The Web3 world is a dark forest, where we are both hunters and prey. Every step must be taken with caution, only then can we live longer and go further.
Author: Yue Xiaoyu
Cover: Photo by Markus Spiske on Unsplash
Introduction:
The Web3 industry is developing too fast, with new things appearing every day. Therefore, many daily thoughts are worth recording.
These thoughts will be updated in real-time on my Twitter account and published regularly on the WeChat public account.
Welcome to follow my Twitter account: Yue Xiaoyu (ID: @yuexiaoyu111).
1. First, explain in plain language how Bybit was hacked:
Bybit used a Safe multi-signature wallet, with a 3/3 signature setting, meaning that three people needed to sign to complete a transaction, and each signer used a hardware cold wallet.
The Safe multi-signature smart contract has been verified over many years and is not problematic in itself, and with the signers using hardware cold wallets, where the private keys are physically isolated and not connected to the internet, this can be said to be the most secure wallet method currently.
But why was it still stolen?
The hackers used a social engineering attack.
Technically, there was no way to directly breach the system, so they directly attacked the "people".
The hackers first infiltrated the computers of the three signers, and then secretly replaced the signing content while they were performing their daily operations (such as transfer signing).
The signers thought they were signing a normal transaction on the web page, but the hackers had actually replaced the content with a "malicious signature", such as upgrading the Safe contract to a malicious contract they had prepared earlier.
The three signers unknowingly signed, and the hackers used this malicious contract to withdraw all the funds.
2. What is a social engineering attack?
A social engineering attack is an attack method that has a very high cost, very complex means, but also very effective.
In this attack incident, the exchange had already used the highest security measures, multi-signature smart contracts, plus hardware wallets, and strict offline company organization, but it was still unable to prevent this social engineering attack.
The hackers directly targeted the multi-signature signers, and infiltrating the signers' computers was an easier breakthrough point.
How did they infiltrate the employees' computers?
The specific methods include sending phishing emails, implanting malware, or exploiting the personal security habits of the signers (such as using weak passwords, not enabling two-factor authentication).
Once the computer is hacked, the hackers can control the employee's device and tamper with any information.
Social engineering attacks have very strong concealment, and the signers may think they have completed their daily work, and the system logs also record "contract upgrades" as a legitimate operation, rather than obvious "fund transfers".
By the time the funds were withdrawn, Bybit only realized it, but it was too late.
Of course, social engineering attacks are not impossible to prevent, and require a rigorous set of measures, and long-term protection.
The best approach is to strictly control the relevant devices of the company's internal personnel and the behavior anomalies of the personnel themselves, such as dedicated device isolation, device whitelisting and monitoring, regular inspections and updates, etc.
3. What will happen after Bybit is hacked?
First, see if Bybit has the ability to withstand the recent user withdrawal rush, if Bybit can't withstand it, it will be another FTX, and may even drag the entire industry into a new bear market;
Second, see if Bybit has the ability to compensate for the stolen funds, if it doesn't have the ability to compensate, it will directly declare bankruptcy, which may also drag the industry into a bear market.
So what is Bybit's current financial situation?
Bybit is the second largest cryptocurrency exchange in the world, with a daily trading volume of up to $36 billion and over 60 million users. With such a large scale, its profitability must be strong.
The industry generally estimates that for top exchanges like Bybit, they mainly make money through transaction fees, leverage trading interest, wealth management product revenue sharing, etc., with an estimated annual net profit of $1.5 to $5 billion.
Looking at Bybit's asset size, it is said that its total reserve assets exceeded $16 billion before the theft.
Comparing this, a $1.5 billion shortfall accounts for less than 10% of the total assets, which is not a fatal blow.
And Bybit's CEO Ben Zhou has publicly stated that customer assets are 1:1 backed, which means that user funds are protected, and the funding gap caused by the theft is mainly eaten by the company's own profits and reserves.
In summary, there are three possible scenarios:
Best case: The withdrawal rush is stabilized, and Bybit uses loans and its own assets to fill the remaining gap, recovering within half a year. Market confidence rebounds, and the industry continues a bull market momentum.
Middle case: The withdrawal rush lasts for a period of time but is not out of control, Bybit has to tighten its belt to get by, with less profit distribution for a few years to fill the gap. The industry is affected to some extent, with ETH and Altcoins correcting, but not to the extent of a bear market.
Worst-case scenario: Uncontrolled bank run, Bybit unable to withstand bankruptcy, a $150 million hole triggers a crisis of trust, the industry follows suit and the bear market arrives early.
4. What is the revelation for us ordinary users?
Many people say: "Small white users don't need to manage their own private keys, it's not safe, it's better to put funds on the exchange for more security."
The continuous exchange hacks are a powerful refutation of the above statement.
Do not be superstitious about the technical strength of the exchange, nor about the security of the exchange. In fact, the potential risks of the exchange are very large.
Why are the potential risks of the exchange greater?
The biggest risk of this centralized platform is that all user assets are concentrated, which actually makes it a concentrated target for attacks.
There is no absolutely secure system in the world. All systems may be breached, but attacks have a cost, so it depends on how much the target benefit is.
When the attack benefit is large enough, the attack methods and costs will also be amplified.
The exchange is a significant target, the exchange's wallet addresses are basically public, and the fund flows are also public, so as long as more resources are invested in the attack, there will eventually be a day when it is breached.
So the only thing we can believe in is technology, not "people" or "platforms".
Therefore, we still call on ordinary users to use decentralized wallets as much as possible, manage their own private keys, or go further and use wallets without private keys.
The Web3 world is a dark forest, we are both hunters and prey, every step must be taken with caution, only in this way can we live longer and go further.
Disclaimer: As a blockchain information platform, the articles published on this site only represent the views of the authors and guests, and are not related to the position of Web3Caff. The information in the articles is for reference only and does not constitute any investment advice or offer, and please abide by the relevant laws and regulations of your country or region.
