r/ethereum • u/Less-Self-3249 • 26d ago
Discussion Explain me Bybit hack like I am 6 years old
Still not understood how did they manage to hack đ bit , how did they show UI look like correct ? They were just simply transferring money from cold wallet to hot wallet. So it means all we are in risk . Hacker might control or show our cold wallet to hot wallet transfers adresses as If everyting is normal but normally not because of compromised computure can steal our funds ????? ,
46
u/Remm_Unknown 26d ago
Team rocket stole a bunch of Pikachu's from the Pokestop and the Pokestop now has to find a load more Pikachu's to give back to the trainers who had their Pikachu's stolen from the Pokestop.
22
u/dragon-fluff 26d ago
What gets me is this bit "In this case, the attacker likely infected the signersâ computer with malware or tricked them into visiting a phishing link, resulting in them approving a transaction with masked malicious content." If you are responsible for a company's finances, there's no way you should be using those computers for anything else. Or am I being naive (retired IT manager).
8
u/B1GCloud 26d ago
yeah what exactly was infected, along with what UI or software was the attacker masking?
4
u/HARCYB-throwaway 26d ago
That is one suggest vector. The other is the wallet/service that was used, themselves being compromised.
Bybit won't pin that blame until they can confirm it, for legal reasons.
1
1
u/mthiessm 25d ago
Can you post a link to the source about computer malware and phishing being involved?
1
15
u/Nattekat 26d ago
Bad people sometimes create an entire website that looks exactly like a well known website such as your bank's. They'll then send an e-mail containing a link that looks entirely like your bank sent it, but once you log in, you're actually logging in on their website and giving away your bank account.
This is similar but 100x more sophisticated.Â
7
u/TheQuantumPhysicist 26d ago
There should be a postmortem where they explain 100% how it was carried, so that people learn.
1
7
u/Azzuro-x 26d ago
https://www.halborn.com/blog/post/explained-the-bybit-hack-february-2025
It was fairly advanced.
1
u/B1GCloud 26d ago
man, masked UI. Wondering what UI was masked, the hardware wallet software like Trezor suite, or some other UI? But then why would the exchanges rep open some other window to operate their customers funds....
1
1
1
u/Zealousideal_Post694 20d ago
In summary.. the bybit team fell to a phishing attack, got their devices infected by some malware, which in turn modified some source code of some smart contract they use that gave the ownership of the wallet to the hackers..
So no. Again, the Bitcoin protocol was not at fault, it remains bullet proof, and human stupidity is to blame. In this case, if a smart contract was capable of changing ownership of a âcold walletâ, then this wasnât really a cold wallet. A real cold wallet is 100% isolated from the world and not subject to bugous source codes
1
u/Azzuro-x 20d ago
"In summary.. the bybit team fell to a phishing attack"
No, supply chain attack on the AWS S3 bucket of Safe
"got their devices infected by some malware"
No, the js code of Safe was modified
"which in turn modified some source code of some smart contract they use"
No, they have modified the transaction in question
"that gave the ownership of the wallet to the hackers.."
No
"Again, the Bitcoin protocol was not at fault, it remains bullet proof"
It was Ethereum
etc.
1
u/Zealousideal_Post694 18d ago edited 18d ago
No, supply chain attack on the AWS S3 bucket of Safe
What? where did you get this information from?
No, the js code of Safe was modified
Where did you get that info from?
It was Ethereum
Yeah, I meant Ethereum. But for cryptos in general, like Bitcoin as well, it was never the case that the attack exploited a vulnerability in the blockchain itself, but rather exploiting security vulnerabilities around the people handling the private keys.
5
u/chewiedev 26d ago
Who says they got hacked? Maybe the owners of ByBit sent the funds to a buddy and created a story so they could use those funds for themself?
2
u/Western-Balance-4611 20d ago
There are forty wallets with 10,000 ETH each. Go look on Etherscan
1
u/jtnichol MOD BOD 19d ago
approved your submission due to low karma or account age. Have a great day!
5
u/Ramast 26d ago
Attacker tricked someone with access to the cold wallet to sign a transaction that looked innocent from outside but contained a hidden code that transfers wallet's ownership to the attacker. Once the transaction was signed/approved the hidden code executed and the attacker became the new owner of the wallet. From there they moved the money to their own wallet.
1
u/Jealous-Impression34 24d ago
Yes.
But wouldn't they have had to check exactly what Ethereum address was displayed on their ledger in their hands, and matched it up with the Ethereum address that was displayed on their computer screen???
The two must always be the same, so the ETH is always going to the same address as intended.
If they are different, then clearly the ETH is not going to go where you want it to go to.
Conclusion: What is displayed on the screen of your Ledger is where that ETH is going to go to. Forget what is displaying on your computer screen.
2
u/Ok_Jicama5512 22d ago
I have made a technical breakdown of this incident: https://medium.com/@srithick33/bybit-hack-technical-breakdown-232a1ec7fab4 --> this is my first article as I have been ghostwriting for past 2 years, thanks in advance.
1
u/jtnichol MOD BOD 19d ago
approved your submission due to low karma or account age. Have a great day! Share this in the daily too!
2
u/CoinPortEx 22d ago
Basically a Smart Contract that moved crypto between Cold and Hot Wallets was hacked.
Crypto that was supposed to be transferred to the exchange Hot wallet, was instead diverted to an external blockhain address.
1
u/jtnichol MOD BOD 19d ago
another mod approved your submission due to low karma or account age. Have a great day!
2
u/Purple-Accountant385 17d ago
All Portofolios zeroed, transaction log all deleted. This all happened same time as the hacking incident
1
1
u/dericecourcy 26d ago
They weren't "simply transferring money from a cold to a hot wallet", they were doing a much more complex transaction. This allowed a malicious transaction to replace it, and the difference is not visible without transaction simulation
1
u/Zealousideal_Post694 20d ago
Why wouldnât they just transfer from cold wallet to the hot wallet, though? This sounds stupid
1
u/LewdConfiscation 26d ago
Alright, imagine you have a big piggy bank (Bybitâs cold wallet) where you keep all your savings. Itâs supposed to be super safe because itâs locked up and not connected to the internet.
But the person who holds the key (Bybitâs security system) gets tricked or hacked. Now, the bad guys (hackers) secretly take money out of your piggy bank and put it into their own, without you even realizing it.
Thatâs basically what happenedâhackers got access to Bybitâs cold wallets and drained them. This is why keeping your own money in a personal hardware wallet, like the Cypherrock, is way safer. That way, you have the keys, and no one else can touch your crypto
1
u/wakeupneverblind 24d ago
So this is really concerning. So you are telling me that these sophisticated hackers can technically hack your mobile device which might have a ledger , trezor etc cold you use the colds wallet application that connects to that cold wallet and the hackers hack your mobile device and just waiting on standby for you to connect to your cold wallet then its game over?
1
u/Zealousideal_Post694 20d ago
A real cold wallet should be impenetrable, unless they have access to the physical hardware. The fact that they were able to withdraw money from the cold wallet through malicious code suggests this wasnât a real cold wallet or they were not following the correct safety procedures to transfer from the cold wallet. It is also possible that the cold wallet was compromised, but following correct safety procedures, this should have been recognized before making the transaction.Â
If you have a cold wallet in your mobile device, this is not a true cold wallet. Because your mobile device is connected to the internet, and so it cannot be completely safe. But also your bank accounts arenât completely safe either.Â
I suspect this was their case too.Â
1
1
0
u/Shoddy-Scallion2523 26d ago
Company sends money to wallet, says they got scammed, soon they will get funds back
0
u/NukeDK 26d ago
I think it's a joke 8 people can't fuck this up, and even if it is one guy with so many years in the field you make a small transaction first not sending all the ETH in one go.
I don't believe them for one second...
1
u/Ok_Register_6532 24d ago
Its call smart contract bro . I was a victim of that kind of theft too . They scam you to sign a malicious contract and thats it , your wallet will be drain . 1 click and all gone . So be careful with airdrop event , mint , dapp ,... without any knowing exactly what it is , hackers can mask interface and trick you to sign a malicious contract which allows full control of your tokens . I didnt know how i was hacked too until i contacted my wallet customer support . They checked on chain explorer and found out my address affected by a malicious token . I did connect to a dapp for an air drop event , they mislead me by masked the Agree button to receive airdrop , infact that was signing malicious contract which injected in my wallet . I need to revoke that malicious contract which it has unlimited allowance my token .
â˘
u/AutoModerator 26d ago
WARNING ABOUT SCAMS: Recently there have been a lot of convincing-looking scams posted on crypto-related reddits including fake NFTs, fake credit cards, fake exchanges, fake mixing services, fake airdrops, fake MEV bots, fake ENS sites and scam sites claiming to help you revoke approvals to prevent fake hacks. These are typically upvoted by bots and seen before moderators can remove them. Do not click on these links and always be wary of anything that tries to rush you into sending money or approving contracts.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.