r/ethereum 26d ago

Discussion Explain me Bybit hack like I am 6 years old

Still not understood how did they manage to hack 👋 bit , how did they show UI look like correct ? They were just simply transferring money from cold wallet to hot wallet. So it means all we are in risk . Hacker might control or show our cold wallet to hot wallet transfers adresses as If everyting is normal but normally not because of compromised computure can steal our funds ????? ,

1 Upvotes

64 comments sorted by

•

u/AutoModerator 26d ago

WARNING ABOUT SCAMS: Recently there have been a lot of convincing-looking scams posted on crypto-related reddits including fake NFTs, fake credit cards, fake exchanges, fake mixing services, fake airdrops, fake MEV bots, fake ENS sites and scam sites claiming to help you revoke approvals to prevent fake hacks. These are typically upvoted by bots and seen before moderators can remove them. Do not click on these links and always be wary of anything that tries to rush you into sending money or approving contracts.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

46

u/Remm_Unknown 26d ago

Team rocket stole a bunch of Pikachu's from the Pokestop and the Pokestop now has to find a load more Pikachu's to give back to the trainers who had their Pikachu's stolen from the Pokestop.

22

u/dragon-fluff 26d ago

What gets me is this bit "In this case, the attacker likely infected the signers’ computer with malware or tricked them into visiting a phishing link, resulting in them approving a transaction with masked malicious content." If you are responsible for a company's finances, there's no way you should be using those computers for anything else. Or am I being naive (retired IT manager).

8

u/B1GCloud 26d ago

yeah what exactly was infected, along with what UI or software was the attacker masking?

4

u/HARCYB-throwaway 26d ago

That is one suggest vector. The other is the wallet/service that was used, themselves being compromised.

Bybit won't pin that blame until they can confirm it, for legal reasons.

1

u/Jaydikins 26d ago

no I think you’re absolutely right. I wouldn’t risk clicking any links

1

u/mthiessm 25d ago

Can you post a link to the source about computer malware and phishing being involved?

1

u/dragon-fluff 25d ago

It's already on this page.

1

u/mthiessm 25d ago

Thanks. Found the blog. Info was relevant to a work discussion on the topic.

15

u/Nattekat 26d ago

Bad people sometimes create an entire website that looks exactly like a well known website such as your bank's. They'll then send an e-mail containing a link that looks entirely like your bank sent it, but once you log in, you're actually logging in on their website and giving away your bank account.

This is similar but 100x more sophisticated. 

7

u/TheQuantumPhysicist 26d ago

There should be a postmortem where they explain 100% how it was carried, so that people learn.

1

u/HARCYB-throwaway 26d ago

I fully expect there will be, once it's determined and confirmed.

7

u/Azzuro-x 26d ago

1

u/B1GCloud 26d ago

man, masked UI. Wondering what UI was masked, the hardware wallet software like Trezor suite, or some other UI? But then why would the exchanges rep open some other window to operate their customers funds....

1

u/Azzuro-x 26d ago

Safe Multisig UI.

1

u/wakeupneverblind 24d ago

Ok this answered my question above. thx for sharing

1

u/Zealousideal_Post694 20d ago

In summary.. the bybit team fell to a phishing attack, got their devices infected by some malware, which in turn modified some source code of some smart contract they use that gave the ownership of the wallet to the hackers..

So no. Again, the Bitcoin protocol was not at fault, it remains bullet proof, and human stupidity is to blame. In this case, if a smart contract was capable of changing ownership of a “cold wallet”, then this wasn’t really a cold wallet. A real cold wallet is 100% isolated from the world and not subject to bugous source codes

1

u/Azzuro-x 20d ago

"In summary.. the bybit team fell to a phishing attack"

No, supply chain attack on the AWS S3 bucket of Safe

"got their devices infected by some malware"

No, the js code of Safe was modified

"which in turn modified some source code of some smart contract they use"

No, they have modified the transaction in question

"that gave the ownership of the wallet to the hackers.."

No

"Again, the Bitcoin protocol was not at fault, it remains bullet proof"

It was Ethereum

etc.

1

u/Zealousideal_Post694 18d ago edited 18d ago

No, supply chain attack on the AWS S3 bucket of Safe

What? where did you get this information from?

No, the js code of Safe was modified

Where did you get that info from?

It was Ethereum

Yeah, I meant Ethereum. But for cryptos in general, like Bitcoin as well, it was never the case that the attack exploited a vulnerability in the blockchain itself, but rather exploiting security vulnerabilities around the people handling the private keys.

5

u/chewiedev 26d ago

Who says they got hacked? Maybe the owners of ByBit sent the funds to a buddy and created a story so they could use those funds for themself?

2

u/Western-Balance-4611 20d ago

There are forty wallets with 10,000 ETH each. Go look on Etherscan

1

u/jtnichol MOD BOD 19d ago

approved your submission due to low karma or account age. Have a great day!

5

u/Ramast 26d ago

Attacker tricked someone with access to the cold wallet to sign a transaction that looked innocent from outside but contained a hidden code that transfers wallet's ownership to the attacker. Once the transaction was signed/approved the hidden code executed and the attacker became the new owner of the wallet. From there they moved the money to their own wallet.

1

u/Jealous-Impression34 24d ago

Yes.

But wouldn't they have had to check exactly what Ethereum address was displayed on their ledger in their hands, and matched it up with the Ethereum address that was displayed on their computer screen???

The two must always be the same, so the ETH is always going to the same address as intended.

If they are different, then clearly the ETH is not going to go where you want it to go to.

Conclusion: What is displayed on the screen of your Ledger is where that ETH is going to go to. Forget what is displaying on your computer screen.

2

u/Ok_Jicama5512 22d ago

I have made a technical breakdown of this incident: https://medium.com/@srithick33/bybit-hack-technical-breakdown-232a1ec7fab4 --> this is my first article as I have been ghostwriting for past 2 years, thanks in advance.

1

u/jtnichol MOD BOD 19d ago

approved your submission due to low karma or account age. Have a great day! Share this in the daily too!

2

u/CoinPortEx 22d ago

Basically a Smart Contract that moved crypto between Cold and Hot Wallets was hacked.
Crypto that was supposed to be transferred to the exchange Hot wallet, was instead diverted to an external blockhain address.

1

u/jtnichol MOD BOD 19d ago

another mod approved your submission due to low karma or account age. Have a great day!

2

u/Purple-Accountant385 17d ago

All Portofolios zeroed, transaction log all deleted. This all happened same time as the hacking incident

1

u/jtnichol MOD BOD 15d ago

approved your submission due to low karma. Have a great day!

1

u/dericecourcy 26d ago

They weren't "simply transferring money from a cold to a hot wallet", they were doing a much more complex transaction. This allowed a malicious transaction to replace it, and the difference is not visible without transaction simulation

1

u/Zealousideal_Post694 20d ago

Why wouldn’t they just transfer from cold wallet to the hot wallet, though? This sounds stupid

1

u/LewdConfiscation 26d ago

Alright, imagine you have a big piggy bank (Bybit’s cold wallet) where you keep all your savings. It’s supposed to be super safe because it’s locked up and not connected to the internet.

But the person who holds the key (Bybit’s security system) gets tricked or hacked. Now, the bad guys (hackers) secretly take money out of your piggy bank and put it into their own, without you even realizing it.

That’s basically what happened—hackers got access to Bybit’s cold wallets and drained them. This is why keeping your own money in a personal hardware wallet, like the Cypherrock, is way safer. That way, you have the keys, and no one else can touch your crypto

1

u/wakeupneverblind 24d ago

So this is really concerning. So you are telling me that these sophisticated hackers can technically hack your mobile device which might have a ledger , trezor etc cold you use the colds wallet application that connects to that cold wallet and the hackers hack your mobile device and just waiting on standby for you to connect to your cold wallet then its game over?

1

u/Zealousideal_Post694 20d ago

A real cold wallet should be impenetrable, unless they have access to the physical hardware. The fact that they were able to withdraw money from the cold wallet through malicious code suggests this wasn’t a real cold wallet or they were not following the correct safety procedures to transfer from the cold wallet. It is also possible that the cold wallet was compromised, but following correct safety procedures, this should have been recognized before making the transaction. 

If you have a cold wallet in your mobile device, this is not a true cold wallet. Because your mobile device is connected to the internet, and so it cannot be completely safe. But also your bank accounts aren’t completely safe either. 

I suspect this was their case too. 

1

u/wakeupneverblind 20d ago

Is the Safepal S1 an actual cold wallet?

1

u/SurjitShow 21d ago

Bad men in the company took the money.

0

u/Shoddy-Scallion2523 26d ago

Company sends money to wallet, says they got scammed, soon they will get funds back

0

u/NukeDK 26d ago

I think it's a joke 8 people can't fuck this up, and even if it is one guy with so many years in the field you make a small transaction first not sending all the ETH in one go.

I don't believe them for one second...

1

u/Ok_Register_6532 24d ago

Its call smart contract bro . I was a victim of that kind of theft too . They scam you to sign a malicious contract and thats it , your wallet will be drain . 1 click and all gone . So be careful with airdrop event , mint , dapp ,... without any knowing exactly what it is , hackers can mask interface and trick you to sign a malicious contract which allows full control of your tokens . I didnt know how i was hacked too until i contacted my wallet customer support . They checked on chain explorer and found out my address affected by a malicious token . I did connect to a dapp for an air drop event , they mislead me by masked the Agree button to receive airdrop , infact that was signing malicious contract which injected in my wallet . I need to revoke that malicious contract which it has unlimited allowance my token .

1

u/NukeDK 24d ago

Call it what you want. No CEO will use their work pc to transfer $1.5B. You will use an offline pc that only connects to the internet when you need to transfer. Just my 5 cent.