797 reports
The excerpt attributes a malicious LNK file themed around virtual asset service provider anti-money-laundering supervision to the North Korea-linked Konni group. The file, identified by SHA-256 4a6c23e76524364fe9b9f5ecd46dc73e7714cac93849a380f0d1b746fae36…
The Bybit cold Ethereum wallet theft involved a masked Safe{Wallet} transaction that obtained three valid signer approvals while sending malicious transaction data to Ledger devices. The attacker used a delegatecall to modify the Safe masterCopy storage s…
SlowMist assessed a state-level APT campaign targeting cryptocurrency exchanges and attributed it to Lazarus Group after forensic analysis and correlation over recent incidents. The attackers used social engineering to persuade employees to run disguised …
The podcast episode includes discussion of a reported $1.4 billion Lazarus Group theft from cryptocurrency exchange Bybit. The excerpt identifies the Bybit incident as North Korea’s largest-ever crypto heist and places it among other cyber-espionage and p…
The article describes Lazarus-linked Operation 99 activity against developers and Web3 organizations in Europe, using trusted platforms and Windows utilities to avoid early detection. The reported chain begins with trojanized GitHub software, then abuses …
Elliptic attributes the February 2025 theft of about $1.46 billion from Bybit to North Korea's Lazarus Group, citing laundering behavior and links to the group's crypto theft history. The attackers quickly swapped freezeable tokens such as stETH and cmETH…
Check Point analyzed the February 2025 Bybit theft in which attackers compromised an offline Ethereum wallet and stole roughly $1.5 billion in digital assets. The attack abused signer trust rather than a smart contract flaw: multisig participants were sho…
SlowMist attributes a June 2024 intrusion set against cryptocurrency exchanges to Lazarus Group after forensic work across multiple incidents. The attackers used social engineering against developers, including fake project-team and investment personas, t…
Attackers drained approximately $1.5 billion from Bybit after a signed Safe multisig transaction used `delegatecall` to overwrite the wallet proxy's `masterCopy` storage slot. The change redirected the proxy from the legitimate Gnosis Safe implementation …
Arkham reports that Bybit's ETH cold wallet lost roughly $1.5 billion in ETH, stETH, mETH, and cmETH after a fraudulent transaction was signed during a scheduled cold-wallet migration. The attacker moved 401K ETH, 90.4K stETH, 8,000 mETH, and 15,000 cmETH…
A recorded DistrictCon session by Nick Roy and Martyn Williams describes a misconfigured North Korean server that exposed data on overseas animators and IT workers. The server reportedly held logs, documentation, and animation files for outsourced project…
A DistrictCon talk abstract describes a misconfigured North Korean server that exposed logs, documentation, and animation files tied to overseas animators and IT workers. The material reportedly included outsourced animation project data, factory video to…
SlowMist analyzed the February 2025 Bybit theft, where attackers stole more than $1.46 billion in ETH and liquid staking assets from a cold wallet workflow. The report cites ZachXBT attribution to Lazarus Group and links the incident to North Korea-linked…
Rekt describes the Bybit theft as a compromise of the exchange’s Ethereum cold-wallet signing process that drained roughly 401,346 ETH, 90,375 stETH, 15,000 cmETH, and 8,000 mETH. The attackers presented signers with a legitimate-looking Safe interface wh…
The Bybit attack used a trojan contract and a backdoor contract to turn a signed transaction into a malicious upgrade of an upgradeable Safe multisig cold wallet. Signers were tricked into authorizing a zero-token ERC-20 transfer to an unlisted contract, …