Safe Wallet Resumes After Lazarus Group’s Sophisticated Crypto Heist

• Lazarus Group’s attack on Safe Wallet exposes the risks of developer-targeted exploits in high-value crypto transactions.
• Safe Wallet’s swift security overhaul highlights the need for stricter infrastructure protections in decentralized finance.
• Multisig wallets remain crucial but vulnerable—users must verify transactions carefully to avoid irreversible crypto losses.

Following a serious attack by the state-sponsored Lazarus Group in North Korea, Safe Wallet has started functioning again on the Ethereum mainnet. Through a hacked developer computer, the hackers gained access to Bybit’s Safe Wallet and were able to insert rogue transactions.

Although this hack revealed infrastructure weaknesses, it did not point to problems with Safe’s source code or smart contracts. Concerns over the security of multisignature (multisig) wallets, especially in high-value transactions, have been highlighted by the occurrence.

Lazarus Group’s Attack and Exploitation

To obtain unauthorized access, the hackers employed complex social engineering techniques, occasionally in conjunction with zero-day exploits. By inserting malicious code into a developer’s machine and changing transaction data, they especially targeted Safe Wallet. The attack unfolded when Bybit attempted a routine transfer from its Ethereum cold wallet to a warm wallet. The attackers manipulated the signing process, redirecting assets to an unknown address.

Forensic examination revealed that JavaScript files within Safe Wallet’s AWS S3 bucket were modified to conceal traces of the attack. The injected code was designed to activate only for specific contract addresses, including Bybit’s. Minutes after the fraudulent transaction, new versions of the JavaScript files were uploaded, removing any malicious code. This deliberate cover-up underscores the sophisticated nature of the exploit.

Security Measures and Industry Response

Following the breach, Safe Wallet conducted a thorough security overhaul. The team rebuilt and reconfigured its entire infrastructure while rotating all credentials. Additionally, it introduced stricter security protocols to prevent similar attacks. The Safe Wallet frontend remains operational but now includes enhanced security features. Users must exercise caution and verify all transaction details before signing.

The cryptocurrency community raised concerns over multisig wallet security, as Safe Wallet safeguards more than $100 billion in assets. Bybit CEO Ben Zhou inquired into Safe Wallet’s infrastructure vulnerabilities as demands for greater openness were made. Safe promised to lead a sector-wide initiative to improve transaction verifiability in an attempt to lessen security risks in decentralized finance.

Implications for Crypto Security

This attack highlights the importance of securing developer environments. Cryptocurrencies operate on a decentralized network, eliminating intermediaries like banks. However, users must remain vigilant since crypto payments are irreversible. Losing wallet credentials or signing malicious transactions can lead to significant financial losses.