Support NeoGAF

[HRK69]

Hackers steal $1.5bn from crypto exchange in ‘biggest digital heist ever’

Bybit platform appeals to ‘brightest minds’ in cybersecurity for help after attacker transfers Ethereum currency

www.theguardian.com

The cryptocurrency exchange Bybit has called on the “brightest minds” in cybersecurity to help it recover $1.5bn (£1.2bn) stolen by hackers in what is thought to be the biggest single digital theft in history.

The Dubai-based crypto platform said an attacker gained control of a wallet of Ethereum, one of the most popular digital currencies after bitcoin, and transferred the contents to an unknown address.

Bybit immediately sought to reassure its customers that their cryptocurrency holdings were safe, while its chief executive said on social media that Bybit would refund all those affected, even if the hacked currency was not returned.

“Bybit is solvent even if this hack loss is not recovered, all of clients assets are 1 to 1 backed, we can cover the loss,” Ben Zhou, Bybit’s co-founder and chief executive, posted on X.

He added that the company held $20bn in customer assets, and would be able to cover any unrecovered funds itself or through loans from partners.

Bybit, which has more than 60 million users worldwide and is the world’s second-largest cryptocurrency exchange by trading volume, said news of the hack had led to a surge in withdrawal requests.

Zhou wrote that the company had received more than 350,000 requests from customers to withdraw their funds, which could lead to delays in processing.

Bybit said the hack occurred when the company was making a routine transfer of Ethereum from an offline “cold” wallet to a “warm” wallet, which covers its daily trading. An attacker exploited security controls and was able to transfer the assets. Zhou said all other wallets on the exchange were unaffected.

The price of Ethereum dropped by nearly 4% following news of the hack on Friday, but has since almost returned to previous levels.

The company has called on “the brightest minds in cybersecurity and crypto analytics” to help it try to recover the hacked funds, and is offering a reward of 10% of the amount recovered, which could total $140m if the entire hacked amount was retrieved.

“Bybit is determined to rise above the setback and fundamentally transform our security infrastructure, improve liquidity, and be a steadfast partner to our friends in the crypto community,” Zhou said in a statement.

The hack is a setback for the crypto industry, which has rebounded in recent months after benefiting from Donald Trump’s return to the White House, and his promises to make the US the “crypto capital of the planet” amid looser regulation.

Although the identity of the Bybit attacker is unknown, some reports have suggested that the perpetrators could be North Korean state hackers, such as the Lazarus Group, who have been blamed for previous large-scale heists, including the $615m theft from the blockchain project Ronin Group in 2022.

 

[AJUMP23]

How do people keep stealing Crypto. And how do you expect it to be a real option if hackers can keep stealing peoples assets?

 

[Hookshot]

"Bybit"

 

[HRK69]

"Bybit"

This obviously wouldn't happen at ony other platform!

 

[Heimdall_Xtreme]

Fuck y0u Dirty Milei

 

[Dr.D00p]

Nice bonus in store for the North Korean Hacker Unit....No executions this month.

 

[ClanOfNone]

The Ocean’s 11 reboot is just gonna be a bunch of nerds sitting in front of pc’s.

 

[Unknown?]

How do people keep stealing Crypto. And how do you expect it to be a real option if hackers can keep stealing peoples assets?

Anything online can be hacked, including your bank. Digital is insecure and useless to society. It is bad money.

 

[AJUMP23]

Nice bonus in store for the North Korean Hacker Unit....No executions this month.

Didn't NK steal a ton of ETH?

 

[Mr1999]

How do people keep stealing Crypto. And how do you expect it to be a real option if hackers can keep stealing peoples assets?

If you have spare time, check out ledger on reddit, it's almost every week someone posts a thread saying they were hacked, and it's almost always the same story, guy wakes up to find his account emptied and then posts about it saying how he never shared his keywords and that he's not a newbie. The amount they lose is what always gets me, almost always a large sum, 30k, 50k. I don't touch crypto because of it.

 

[Trogdor1123]

How do people keep stealing Crypto. And how do you expect it to be a real option if hackers can keep stealing peoples assets?

I was wondering the same thing. How does this even work? Are all of the wallets compromised? I know next to nothing about cryptocurrency so any who can explain this to me I would greatly appreciate it

 

[YCoCg]

The Ocean’s 11 reboot is just gonna be a bunch of nerds sitting in front of pc’s.

No way that's only one part, think of the Hollywood flair here...

So the movie starts off with the hackers tracing down a large wallet owned by the Dubai Elite, they've somehow got a transfer lock on it so it can't be sent, meaning they'd have to retrieve the hard drives and keys directly from their building.

Luckily for them, they hosting a party in the same building on the top floor of the above the clouds skyscraper (think Hitman 3) and that's where the Oceans crew come in, they have to infiltrate the party, split up into two groups, one to distract the party hosts and the other to descend the building into the server room to bypass the security locks and plug some usb drives into random server racks until they find the one with the hard drives housing the crypto. It's at this point they find out the transfer keys are on a usb drive that the host wears around his neck and it's then upto to the distract crew to get that from him, hijinks ensures.

Once both are complete, they have the unlock key and the server racks of hard drives, they must escape undetected and get back to the US to deliver the goods to the hackers. Mission complete.

You can thank me later Hollywood, I'll take my royalties by cheque.

 

[Ikutachi]

Worse was the theft of Mt. Gox's 850,000 BTC.

 

[thefool]

How do people keep stealing Crypto

Highly sophisticated social engineering. These criminals technical achievements are impressive.

I was wondering the same thing. How does this even work? Are all of the wallets compromised? I know next to nothing about cryptocurrency so any who can explain this to me I would greatly appreciate it

If you want to know how it happened, check Patrick Collins explanation



He's a well known dev and smart contract auditor.

 

[Paltheos]

How do people keep stealing Crypto. And how do you expect it to be a real option if hackers can keep stealing peoples assets?

I'm still not convinced it can be. The vast majority of my awareness of crypto treatment by the public is speculatively and as a security, not as a currency, and I trust investment firms and banks to at least hold my assets responsibly more than I do crypto exchanges. The environment stinks of fraud to me.

 

[Mr1999]

It boils down to the choice of holding your own keys versus not holding your keys, with each side blaming the other when they get hacked. If you have your own hardware wallet and get hacked, it’s "your keys, your coins." But if you don’t use a hardware wallet and keep your coins on Coinbase for example, and you get hacked, it’s "not your keys, not your coins."

For example hackers don't need your coinbase user/password to access your account, and two factor authentication doesn’t protect you since they manage to steal the instance from your files while you’re browsing the site. I've read enough posts to feel like an expert, but they always find new ways to hack people, even when the person was cautious.

Sometimes the entire ledger device has been tampered it, someone buys it, opens it up and prints their own key phrases and puts it inside the ledger, repackages it and sells it, unknowing person buys the ledger and deposits all their money but the keywords are known. There's so many vectors to lose your money. People have sworn up and down that they never gave out their key phrases but still somehow managed to get hacked, that's the scary part of it.

All you can do at that point is file a police report, or find someone who may be able to get it back for a fee, which is highly unlikely, in fact there are scammers who prey on people who lost their coins, to scam them again, seen that happen as well. Don't believe me, just google "I lost all my crypto" or "Crypto stolen" into google, and search for last month and just read the threads that pop up.

Then there are those who never got hacked but saved their wallets in some configuration or they did something where they see their money in their wallet, but they can't access it, that's a whole other topic though. My point is, there are very knowledgeable people out there who have done this since its conception and they still every now and then get robbed. That's not something Im willing to risk, I don't know about you but I don't want to even imagine how crappy I would feel if I lost even $5,000, never mind the 100K some of these posts are claiming to have lost. No thanks

 

[SidViscous]

So maybe someone does have a working quantum computer after all, in theory the trick would be to do it gradually so as not to tank the whole market before you’ve cleared out a few of these massive exchange wallets.

Let them think you got the keys via some other nerfarious one-off means, intentionally don’t clear out the biggest wallet to make it look like an isolated incident.

If coinbase or kraken announce something similar in the coming months, I for one welcome our new computer overlords

 

[jason10mm]

How do people keep stealing Crypto. And how do you expect it to be a real option if hackers can keep stealing peoples assets?

Real banks get robbed all the time.

 

[HoodWinked]

very strange hack. i figured it was someone stealing the keys but it was some smart contract thing.

 

[RoadHazard]

Real banks get robbed all the time.

You know, I haven't heard of a really good bank robbery in quite some time.

 

[rkofan87]

good cypto is trash and a scam

 

[ntropy]

i thought a vital point of bitcoin was forgoing financial institutions

 

[readonly]

good cypto is trash and a scam

What about bad crypto?

 

[Mistake]

i thought a vital point of bitcoin was forgoing financial institutions

That was the original idea, but since most transactions can be traced you won't have true financial freedom. Roger Ver had some interesting things to say about it

 

[bender]

The Ocean’s 11 reboot is just gonna be a bunch of nerds sitting in front of pc’s.

 

[thefool]

i thought a vital point of bitcoin was forgoing financial institutions

a) this is ethereum, not bitcoin (not that changes a thing about whatever point you are trying to make)

b) a vital point of crypto is freedom of choice. Self-custody, p2p, using programmable smart contracts or depositing on centralized institutions is your choice to make.

 

[Hudo]

They all deserve each other. Crypto bros can get fucked.

 

[RJMacready73]

North Korea is good at this shit, Kim gonna get himself some new cheese

 

[Darchaos]

lol, cryptobros