In case anyone is interested, Bybit Hack Forensics Report:

https://docsend.com/view/s/rmdi832mpt8u93s7

TL;DR:

- Hackers injected malicious code into app.safe.global on Feb 19, 2025, targeting Bybit’s Ethereum Multisig Cold Wallet.

- The attack was triggered automatically during Bybit’s next transaction on Feb 21, 2025.

- Investigation suggests Safe.Global’s AWS or CloudFront credentials were compromised, allowing attackers to modify the JavaScript file.

- The malicious code was found in the Wayback Machine archive, confirming its legitimacy.

- Further investigation is needed to determine the full impact and root cause.

Bottom line: A supply chain attack was used to compromise a key security tool, leading to a targeted wallet exploit.

this is why crypto frontends need to host on @earthfast

Decentralize your frontend, securely.
https://earthfast.com/

editor https://lowercase.cards/ prev: everyname (acq. Q4 '23)

Reconciling all versions of me | Experimenting with social here

More detail from @sidsethi here https://x.com/sidsethi/status/1894845931268583635

https://lowercase.cards/92359e63-c925-4d09-bd54-05c46c381636