Bybit's Founder Shares Concerns Over Major Ethereum Security Breach
Bybit founder Ben Zhou recently expressed his worries about a significant breach involving multisig wallet provider Safe, which might have led to hackers extracting a staggering $1.4 billion in Ethereum funds. This incident has attracted considerable attention in the cryptocurrency community, raising questions about security practices within the industry.
How the Attack Was Executed
During a live stream, Zhou detailed the mechanics of the attack that specifically targeted Bybit's Ethereum cold wallet. Fortunately, all other wallets, including those holding Bitcoin, were not affected. This narrow focus on the Ethereum wallet highlights a potential flaw that needs addressing.
Details of the Breach
Zhou elaborated on how the hackers managed to manipulate Bybit’s signing process while masquerading their actions behind what appeared to be a legitimate Safe transaction. This deception involved using a standard URL from the official Safe website. Zhou stated, “I double-checked everything; it was the Safe URL we always use.” However, despite this verification process, the attackers had managed to alter the signing message.
Instead of merely transferring funds, the hackers effectively changed the smart contract logic governing the cold wallet. Zhou revealed that this deceptive alteration granted them complete control over the Ethereum cold wallet in question.
Consequences of the Hack and Bybit's Strategy
The amount stolen includes:
- 401,347 ETH worth approximately $1.12 billion
- 90,376 stETH valued at around $253 million
- 15,000 cmETH estimated at $44 million
- 8,000 mETH, equating to about $23 million
In the aftermath, Zhou reassured users that withdrawals are still processing, though at slower rates due to heightened activity. At its peak, Bybit faced a request volume nearly 100 times above typical levels. To stay afloat while addressing these issues, Bybit has secured a bridge loan from its partners.
“We are not in the position to procure more ETH currently. However, we managed to secure nearly 80% of the lost funds through this arrangement to uphold liquidity,” Zhou said.
The Ongoing Investigation
Bybit is actively collaborating with the Safe team to investigate the breach's source. Zhou mentioned that Safe has temporarily halted its services to conduct a thorough internal investigation, saying, “It could be that the Safe server was hacked, but we are still determining the facts.”
Efforts to Track Stolen Assets
Support has flowed in from major exchanges, including Binance, MEXC, and Gate, in an effort to trace the stolen funds. Zhou urged security firms and blockchain specialists to assist in tracking the movement of these assets, hoping to freeze any stolen Ethereum before it can be laundered.
Future Steps by Bybit
Despite the hack's severity, Bybit is confident in its ability to absorb the financial hit, emphasizing that the stolen Ethereum amount is a mere fraction of the exchange's total assets. The company has pledged to bolster its security measures while consistently updating users concerning the ongoing investigation.
Frequently Asked Questions
What happened in the Bybit Ethereum hack?
Bybit suffered a $1.4 billion Ethereum theft, with founder Ben Zhou revealing a potential compromise of multisig wallet provider Safe.
How did the hackers manage to breach Bybit's security?
The hackers manipulated the signing process by altering the smart contract logic during what appeared to be a legitimate transaction.
What was the total amount stolen in the hack?
The total stolen amount was approximately $1.4 billion in Ethereum and other related assets.
How is Bybit addressing the situation?
Bybit is working with Safe to investigate the breach and has also secured a bridge loan to maintain liquidity for users.
What can users expect moving forward?
Bybit reassured clients that they have sufficient reserves to cover losses and are committed to enhancing security measures while keeping users informed.
