Table of contents
- The attack: social engineering and covering tracks
- TraderTraitor: the link to APT38 and Lazarus
- Safe{Wallet}’s countermeasures: strengthening security
- The FBI’s role and the hunt for hackers
- What can we learn from this attack?
The largest cryptocurrency theft in history began with a trojan installed on a MacBook belonging to a Safe{Wallet} developer. The hackers, part of the North Korean group TraderTraitor, exploited a vulnerability on the device, gaining access to AWS session tokens.
These tokens allowed them to bypass multi-factor authentication and infiltrate ByBit‘s infrastructure. The developer, who had high-level privileges, was responsible for managing the exchange’s code, making his device a particularly attractive target.
The attack: social engineering and covering tracks
The infection occurred on February 4, 2025, when the MacBook connected to the website getstockprice.com via a project running on Docker.
Although the project was no longer present at the time of analysis, file traces in the ~/Downloads/ directory suggest the use of social engineering techniques. The hackers also used ExpressVPN to access the developer’s AWS account, synchronizing their activities with his work schedule to avoid raising suspicions.
After completing the attack, the criminals removed the malware and deleted the Bash history to cover their tracks.
TraderTraitor: the link to APT38 and Lazarus
The TraderTraitor group is closely linked to other North Korean hacking groups, including APT38 (also known as BlueNoroff or Stardust Chollima), part of the broader Lazarus collective.
These groups are known for their sophistication and for conducting some of the largest cryptocurrency heists in the world. The attack on ByBit confirms their ability to exploit both technical and human vulnerabilities to achieve high-profile targets.
Safe{Wallet}’s countermeasures: strengthening security
Despite the complexity of the attack, Safe{Wallet}‘s smart contracts remained untouched.
However, the company has taken several measures to enhance security, including a complete infrastructure reboot with credential rotation, closing external access to services, and implementing advanced systems for detecting malicious transactions.
Additionally, Safe{Wallet} has temporarily disabled native support for hardware wallets, as they relied on the vulnerable eth_sign function.
The FBI’s role and the hunt for hackers
The FBI has issued a public warning confirming that North Korea is responsible for the theft of $1.5 billion in virtual assets from ByBit. The hackers have already converted some of the stolen funds into Bitcoin and other cryptocurrencies, distributing them across thousands of addresses on various blockchains.
The FBI urges industry players, including exchanges, DeFi services, and blockchain analytics firms, to block transactions from addresses associated with TraderTraitor.
What can we learn from this attack?
This incident highlights the importance of advanced security tools and greater user awareness.
Experts emphasize that cryptocurrency transaction security must be simplified to reduce risks. Safe{Wallet} is working to integrate the IPFS platform, which will provide an additional layer of protection.
