH (approximately 148 million USD) left in the address waiting to be laundered. In the past 24 hours, the Bybit hacker has laundered 96,500 ETH.

According to ChainCatcher's message, on-chain analyst Yu Jin has monitored that since 3 PM yesterday, the Bybit hacker has resumed money laundering activities, having laundered 62,200 ETH (approximately 138 million USD).Currently, of the 499,000 ETH stolen from Bybit, only 156,000 ETH (approximately 346 million USD) remains unprocessed.At the current rate of money laundering, it is expected that the remaining stolen funds will be completely cleared within three days.

ChainCatcher message, about 18 hours ago, Mask Network founder Suji Yan sent a message to the hacker: "The FBI, Hong Kong police, Interpol, and private security personnel are conducting international cooperation, have identified your identity, and are in pursuit of you. You have been completely exposed, and evidence of your actions has been gathered by us and our law enforcement partners. You have 72 hours to return the stolen funds, or the situation will become uncontrollable. If you return the funds, we are willing to offer a generous reward. After the funds are returned, we will cease all tracking, destroy the collected data, and close the case. If you do not return the funds, we will escalate law enforcement actions, blacklist your address globally, and ensure that you and any accomplices face legal consequences."

ChainCatcher news, "on-chain detective" ZachXBT revealed in a personal channel that an unknown victim was attacked by the North Korean hacker Lazarus Group on February 28 on Tron, resulting in a loss of approximately $3.1 million. The funds were transferred from Tron to Ethereum, and the ETH was split into ten addresses before being deposited into Tornado Cash.

ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, the Bybit hacker has suspended the transfer and laundering of ETH since 3 PM yesterday, so only 14,300 ETH (worth about 32.2 million USD) has been laundered in the past 24 hours. Now there are still 218,000 ETH (worth about 486.6 million USD) in the hacker's address.

ChainCatcher news, according to monitoring by Spot on Chain, the Bybit hacker has successfully laundered 50% of the stolen ETH.In the past 5 and a half days, the Bybit hacker has laundered a total of 266,309 ETH (approximately $614 million), accounting for 53.3% of the 499,000 ETH stolen, averaging 48,420 ETH laundered per day, mostly converted to BTC through THORChain. At the current rate, the remaining 233,086 ETH could be fully laundered in just 5 days.

ChainCatcher message, Slow Mist posted on platform X, announcing the hacker addresses of the 7 Mask Network founders whose funds were stolen:0x7e8da2dc33416e5f73008366cd5027f22be17df70xce98ad7553c73578633a286f476c641179c5695d0xb6a5426b885172fb73d3c8fcf9612610612df7070xe457171b295e3ec597ddb234a46215e6006636e70x15eb933b90f13fdfa0f46a7ae52fe8cf4307fa430x180fe23ff9c57031e305ecffaadff4a5ac3d92190xaa937733edecda7924849c284b76912489e1f693

ChainCatcher news, according to Decrypt, the hacker group Crazy Evil has created a fake Web3 company called "ChainSeeker.io" to lure job seekers in the crypto industry into downloading malware that steals wallet funds.According to cybersecurity site Bleeping Computer, the organization has set up profiles on LinkedIn and X, recruiting for standard positions in the crypto industry, such as "Blockchain Analyst" or "Social Media Manager." They have also placed premium ads on sites like LinkedIn, WellFound, and CryptoJobsList to increase the visibility of their advertisements. Job seekers then receive an email from the fake company's "Chief Human Resources Officer," inviting them to contact the fake "Chief Marketing Officer" (CMO) via Telegram.The so-called CMO subsequently pressures them to download and install a virtual meeting software called GrassCall and enter a code provided by the CMO. GrassCall then installs various information-stealing malware or Remote Access Trojans (RATs), which search for crypto wallets, passwords, Apple Keychain data, and authentication cookies stored in web browsers.Currently, most of the ads seem to have been removed from social media.

ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, the hacker involved in the Bybit theft incident laundered ETH into BTC through THORChain, bringing THORChain a trading volume of $2.91 billion and $3 million in fee revenue.Data shows that the hacker began the money laundering operation on February 22, contributing a significant amount of transactions to THORChain over a period of 5 days. Prior to this, THORChain's average daily trading volume was about $80 million, which surged to $580 million during the hacker's activity.

ChainCatcher news, ChatGPT developer OpenAI recently stated that the company has banned and removed accounts from North Korean users, who are suspected of using its technology for malicious activities, including surveillance and manipulation of public opinion.OpenAI pointed out in a report that these activities are ways authoritarian regimes may use AI technology to exert control over the United States and their own citizens. The company also added that they use AI tools to detect these malicious operations. OpenAI did not disclose the specific number of banned accounts or the timeframe of the related actions.In one case, malicious actors possibly linked to North Korea used AI to generate fake resumes and online profiles of job seekers with the aim of fraudulently applying for positions at Western companies.Additionally, there is a batch of ChatGPT accounts suspected of being related to financial fraud in Cambodia, which utilize OpenAI technology to translate and generate comments on social media and communication platforms, including X and Facebook.

ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, in the past 24 hours, the Bybit hacker has continued to launder 71,000 ETH (170 million USD). From the afternoon of the 22nd until now, in 4.5 days, 206,000 of the stolen 499,000 ETH have been laundered. An average of 45,000 ETH per day. There are still 292,000 ETH (685 million USD) remaining in the hacker's address.

ChainCatcher news, according to an announcement from the FBI, the Federal Bureau of Investigation has issued a Public Safety Announcement (PSA) confirming that a North Korean hacking group is responsible for the theft of approximately $1.5 billion in digital assets from the Bybit exchange.The FBI stated that the hacking group acted quickly, converting some of the stolen assets into Bitcoin and other digital assets, and dispersing them to thousands of addresses across multiple blockchains. It is expected that these assets will be further laundered and eventually converted into fiat currency.