Investigation Updates and Community Call to Action
Contents
Investigation Updates and Community Call to Action
62K
Safe{Wallet}’s forensic investigation is being conducted in collaboration with Mandiant, a leading cybersecurity firm that is now part of Google Cloud. This investigation has reached a critical checkpoint, allowing us to share an update on the progress and insights gathered so far from the security incident that occurred on February 21, 2025. Evidence suggests that this was a highly sophisticated, state-sponsored attack. We present these findings in the spirit of transparency and to highlight key lessons learned, along with calls to action for the broader community to learn from this incident and strengthen defenses. We wish to stress that despite hundreds of hours of analysis already conducted, there is more work to be done. Certain gaps in fully recovering certain aspects of the attack remain because the attacker removed their malware and cleared Bash history in an effort to thwart investigative efforts. While the …
62K
Safe{Wallet}’s forensic investigation is being conducted in collaboration with Mandiant, a leading cybersecurity firm that is now part of Google Cloud. This investigation has reached a critical checkpoint, allowing us to share an update on the progress and insights gathered so far from the security incident that occurred on February 21, 2025. Evidence suggests that this was a highly sophisticated, state-sponsored attack. We present these findings in the spirit of transparency and to highlight key lessons learned, along with calls to action for the broader community to learn from this incident and strengthen defenses. We wish to stress that despite hundreds of hours of analysis already conducted, there is more work to be done. Certain gaps in fully recovering certain aspects of the attack remain because the attacker removed their malware and cleared Bash history in an effort to thwart investigative efforts. While the …