© 2024 AnChain.AI. All Rights Reserved | Privacy Policy
Victor Fang, Philip Werlau - AnChain.AI
Key Takeaways:
Days ago, the world was shocked by the $1.5 Billion Bybit hack. Subsequently, the AnChain.AI team has been hard at work with our partners in both the public and private sectors to debrief the situation, and take preventative action.
As we continue to closely monitor the incident and subsequent money flows, the underlying factors behind this attack have become clear:
1. Bybit press confirmed its Safe{Wallet} Javascript front end compromise.
2. FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
https://www.ic3.gov/PSA/2025/PSA250226
The AnChain.AI started by taking a detailed look at the Web3 attack surface, developing the following timeline pictured below.
Subsequently, the AnChain.AI investigation team honed in on the period following the Bybit 400K ETH transfer. Here is the attack vector analysis and timeline, with highlights of the attack surface.
Pre-Exploit - (Attack surface: Blockchain)
Tuesday, February 18, 2025: The attacker deployed a malicious smart contract bytecode on Ethereum mainnet, in preparation for the exploit.
Exploit:
Friday, February 21, 2025: The attacker successfully executed a phishing attack against Bybit’s cold wallet multisig signers (including Bybit CEO). This deception led them to unknowingly approve a transaction that replaced the Safe{Wallet} Gnosis smart contract wallet implementation with the attacker’s malicious smart contract.
The exploit, based on AnChain.AI, mainly comes in two angles:
1. JavaScript-Based Attack (Cloud Compromise)
DeFi investigation such as Safe{Wallet} smart contracts presents a challenge entirely distinct from tracing bitcoin UTXO or stablecoin tokens.
In order to address the unique obstacles presented in the course of DeFi forensics, our investigators utilize the SCREEN engine, a tool developed by AnChain.AI designed to empower frontline investigators, having played pivotal roles in Tornado Cash, Crema Finance, and other high-profile cases.
To set the stage, these are the key wallet addresses and smart contract exploit transactions that AnChain.AI identified.
Exploiter Wallet: 0x0fa09C3A328792253f8dee7116848723b72a6d2e
Exploit Contract: 0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516
Exploit Contract Creation: 0xc47ac9038127cef763a1c9a33309a645c5a4fa9df1b4858634ae596ccc2aee5e
Bybit Cold Wallet: 0x1Db92e2EeBC8E0c075a02BeA49a2935BcD2dFCF4
Cold Wallet Exploit Transaction: 0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882
Exploit Input Data in Gnosis Safe Data Payload:
The attacker altered this data field, in the Safe{Wallet} Gnosis Data Payload:
0xa9059cbb000000000000000000000000bdd077f651ebe7f7b3ce16fe5f2b025be296951600000000000...
The AnChain.AI team was able to decode this into 2 pieces:
This can be clearly visualized below utilizing the SCREEN platform, in which we can directly highlight the manner in which the internal transaction was able to transfer 401K ETH to the hacker.
Figure: the Bybit multisig exploit transaction that sent 401K ETH to the hacker.
This examination within the SCREEN platform also revealed additional exploit transactions worthy of note, as listed below.
90 USDT ($90)
401,346.768858404671846374 ETH ($1,066,920,182.99 @ $2,658.35)
8,000 mETH ($22,380,480.00 @ $2,797.56)
90,375.547907685258392043 stETH ($239,938,042.14 @ $2,654.90)
15,000 cmETH ($42,038,400.00 @ $2,802.56)
Total: $1,371,277,195.13 (All dollar values calculated using asset day close price)
However, not all smart contracts deployed on Ethereum blockchain contain Solidity source code. Ordinarily this presents an immediate roadblock, but by utilizing the SCREEN platform, we are able to circumvent this obstacle by taking advantage of a smart contract’s deployed bytecode.
The Exploit Contract: 0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516 doesn’t contain Solidity source code, which makes it nearly impossible for DeFi investigators to understand the malicious business logics that may or may not be contained within
However, using AI and machine learning, especially GPT embedding models, SCREEN can decode the bytecode, uncovering key logics:
These are confirmed in further transaction analysis.
Figure: We reverse engineered the Bybit exploit bytecode, leading to 4 smart contract functions, and 50 other similar smart contracts, based on embedding.
This leads to a natural question, one which arose frequently in discussion with our customers and law enforcement partners: “Is Safe{Wallet} smart contract delegate call, a bug or feature?”
Based on our in-depth analysis at AnChain.AI, we conclude that this functionality is a legitimate design choice within the Gnosis Safe smart contract architecture. The delegate call mechanism allows the contract to execute logic from an external smart contract while maintaining the context of the original contract. This is a commonly used feature in upgradable and modular smart contract systems, enabling flexibility and extensibility.
However, in this case, the attacker exploited this feature to replace the contract’s implementation with a malicious version, as AnChain.AI SCREEN reveals, effectively hijacking control over Bybit’s cold wallet. This underscores the inherent risks of delegate calls, particularly when proper security measures, such as strict access controls and validation mechanisms, are not in place.
Gnosis Safe Contract
https://github.com/destenson/gnosis--gnosis-safe-contracts/blob/master/contracts/GnosisSafe.sol
The function is operating as intended, but the failure of other security measures have exposed it to exploitation at an unprecedented level.
Recommendations :
The billion-dollar Bybit hack is a stark reminder that what we've witnessed in DeFi hacks is just the tip of the iceberg. As the severity and sophistication of these attacks escalate, it's crucial to critically reassess and enhance our investigative toolsets. AnChain.AI’s SCREEN engine is designed from the ground up to tackle these DeFi threats, and has already spearheaded groundbreaking investigations in both the public and private sectors.
For any VASPs or financial institutions with DeFi exposure such as Safe{Wallet}, we recommend a thorough Web3 security pentest and vulnerability assessment. Contact our experts today to get started.
Looking to equip your business with the tools and skills to protect against DeFi threats? Schedule a live training session with AnChain.AI, trusted by the world’s leading regulators.
© 2024 AnChain.AI. All Rights Reserved | Privacy Policy
.png)