作者：23pds & Thinking 编辑：Liz
背景
2 月 26 日晚间， Bybit 与 Safe 同时发布关于之前 Bybit 价值近 15 亿美金的加密货币被盗事件的安全调查公告。
Safe 方面表示：
Lazarus Group 对 Bybit 发起的针对性攻击的取证分析表明，攻击者通过入侵 Safe{Wallet} 开发人员机器，从而提交了一笔伪装的恶意交易提案，并诱导 Bybit 的 Safe 钱包 Owner 签署恶意交易，实现对 Bybit Safe 钱包的攻击。
外部安全研究人员的取证分析未发现 Safe 智能合约、前端或相关服务的源代码存在任何漏洞。事件发生后，Safe{Wallet} 团队进行了彻查，并分阶段恢复了以太坊主网上的 Safe{Wallet}。Safe{Wallet} 团队已完全重建、重新配置了所有基础设施，并轮换了所有凭证，确保完全消除了攻击媒介。待调查最终结果出炉后，Safe{Wallet} 团队将发布完整的事后分析。
Safe{Wallet} 前端仍在运行，并采取了额外的安全措施。但是，用户在签署交易时需要格外小心并保持警惕。
Bybit 方面表示：
攻击时间：恶意代码于 2025 年 2 月 19 日被注入到 Safe{Wallet} 的 AWS S3 存储桶中，并在 2025 年 2 月 21 日 Bybit 执行 multisig 交易时触发，导致资金被盗。
攻击方法：攻击者通过篡改 Safe{Wallet} 的前端 JavaScript 文件，注入恶意代码，修改 Bybit 的 multisig 交易，将资金重定向到攻击者地址。
攻击目标：恶意代码专门针对 Bybit 的 multisig 冷钱包地址及一个测试地址，仅在特定条件下激活。
攻击后操作：恶意交易执行后约两分钟，攻击者从 AWS S3 存储桶中移除恶意代码，以掩盖痕迹。
调查结论：攻击源自 Safe{Wallet} 的 AWS 基础设施（可能是 S3 CloudFront 账户/API Key 泄露或被入侵），Bybit 自身基础设施未被攻击。
美国联邦调查局(FBI) 发布公告，确认朝鲜黑客组织“TraderTraitor”（亦称 Lazarus Group）是 2 月 21 日针对 Bybit 交易所发起的黑客攻击的幕后黑手，此次攻击导致价值 15 亿美元的加密资产被盗。
回顾分析
慢雾作为外部第三方安全机构，虽然没有直接介入分析，但是我们也持续关注事情的进展。
2 月 26 日上午，慢雾安全团队内部对攻击进行复盘时，慢雾 CISO 23pds 发现自 2 月 21 日攻击发生后，Safe 开始各种修改前端等代码，于是 23pds 在 X 发布部分分析，并立即通知慢雾安全团队负责人 Thinking 关注：
https://app.safe.global/_next/static/chunks/pages/_app-52c9031bfa03da47.js
这个 JavaScript 代码的历史变更：
我们首先使用 urlscan 抓取 app.safe.global 近几个月来的变化，发现唯独 “_app-52c9031bfa03da47.js” 这个文件发生了变更：
于是，我们通过 archive 分析这个文件的变更：
https://web.archive.org/web/20250219172905js_/https://app.safe.global/_next/static/chunks/pages/_app-52c9031bfa03da47.js
如图所示：
匹配到本次被黑事件攻击者使用的恶意实现合约地址：0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516。
涉及的 “_app-52c9031bfa03da47.js” JavaScript 代码分析如下：
(图片来源：ScamSniffer)
整体攻击流程图
巧合的是，我们在分析的过程中，Safe 和 Bybit 昨晚刚好发布了调查报告，最终事情有了定论，这无疑是件好事。至此，可以确认此次 Bybit 价值近 15 亿美元的加密货币被盗事件是攻击者精心策划的针对性攻击。此次事件揭示了黑客对开发环境和供应链的精准打击能力，并凸显了前端代码控制权的重要性。攻击者先获取到 app.safe.global 的前端代码的控制权，然后针对 Bybit 的 Safe{Wallet} 钱包进行精准攻击。在 Bybit 的多签 Owner 使用 app.safe.global 进行签名的时，让 Safe{Wallet} 的界面展示正常地址，实则在发起交易的时已将交易内容替换成恶意的待签名数据，从而欺骗 Owner 签署了经过修改后的恶意待签名数据。最终，攻击者成功接管了 Bybit 的多签钱包的合约控制权，并实施盗币。
Meta has reduced the prices of its ad-free subscriptions for Facebook and Instagram in the EU by up to 40%, following regulatory pressure. It has also introduced a new "less personalised" ad option for users who prefer to access the platforms for free.
AnaisPresident-elect Donald Trump announced Tuesday that Tesla CEO Elon Musk and Strive co-founder Vivek Ramaswamy will lead the newly created D.O.G.E, focused on reducing bureaucracy, cutting costs, and streamlining government operations.
KikyoBinance Founder CZ playfully mocks “Bitcoin is Dead” critics as Bitcoin hits a new all-time high, underscoring the cryptocurrency’s resilience and defying those who doubted its longevity.
CatherineA massive cryptocurrency scam in South Korea led to the arrest of 215 people, including a YouTuber who used his platform to promote fake investment schemes. The scam, which targeted over 15,000 investors, defrauded them of around $230 million by selling worthless crypto assets and making false promises of high returns.
JoyA phishing attack on a cryptocurrency investor led to the theft of 95.3 million GIGA tokens, worth over $6 million, through a fake Zoom link. The hacker quickly sold the stolen tokens, converted them into Solana and stablecoins, and moved the funds to obscure wallets, while the investor is now working with law enforcement to recover the assets.
WeatherlyThe FBI has reportedly seized Polymarket CEO Shayne Coplan’s devices, possibly tied to the platform’s prediction of Trump’s election victory. While no charges have been filed, sources suggest market manipulation is under investigation. Meanwhile, France’s gambling regulator may block Polymarket’s operations. Is this the beginning of the end for the decentralised betting platform?
CatherineAmidst his election victory and staff appointments, President-elect Trump is capitalising on the Dogecoin trend by selling DOGE merchandise. This move highlights his continued business instincts, even in politics, as Dogecoin enjoys a steady rally.
KikyoCoinbase Wallet’s upcoming “tap-to-pay” feature aims to rival quick-pay apps like Venmo and Cash App, with a goal to reach 50 countries by 2025. Additionally, Coinbase’s Base network is working to solve Ethereum layer 2 interoperability, which could allow seamless transfers across multiple chains within six months.
WeatherlyThe Free Republic of Liberland has launched its space programme, aiming to lead in technological innovation and global collaboration through an open platform for nations and private entities, free from bureaucratic constraints.
CatherineRevolut X is expanding across 30 European markets, offering advanced crypto trading tools and enhanced security. The platform caters to serious traders with access to over 200 cryptocurrencies and low fees, while Revolut also develops a stablecoin for faster cross-border payments.
Anais