<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
  <title>Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea) · updates</title>
  <link>https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025</link>
  <description>North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.</description>
  <language>en</language>
  <lastBuildDate>Thu, 06 Mar 2025 00:00:00 GMT</lastBuildDate>
  <atom:link href="https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025/feed.xml" rel="self" type="application/rss+xml" />
  <item>
    <title>Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea): Safe{Wallet} confirms a developer machine compromise by TraderTraitor</title>
    <link>https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025</link>
    <guid isPermaLink="false">https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025#2025-03-06-99cf34de</guid>
    <pubDate>Thu, 06 Mar 2025 00:00:00 GMT</pubDate>
    <category>critical</category>
    <description>&lt;p&gt;&lt;a href=&quot;https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;</description>
  </item>
  <item>
    <title>Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea): FBI attributes the theft to North Korea ('TraderTraitor')</title>
    <link>https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025</link>
    <guid isPermaLink="false">https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025#2025-02-26-4b53033c</guid>
    <pubDate>Wed, 26 Feb 2025 00:00:00 GMT</pubDate>
    <category>critical</category>
    <description>&lt;p&gt;&lt;a href=&quot;https://www.ic3.gov/psa/2025/psa250226&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;</description>
  </item>
  <item>
    <title>Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea): About $1.5B in ETH drained from a Bybit cold wallet</title>
    <link>https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025</link>
    <guid isPermaLink="false">https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025#2025-02-21-31e7330d</guid>
    <pubDate>Fri, 21 Feb 2025 00:00:00 GMT</pubDate>
    <category>critical</category>
    <description>&lt;p&gt;Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea): About $1.5B in ETH drained from a Bybit cold wallet&lt;/p&gt;</description>
  </item>
</channel>
</rss>
