Changpeng Zhao: Safe's Bybit Hack Report Leaves Many Questions
Safe's report on the investigation into the $1.46 billion Bybit hack is vague and leaves more questions than answers, Binance founder Changpeng Zhao (CZ) said.
“I usually try not to criticize other people in the industry, but I still do it from time to time,” he wrote.
According to the wallet team's findings, Lazarus Group attacked Bybit using a compromised Safe {Wallet} developer machine. The result was a disguised malicious transaction offer. The incident occurred during a transfer of funds from cold storage.
“Lazarus is a state-sponsored North Korean hacker group that is well known for sophisticated social engineering attacks on developer credentials, sometimes combined with zero-day exploits,” the report's authors noted.
The examination did not reveal any vulnerabilities in the wallet's smart contracts or the source code of the frontend and services. The Safe {Wallet} team has taken additional measures to eliminate the attack vector, they added.
According to CZ, the presented findings did not answer a number of important questions:
Martin Koppelman, co-founder of the company behind Safe, Gnosis, provided CZ with some clarification.
In general, he repeated the points from the report regarding the attack vector and failed to explain the methods of deception of the signatories. According to Koppelman, the Bybit repository was indeed one of the largest and, apparently, the first to be attacked in this way – which is why the hackers tried to cover their tracks.
The entrepreneur also spoke about the measures being developed to strengthen transaction security.
Regarding the third question, CZ was answered by Ledger CTO Charles Guillemet. According to him, the hardware wallet provider offers a number of solutions to ensure transaction security, but integrating them into Safe is difficult due to technical features.
“For me, the most important takeaway from the Bybit hack is this: Companies and financial institutions need to use enterprise-grade storage solutions. Storing $1.46 billion in a free Safe{Wallet} smart contract with a group of signers designed for retail users should be a thing of the past,” the programmer said.
Previously, Blockstream co-founder and cypherpunk Adam Back concluded that the exchange hack was caused by a “flawed EVM design.”
Источник: cryptocurrency.tech
