# How the largest crypto exchange hack happened: What Ethereum security experts say about Lazarus' $1.5 billion Bybit attack | The Block - Host: [theblock.co](https://links.thingelstad.xyz/hosts/theblock.co/) - Saved: February 27, 2025 (2025-02-28T01:43:33Z) - Record: https://links.thingelstad.xyz/links/41454e3afe8f/ - JSON: https://links.thingelstad.xyz/links/41454e3afe8f.json ## What Jamie wrote This $1.5B theft from Bybit is the largest crypto attack ever, and notably it doesn't appear to be a compromise of Ethereum, Smart Contracts, or even the Wallets themselves but instead an attack at the interface between the multiple humans that controlled the multi-signature wallet and the transaction. > "This was most probable an infected machine(s) where the attacker was able to intercept and show a fake Safe page so they sign something different from what it was shown," Odysseus, the pseudonymous founder of [Ethereum security protocol Phylax](https://www.theblock.co/post/322763/phylax-systems-aims-to-reshape-blockchain-security-with-credible-layer-solution), said in a direct message. "They then leveraged the fact that hardware wallets don't show the signed action but just the signature hash." > > Said simply, Lazarus -- in one way or another, either through phishing, infection via malware or a faulty Chrome plugin -- was able to put a screen in front of the multi-sig holders that made it seem like they were interacting with a familiar platform that was actually a backdoor to drain their funds. It is still too soon for full forensics to be done on this crime but it is now verified to be a state-sponsored North Korean entity. On X there was some rumblings that Ethereum may try to roll this back and fork Ethereum, which would have been a monumental thing. I could find no credible reporting on that even being considered and instead found nearly unanimous statements in Ethereum community that that would not be done. I keep having a thought regarding crypto theft like this — **some of the security we experience with money is a result of inefficiency and bureaucracy**. Sure banks have security programs and those do a lot, but there is also just the fact that it is slow to send money from one place to another with fiat. And that slowness allows time for things to be caught. If you can send any amount of funds instantly there is no time. And that bureaucracy that many like to rail against? That also requires a bunch of signatures and other blocks that can deter theft. Operational security of crypto assets, beyond the tech itself, may need to show up as **adding inefficiency and bureaucracy** to the system. ## Facts - Kind: [Page](https://links.thingelstad.xyz/kinds/page/) ## Appears in - [WT311: Weekly Thing 311 / WikiTok, Bookmarklets, Tapestry](https://weekly.thingelstad.com/archive/311/), Notable ## Same host - [The Block: CFTC and SEC chairs may disagree over whether ether is a security](https://links.thingelstad.xyz/links/ec819c250599/) (theblock.co, October 26, 2022) ## Saved the same week - [Introduction to CUDA Programming for Python Developers | PySpur - AI Agent Builder](https://links.thingelstad.xyz/links/85ab0f4a9f0e/) (pyspur.dev, February 27, 2025) - [Removing Jeff Bezos From My Bed — Truffle Security Co.](https://links.thingelstad.xyz/links/dc852167e9b0/) (trufflesecurity.com, February 27, 2025) - [Software engineering job openings hit five-year low? - The Pragmatic Engineer](https://links.thingelstad.xyz/links/1c8c833ac87f/) (blog.pragmaticengineer.com, February 27, 2025) - [Trump 2.0 Brings Cuts to Cyber, Consumer Protections – Krebs on Security](https://links.thingelstad.xyz/links/d408529bc145/) (krebsonsecurity.com, February 27, 2025) - [It is no longer safe to move our governments and societies to US clouds - Bert Hubert's writings](https://links.thingelstad.xyz/links/cc44c6ae7845/) (berthub.eu, February 27, 2025) ## Elsewhere - Wayback Machine: https://web.archive.org/web/*/https://www.theblock.co/post/342791/largest-crypto-exchange-hack-what-ethereum-security-experts-know-lazarus-bybit