Safe Wallet Reports $1.4B Bybit Hack Linked to North Korea
A North Korean-linked group hacked Bybit, stealing $1.4B by bypassing MFA and hijacking AWS session tokens.
- The attack on Bybit resulted in a $1.4 billion loss.
- The TraderTraitor group bypassed MFA using a hijacked AWS session token.
- The breach occurred through a compromised developer’s notebook.
The crypto exchange Bybit has suffered a massive security breach, losing more than $1.4 billion in an attack linked to the North Korean hacking group TraderTraitor (UNC4899). According to a post by Safe{Wallet}, the attackers managed to bypass multi-factor authentication (MFA) and gain access by hijacking an AWS session token.
How the Attack Happened
The attackers infiltrated Bybit’s systems by first compromising a developer’s notebook. By exploiting security vulnerabilities, they managed to gain unauthorized access and steal an AWS session token. This token allowed them to bypass MFA and infiltrate sensitive systems, leading to the theft of a staggering $1.4 billion in crypto assets.
This method of attack highlights the increasing sophistication of cybercriminals, especially those affiliated with state-backed groups like TraderTraitor. By leveraging social engineering tactics and exploiting security weaknesses in developer environments, they can breach even well-protected platforms.
Safe{Wallet} published a post that the hacker attack on Bybit worth more than $1.4 billion was launched by the North Korean-linked group TraderTraitor (UNC4899). The attackers bypassed multi-factor authentication by hacking into the developer's notebook and hijacking the AWS…
— Wu Blockchain (@WuBlockchain) March 6, 2025
Implications for Crypto Security
The Bybit hack is one of the largest crypto exchange breaches in history and serves as a stark reminder of the vulnerabilities that exist in centralized platforms. Security experts emphasize the importance of strengthening authentication mechanisms, conducting frequent security audits, and ensuring that developers follow best practices to prevent similar incidents in the future.
Bybit has yet to release a full statement on the breach, but industry insiders are urging exchanges to adopt more stringent security measures to safeguard user funds.
