[Music] this is Twi under the headline boy that's got to hurt is the news that the world's second largest by trading volume second largest major cryptocurrency exchange was as they say taken to the cleaners by a group of quite determined North Korean hackers to the tune of is everybody sitting down grip your steering wheel fir if you're if you're listening to this during your morning commute 1. 5 billion dollar worth of completely liquid ethereum tokens 1. 5 billion dollars wow this makes it the largest crypto Heist ever in history probably the largest heist in history right how you going to steal 1.
5 billion from a you know armored car I mean it is the largest Heist of any time in history of the world um and it's nearly two and a half times larger than their previous record which was the theft of $625 million from the Ronin Network back in April of 2022 so I have a link in the show notes at the bottom of page 12 showing the fraudulent transaction event on the ethereum blockchain where 41,0 346 76888 I mean it goes on forever you know with decimal eth are being transferred that transfer was fraudulent ethereum peaked at around $4,000 each in early December of last year and is currently trading around $2,800 which if you multiply 2800 by$ 4,346 you get around1 and5 billion dollars of liquidity that this that a the the second largest group which is bit pay lost okay so the hack took place just last Friday February 21st and in addition to being the single largest crypto Heist ever it's also considered to be one of the most complex crypto heists ever you know parenthetically kudos to buybit because we wouldn't know all these details if they hadn't been very transparent yes they were and they they have not been sunk they they said we've got the liquidity to cover this you know this does not put us out of business but uh they're not happy about it but yes they they were very upfront um so the most not only the biggest but the most complex crypto Heist the blockchain analytics firm uh Arkham intelligence and or firms Arkham intelligence and also the the intelligence firm elliptic have independently claimed that they were able to track the hack to the Lazarus Group which is a well-known North Korean advanced persistent group an AP group what we know is that Lazarus first in infiltrated um by bits Network some time ago they then quietly studied the company's internal procedures identified and then infected with malware all of the multiple employees who are now required to mutually sign off on any major movement of the company's funds this multi signoff requirement is obviously designed to solve the problem of any single employee being hacked or fished or scammed or whatever but that didn't thwart the attack this time the hackers specifically targeted the process of replenishing the company's active wallets known as hot wallets where the company's daily operational funds are stored when hot wallets run dry or low crypto exchanges will move funds from their reserves from the so-called cold wallets to make sure there's enough liquidity to cover users withdrawals and token inter exchanges the same goes for when hot wallets hold too much money in those instances crypto exchanges will move funds back off of the off back to the offline cold reserves to safeguard those reserves from malicious actors and exp and exploits and limit possible losses so you know that all makes sense and actually that's what saved these guys right because they've got something like 10 billion in in total uh Reserve only one in a half only I'm saying but still not all of it because they did have a bunch in cold storage and the bad guys didn't get that but they did Capture One massive transfer of 1. 2 billion bybit CEO Ben Cho says that when his staff wanted to replenish the hot wallets with new funds on Friday the hackers altered the user interface of the crypto wallet software the company was using to move their funds the modification appeared on the systems of everyone of the multiple Engineers who needed to simultaneously sign off off in what is known as a multisig transaction a tweet describing that that what happened reads I I have a tweet in the show notes from from some random person who said the attacker somehow then we've got four points first identified every multisig signer second infected each signer's device with malware third made the UI show a different trans action than what was actually being signed fourth got all signers to approve without suspicion and then he finished saying cold wallet security just got redefined now not surprisingly by bit's loss of that1 and5 billion dollar in ethereal tokens did not go unnoticed and since this makes many investors nervous about other potential weaknesses by bits security you know weaknesses in and about by bits security the company did say that news of the hack had led to a surge in withdrawal requests uh CEO Cho wrote that the company had received more than 350,000 requests from customers to withdraw their funds and that this surge of departing money could lead to delays in processing in response bybit set up a bounty for the recovery of the stolen funds get this offering to pay anyone who is able to recover the funds 10% of anything they're able to recover I'll take it uhuh this has in turn set off the biggest bounty hunt on the internet with the winners being eligible to earn up to a whopping 50 m million do right 10% of one and a half billion at the same time not surprisingly the perpetrators who were naturally standing by and ready to deal with this massive windfall quickly began laundering their funds in the hopes of hiding their tracks and diffusing the proceeds of their theft among the world's cryptocurrency exchanges they you know they're moving quickly because if they leave the funds in their normal wallets they risk having them hacked back by multiple parties including law enforcement bounty hunters and other threat actors another tweet observed and this was from uh vxdb tweeted Lazareth has started laundering the 1. 4 billion stolen uh eth and they said uh uh exch docx a no kyc exchange has recorded an abnormal spike in eth volume 20K eth in the past 24 hours versus its usual 800 eth their Bitcoin reserves are also empty but their eth reserves have increased by 900% so yes that 1.
5 billion is you know sosing around within the internet's exchanges while North Korea tries to to you know tuck it away in in random corners of the internet so that it's not all in one place and hopefully you know can't easily be be tracked and recovered and since and you know we know since blockchain activity can be monitored and tracked uh we now have a bit of a shell game underway so what's our takeaway from this if we're wise every event teaches a lesson that prevents its recurrence and hopefully others are also able to learn and gain from seeing what has befallen others and take away the same lessons without needing to first fall off the same cliff in this case I think the lesson here is that the systems which manage these massive cryptocurrency reserves need to be far more isolated from everyday systems than they currently are in other words they need to be fully air gapped with nothing less being sufficient these are lessons that the professional intelligence community and those practicing the highest Security in the world learned decades ago and nothing we've done since with our computer and networking technology has served to make air gapping any less necessary we could easily argue that in fact the reverse ver is true and that air gapping systems that absolutely and positively must never be compromised has grown more necessary today than ever before I would bet that bybit has just learned the same painful lesson they obviously felt that requiring a multi-person multi- keed funds transfer authorization process would be sufficient it's certainly better than requiring just one person they just learned a$ 1. 5 billion lesson though that it wasn't enough that's amazing wow wow hey it's Leo leaport I hope you've enjoyed this little snippet from security now if you want the whole show you can get at our website twit.
