https://pwn.watch/t/safe-wallet Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 06 Mar 2025 00:00:00 GMT https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025 https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025 Thu, 06 Mar 2025 00:00:00 GMT critical <p>North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-03-06: Safe{Wallet} confirms a developer machine compromise by TraderTraitor (<a href="https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html">source</a>)</li><li>2025-02-26: FBI attributes the theft to North Korea ('TraderTraitor') (<a href="https://www.ic3.gov/psa/2025/psa250226">source</a>)</li><li>2025-02-21: About $1.5B in ETH drained from a Bybit cold wallet</li></ul>