Was Bybit itself hacked, or was it a third-party vulnerability?

Not exactly. Bybit’s core systems weren’t directly breached, but the attackers exploited Safe{Wallet}’s AWS S3 bucket, which Bybit used for transaction signing. This allowed them to manipulate multi-signature transactions and redirect funds without raising alarms.

How much of the stolen crypto has been recovered so far?

As of late February 2024, about $42.8 million has been frozen or recovered through exchange freezes, stablecoin blacklisting, and forensic tracking. While that’s only a fraction of the $1.4 billion stolen, the chase is still on, and more funds could be locked down soon.

How did the hackers launder the stolen funds?

They used a mix of cross-chain bridges, mixing services, and decentralized swaps to obfuscate their transactions. They also relied on centralized exchanges that don’t enforce strict KYC policies, making it harder for investigators to track the money trail.

What’s Bybit doing to prevent future attacks like this?

Bybit has tightened security, launched LazarusBounty.com to track stolen funds, and is working with blockchain forensics firms and exchanges to freeze illicit transactions in real time. They’ve also revamped their third-party security audits to prevent similar vulnerabilities.