North Korea's Lazarus steals about $1.5B from Bybit via a compromised Safe{Wallet} developer machine

Safe/Safe Smart Account

Attackers broke into a Safe{Wallet} developer's computer and planted code in the Safe web app that only activated for Bybit's signers. They were shown a disguised transaction, signed it, and handed control of Bybit's cold wallet to the thieves. It was the largest crypto theft on record; Safe's contracts themselves were not flawed.

• Over 400,000 ETH and stETH taken, about $1.5 billion.
• The malicious JavaScript was added two days before the attack and removed minutes after it.
• Safe rebuilt its infrastructure, rotated credentials and added extra transaction checks before restoring service.