North Korean Cybercriminals Snatch $1.5 Billion in Digital Assets
It appears to be a highly advanced assault on the Dubai-headquartered platform Bybit:
Bybit representatives revealed the embezzlement of over 400,000 ethereum and staked ethereum coins shortly after the incident. The announcement stated that the digital assets had been secured in a “Multisig Cold Wallet” but were somehow shifted to one of the exchange’s hot wallets. Subsequently, the stolen cryptocurrency was moved out of Bybit entirely and directed to wallets under the control of the unidentified attackers.
[…]
…an in-depth inquiry by Safe uncovered no signs of unauthorized entrance into its system, no breaches of other Safe wallets, and no glaring weaknesses in the Safe codebase. As the investigators delved deeper, they eventually pinpointed the true cause. Bybit eventually declared that the dishonest transaction was “orchestrated by a sophisticated breach that altered the smart contract logic and obfuscated the signing interface, allowing the attacker to take charge of the ETH Cold Wallet.”
The declaration on the Bybit platform is almost laughable. Here’s the headline: “Incident Update: Unauthorized Activity Involving ETH Cold Wallet.”
This breach establishes a new standard in digital asset security by circumventing a multisig cold wallet without exploiting any vulnerabilities in smart contracts. Rather, it leveraged human trust and UI deception:
- Multisigs no longer guarantee security if signers can be compromised.
- Cold wallets are not automatically secure if an attacker can manipulate what a signer perceives.
- Incidents of supply chain and UI manipulation are growing in sophistication.
The Bybit breach breaks long-held beliefs about digital asset security. Regardless of how robust your smart contract logic or multisig defenses may be, the human factor remains the weakest point. This breach demonstrates that UI manipulation and social engineering can bypass even the most fortified wallets. The sector must shift towards comprehensive prevention — every transaction must be duly verified.
Image of Bruce Schneier on the sidebar is taken by Joe MacInnis.
About Author
