A dev machine of Safe was compromised. This allowed access to AWS and their S3 bucket. A malicious JavaScript was pushed to the bucket and eventually distributed. The malicious JS code targeted specifically the Bybit contract address. The JS code changes the content of the transaction during the signing process.

#security #investigation

Statement by FBI: https://x.com/officer_cia/status/1895005396214968534?s=46

#security #investigation

#investigation #security #opsec

The Bybit hacker has moved 270,000 ETH worth around $605M via THORChain and still holds 229,395 ETH worth around $514M: https://x.com/officer_cia/status/1895407702614094208?s=46

#security #investigation

Telegram 's latest beta for Android introduces detailed user info! 🕵️‍♂️

You can now see:
📍 Country of phone number origin
📅 Account registration date (month/year)
👥 Number of shared groups
✔️ Whether the account is official

• https://x.com/officer_cia/status/1895442145370087681

#privacy #security #opsec

> One image cannot shake the unwavering resolve of a Web3 security researcher!

> Yet, behold this picture:

• https://x.com/officer_cia/status/1896040825479708766?1

#security #opsec

The hacker has laundered all the 499,000 ETH ($1.39 billion) stolen from Bybit, and the whole process took 10 days. THORChain, the main channel used by the hacker to launder money, received $5.9 billion in transaction volume and $5.5 million in handling fees.

My personal advice to the Thorchain team is to contact my attorney @rata0x before it's too late. I think we can help you with a legal audit.

• https://x.com/officer_cia/status/1896749395577581970?3

#security #investigation

Bybit attack flowchart: https://x.com/officer_cia/status/1898048649223192727?s=46

#security #investigation

Rumours: Entangle hacked, hacker minted 13b tokens. Some bridge issue potentially.

Can anyone confirm?

• https://x.com/officer_cia/status/1898531364711915747

#security #alert

According to Decurity’s postmortem report, after negotiations with the hacker, most of the $5 million stolen from 1inch has been returned, with the hacker keeping a portion as a bug bounty.

The attack was caused by a vulnerability in the Fusion v1 smart contract, primarily affecting those using outdated versions of the resolver. Regular users’ funds were not impacted: https://x.com/officer_cia/status/1898544905254777025

#investigation #security

30 minutes ago, a victim lost $1.82M worth of cUSDCv3 due to phishing transaction signatures…

• https://x.com/officer_cia/status/1899730170338009127?12

#security #opsec

Lazarus Group deposits 400 ETH (~$750K) into Tornado Cash, linked to February’s $1.4B Bybit hack, while deploying new “BeaverTail” malware targeting browsers and crypto wallets: https://x.com/officer_cia/status/1900126714086183378?1

#security #investigation

Trezor Reveals Potential Vulnerability in Older Safe 3 Crypto Wallets !

Trezor disclosed a potential vulnerability in its Safe 3 wallet after Ledger identified a supply chain attack using voltage glitching.

The attack requires physical access and advanced skills, making it unlikely for widespread exploitation. Newer Trezor models, including Safe 5, are unaffected. Users are advised to buy from official sources, use strong PINs, enable passphrases, and keep firmware updated.

• https://www.theblock.co/post/346018/trezor-discloses-vulnerability-safe-3-crypto-wallet-rival-ledger

#opsec #security

Yet another awesome OpSec rule:

Don't let perfect be the enemy of good.

100% solutions are rare in cybersecurity. Security solutions, each with their own shortcomings, are OK when layered together to supplement coverage.

Quoting Kerckhoff's principle, "A cryptosystem should remain secure even if everything about the system, except the key, is public."

If revealing a system substantially increases its risk of being broken, then perhaps it needs to be rethought.

• https://github.com/OffcierCia/Crypto-OpSec-SelfGuard-RoadMap

#opsec #privacy #security

New Malware Alert — Microsoft warns of StilachiRAT, a stealthy remote access trojan that:

• Steals browser passwords & clipboard data;
• Targets crypto wallets;
• Executes remote commands & monitors RDP sessions;
• Evades detection by clearing event logs.

• https://x.com/officer_cia/status/1902036244479230132?s=46

#security #opsec