How North Korean hackers executed history’s biggest $1.5 billion crypto heist - BBC World Service

Key Concepts:

• Cryptocurrency exchange hack
• Hot wallets and cold wallets
• North Korean cybercrime
• Crypto laundering
• Transaction signing and verification
• Lazarus Group
• Bounty programs
• Crypto tracing and analysis
• Privacy vs. Security in crypto

1. The ByBit Hack:

• Event: ByBit, a cryptocurrency exchange, experienced a hack resulting in the theft of approximately 401,000 Ethereum, valued at $1.5 billion.
• Significance: Described as potentially the largest hack in the history of the cryptocurrency industry and possibly the biggest single theft across any industry.
• Attribution: Early suspicions pointed towards North Korea due to their history of sophisticated cyber attacks.

2. North Korea's Cybercrime Activities:

• Motivation: North Korea is described as having a "successful industry for hacking" due to its closed economy and lack of other successful industries. They use the funds to support their missile programs.
• History: North Korea has been involved in cyber attacks for at least 15 years, including the Ronin bridge attack (over $600 million stolen in 2022) and the KuCoin attack ($275 million stolen in 2021).
• FBI Involvement: The FBI has accused North Korea of orchestrating cybercrime and has added names and photos of alleged North Korean hackers to a Cyber Most Wanted list.

3. How the Hack Was Executed:

• Target: The hackers targeted SafeWallet, a company used by ByBit to transfer coins from its cold wallets (offline, secure storage) to hot wallets (online, for transactions).
• Method: The hackers secretly changed the destination address of the Ethereum coins during a large transfer.
• Vulnerability: The user interface displayed the correct information to the signers, but at a low-level technical level, the transaction was different. This allowed the hackers to bypass verification.
• Sophistication: The attack required significant development, research, and resources, indicating a high level of sophistication.

4. ByBit's Response and Recovery:

• Customer Protection: ByBit confirmed the theft and assured customers that they would not lose money.
• Financial Measures: ByBit obtained loans to replenish the stolen Ethereum.
• Countermeasures: ByBit initiated a "war on the hackers" by offering bounties to anyone who could help track the stolen money.
• Bounty Program: A $4 million bounty program was established, with 20 volunteers receiving a share for their assistance.

5. Crypto Laundering and Tracing:

• Laundering Techniques: The hackers used sophisticated techniques to launder the stolen funds, including fanning them out across numerous transactions to confuse the money trail.
• Elliptic's Role: Crypto investigators at Elliptic have been tracking the stolen funds since the hack.
• North Korean Expertise: North Korea is considered highly skilled in crypto laundering, potentially using automated tools and dedicated teams.

6. Industry Rifts and eXch Controversy:

• eXch Accusation: ByBit called out eXch, another cryptocurrency exchange, for allegedly not helping to stop the flow of hacked funds.
• Funds Flow: Researchers claimed that $94 million of the hacked funds were funnelled through eXch.
• eXch's Defense: Johann Roberts, the owner of eXch, disputed the accusations, citing a long-running dispute with ByBit and uncertainty about the origin of the coins.
• Privacy Argument: Roberts argued that mainstream companies identifying crypto customers are abandoning the privacy and anonymity benefits of cryptocurrency.

7. Conclusion:

The ByBit hack represents a significant event in the cryptocurrency industry, highlighting the sophistication of cybercriminals, particularly those associated with North Korea. The incident underscores the importance of robust security measures, advanced transaction verification, and effective crypto tracing and laundering prevention. The controversy surrounding eXch also reveals a growing tension between security and privacy within the cryptocurrency community. The hackers have already made off with a significant amount of money, and the ongoing efforts to recover the remaining funds face considerable challenges.