Talking about Li and Talking about the Outside

ay (February 21)

Some friends were still immersed in the joy of "the bull returning quickly" yesterday (February 21), as Bitcoin rebounded to around $99,500 and Ethereum also bounced back to around $2,850. Let's not get into whether yesterday's rebound was a trap; it seems that this market trend has given some partners hope again.

However… by the evening, the market faced a black swan event: the Bybit exchange was hacked, with over 510,000 ETH stolen (worth about $1.5 billion, including 401,347 ETH, 90,376 stETH, 15,000 cmETH, and 8,000 mETH).

We don't need to delve too deeply into the complex attack techniques; interested friends can look it up online. Here, we will simply explain it in layman's terms:

There is an exchange called Bybit, and their multi-signature cold wallet is managed and authorized by a few individuals, namely Zhang San, Li Si, and Wang Wu. Any transaction must be signed by all of them to be completed. So, the hacker used some special means to locate these individuals (which falls under social engineering attacks) and continued to implant malware on their computers through some special methods. One day, the three individuals received a signature request for a transfer, showing that 500 ETH was to be transferred out. Zhang San saw that there was no problem with the operation interface, so he signed it as usual, and then Li Si and Wang Wu did the same. However, the signature interface they saw was forged by the hacker, resulting in the simultaneous signatures transferring 500,000 ETH to the hacker's wallet address.

After the Bybit attack incident occurred, various speculations emerged online. Some said it was an inside job, while others claimed it was the work of a North Korean hacker organization, and even some users from the PI community were spreading the word that they would take responsibility for the incident…

However, after analyzing the situation throughout the morning, it seems that professionals have largely determined that this attack was carried out by the North Korean hacker group Lazarus Group, using a method called blind signature, where the UI displayed to the user on the infected device differs from what actually happens in the background. The specific process is roughly as we described in layman's terms. Interested friends can also consider looking at the detailed report released by Slow Mist for a more professional interpretation.

The North Korean hacker organization Lazarus Group has been accused of multiple cyber attacks since 2010, including the Sony Pictures hack, the 2016 bank heist, the "WannaCry" ransomware attack, and several attacks targeting cryptocurrency and pharmaceutical companies. As shown in the image below.

Below are some attacks by the Lazarus Group in the cryptocurrency field:

And so on…

It can also be seen that this Bybit hack is the largest theft incident in history. Although this black swan event is quite significant, it seems that it hasn't caused a heavy blow to the overall market. As of the time of writing, Bitcoin's price remains around $96,000, and Ethereum's price stays around $2,700. There were only some minor incidents during this period, such as:

MNT (Bybit's token) dropped 10% within minutes, as shown in the image below.

USDE decoupled by 5%, but quickly rebounded. This also indirectly caused ENA to drop and then rise, with a direct increase of about 10% today. This might also be due to Ethena's timely public relations efforts, as shown in the image below.

Looking back at the situation over the past ten hours, Bybit's public relations handling has been quite good. For instance, within 30 minutes of the incident, Bybit's CEO responded on the X platform, and within the next 10 minutes, Bybit's official account also released an official statement. The CEO even held a live stream to answer some community questions. This speed and attitude in handling the situation have been quite helpful in stabilizing market sentiment temporarily.

However, the internet is still filled with various messages and speculations. My suggestion is that everyone should at least remain calm and avoid clicking on random links to prevent phishing. I have noticed that some people have started to promote scam wallets using this hot topic, luring users to download them under the guise of protecting their assets. If you are concerned about the safety of your assets, you might consider temporarily transferring them to larger exchanges like Binance or OKX.

Since the hackers are from North Korea, the probability of recovering the stolen assets is quite low. This loss will likely have to be borne by Bybit itself. As for how they will bear it, whether Bybit will purchase ETH