{"id":295066,"date":"2025-02-26T21:26:38","date_gmt":"2025-02-26T21:26:38","guid":{"rendered":"https:\/\/newhampshiredigitalnews.com\/index.php\/2025\/02\/26\/blind-signing-is-an-issue-but-not-the-prime-suspect-expert-says-on-bybit-1-4b-saga\/"},"modified":"2025-02-26T21:26:38","modified_gmt":"2025-02-26T21:26:38","slug":"blind-signing-is-an-issue-but-not-the-prime-suspect-expert-says-on-bybit-1-4b-saga","status":"publish","type":"post","link":"https:\/\/newhampshiredigitalnews.com\/index.php\/2025\/02\/26\/blind-signing-is-an-issue-but-not-the-prime-suspect-expert-says-on-bybit-1-4b-saga\/","title":{"rendered":"‘Blind signing is an issue, but not the prime suspect’ expert says on Bybit $1.4b saga"},"content":{"rendered":"


\n<\/p>\n

\n

Aneirin Flynn, co-founder and CEO of FailSafe, spoke with crypto.news about the Bybit exploit, future preventive measures, and why an Ethereum rollback is unfeasible.<\/p>\n

Cryptocurrency prices tumbled following one of the largest cyber heists in financial history, as North Korea\u2019s Lazarus Group breached<\/a> Bybit\u2019s Ethereum (ETH<\/a>) cold wallet, stealing more than 400,000 ethereum worth $1.4 billion at the time.<\/p>\n

Ben Zhou, Bybit\u2019s CEO, was quick to defend the exchange. The community was kept informed, industry leaders mobilized resources to assist, and Bybit filled the financial gap within days, restoring withdrawals to normal.<\/p>\n

While recovery efforts advanced through a bounty program and on-chain tracking, hackers laundered the stolen funds across thousands of addresses.<\/p>\n

\"Bybit\n<\/picture>
Lazarus laundering stolen Bybit Ether | Source: Arkham<\/figcaption><\/figure>\n

<\/p>\n

Hack, exploit, or something else?<\/h2>\n

\u201cThis was a sophisticated social engineering attack,\u201d FailSafe CEO Aneirin Flynn told crypto.news. Flynn said hackers used similar tactics against Radiant Capital, DMM Bitcoin, and WazirX.<\/p>\n

In Bybit\u2019s case, Zhou said bad actors spoofed the multi-sig UI and the team unknowingly signed malicious transactions. Findings from an audit<\/a> conducted by Sygnia Labs and Verichains discovered that Lazarus agents used compromised access from a Safe Wallet developer to deceive Bybit multi-sig signers. <\/p>\n

This breach allowed North Korean-funded cybercriminals to push through a malicious transaction, siphoning funds from Bybit\u2019s cold wallet.<\/p>\n

\n

Multi-sig blind signing<\/h2>\n

The incident raised concerns about blind signing, where users approve transactions without fully verifying details such as destination addresses.<\/p>\n

According to Zhou, he was the final signer and used a Ledger hardware wallet to authorize the last approval. However, design limitations prevented full transaction verification, ultimately allowing hackers to steal the funds.<\/p>\n

\u201cYes, blind signing is an issue, but it\u2019s not the prime suspect in this case,\u201d Flynn said when asked if it enabled the theft. Instead, FailSafe\u2019s CEO pointed to large digital asset clusters maintained by most centralized exchanges and protocols in the industry.\u00a0<\/p>\n

Bybit painted a target on its back because it stored billions of crypto in a single multi-sig and Lazarus came knocking, Flynn suggested. Splitting assets under management across multiple addresses may stem the problem, FailSafe\u2019s boss said.<\/p>\n

\n

While greater employee vigilance and robust transaction security tooling would have reduced the likelihood of a successful theft, segregating assets would have been the most effective way to reduce the exchange\u2019s appeal to attackers.<\/p>\n

Aneirin Flynn, FailSafe co-founder and CEO<\/p>\n<\/blockquote>\n

<\/p>\n

Ethereum rollback not the solution for Bybit<\/h2>\n

Maelstrom CIO Arthur Hayes suggested rolling back ethereum\u2019s blockchain to reverse the Bybit hack, a move that would restore transactions and wallet balances to their pre-hack state.<\/p>\n

Hayes argued that the 2016 DAO fork set precedent for this to happen. Hackers stole $60 million from the Ethereum DAO at the time, striking a big blow to Ethereum, which was still in its infancy back then.\u00a0<\/p>\n

The DAO then voted for an \u201cirregular state change\u201d to curtail the crisis. Ethereum was split into two \u2013 Ethereum Classic, the original blockchain with the DAO hack losses, and Ethereum, today\u2019s second-largest blockchain.<\/p>\n

Short-lived discussions based on Hayes\u2019 idea noted that the 2016 DAO hack, an existential crisis for Ethereum at the time, was starkly different from Bybit\u2019s $1.4 billion loss, arguably a splash in the ETH pond in the current market.<\/p>\n

Flynn stated that rolling back Ethereum now would break too many protocols and smart contracts given the size of ETH\u2019s ecosystem.\u00a0\u201cRolling back Ethereum is technically possible through a hard fork but practically infeasible now due to the network\u2019s size, complexity, and decentralization.\u201d<\/p>\n

<\/p><\/div>\n


\n
Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Aneirin Flynn, co-founder and CEO of FailSafe, spoke with crypto.news about the Bybit exploit, future preventive measures, and why an Ethereum rollback is unfeasible. Cryptocurrency<\/p>\n","protected":false},"author":1,"featured_media":295067,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[163],"tags":[],"class_list":["post-295066","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/posts\/295066","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/comments?post=295066"}],"version-history":[{"count":0,"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/posts\/295066\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/media\/295067"}],"wp:attachment":[{"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/media?parent=295066"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/categories?post=295066"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newhampshiredigitalnews.com\/index.php\/wp-json\/wp\/v2\/tags?post=295066"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}