IN-DEPTH TECHNICAL ANALYSIS OF THE BYBIT HACK

Summary from the TLDR InfoSec newsletter

Bybit experienced the largest cryptocurrency theft ever, totaling $1.4 billion, when attackers compromised a developer machine and injected malicious JavaScript into Safe{Wallet} UI, altering what signers saw. This off-chain attack tricked signers into approving a delegatecall that replaced the proxy implementation with the attackers' code, giving them control over all funds. The Lazarus group from North Korea executed this sophisticated attack by exploiting human verification vulnerabilities and the lack of human-readable formats for complex smart contract operations in the EIP-712 standard.