加密貨幣和區塊鏈景觀不斷發展,隨著既定的市場領導者的出現,新的項目都出現了。

A recent report by Sygnia and Verichains has shed light on a significant cryptocurrency heist from Bybit, executed by Lazarus Group, a North Korean hacking group. Their investigation, published in the New Chain analysis, linked a malicious JavaScript code used in the breach to Lazarus Group's activities, specifically targeting Bybit's Ethereum Multisig Cold Wallet.
Sygnia和Verichains最近的一份報告揭示了由北朝鮮黑客組織Lazarus Group執行的拜比特(Bybit)的大量加密貨幣搶劫案。他們的調查發表在新的鏈分析中,將違規中的惡意JavaScript代碼與Lazarus Group的活動聯繫起來,特別是針對Bybit的Ethereum Multisig Cold Wallet。
The heist, which occurred in November 2022 and saw cryptocurrency to the tune of $1.5 billion stolen, was initially reported by the FBI, who also confirmed the involvement of TraderTraitor group, known for hacking and draining cryptocurrency exchanges. Among the stolen cryptocurrency was a large sum of Ethereum, rapidly converted by the hackers into Bitcoin and other cryptocurrencies to obfuscate the transactions.
FBI最初報告說,搶劫案發生於2022年11月,目的是被盜的15億美元被盜。在被盜的加密貨幣中,有很大的以太坊,由黑客迅速轉化為比特幣和其他加密貨幣,以混淆交易。
As reported by Blockware, the cryptocurrency exchange, Bybit, was defrauded to an enormous scale. At the time, the cryptocurrency exchange confirmed the occurrence of the incident but opted not to disclose any further details. Nonetheless, an analysis by Sygnia and Verichains identified a malicious JavaScript code used in the breach and linked it back to Lazarus Group's activities.
正如Blockware報導的那樣,加密貨幣交換BYBIT被欺騙到巨大的規模。當時,加密貨幣交易所確認了事件的發生,但選擇不披露任何其他細節。但是,Sygnia和Verichains的分析確定了違規中使用的惡意JavaScript代碼,並將其與Lazarus Group的活動聯繫起來。
Their investigation, published in the New Chain analysis, uncovered a payload deployed by Lazarus Group, targeting Bybit's Ethereum Multisig Cold Wallet. This code snippet was written in JavaScript and included a function named "handleMessage," designed to intercept and process messages from the webassembly module.
他們的調查發表在新的鏈分析上,發現了Lazarus Group部署的有效載荷,以Bybit的以太坊Multisig Cold Wallet為目標。此代碼段是用JavaScript編寫的,其中包含一個名為“ Handlesesgage”的函數,旨在攔截和處理WebAssembly模塊的消息。
The analysis further revealed that the malicious actors were able to deposit the stolen cryptocurrency into various cryptocurrency mixers in an attempt to launder the funds and mask the source of the theft. Their investigation also linked the payloads used in the Bybit attack to previously known Lazarus Group campaigns, reinforcing the group's involvement in the breach.
分析進一步表明,惡意行為者能夠將被盜的加密貨幣沉積到各種加密貨幣混合器中,以試圖洗錢並掩蓋盜竊的源頭。他們的調查還將BYBIT攻擊中使用的有效載荷與以前已知的Lazarus小組競選活動聯繫起來,從而加強了該小組參與違規行為。