CyberAttack

Trezor, un fornitore di hardware #wallet , ha recentemente riconosciuto che una violazione della sicurezza che ha coinvolto il suo servizio di posta elettronica di terze parti ha provocato l'invio di una serie di e-mail fraudolente ai propri clienti nelle ultime 12 ore.
Il 24 gennaio #Trezor ha rilasciato una dichiarazione rivelando di aver identificato un'e-mail non autorizzata, che affermava falsamente di provenire dall'azienda, diffusa da un servizio di posta elettronica di terze parti utilizzato.
L'e-mail ingannevole, inviata da "noreply@trezor.io", istruiva falsamente gli utenti ad aggiornare la propria "rete" per non correre il rischio di perdere i propri fondi.

#MultiSig #CyberAttack
The recent security breach at Bybit, resulting in the theft of $1.5 billion, has sent shockwaves through the crypto community. At the heart of this incident lies a critical flaw in Safe’s multi-signature infrastructure, exposing serious risks that could impact not just Bybit but the broader Ethereum ecosystem. Let’s break down the key issues that led to this breach.
Safe’s Security Breakdown: A Single Point of Failure
According to the investigation, the attack stemmed from a compromise of a Safe developer’s machine, granting hackers access to AWS permissions. This unauthorized access enabled them to modify Safe’s front-end infrastructure, inserting malicious code tailored specifically to exploit Bybit’s multi-signature contracts.
The most concerning part? The exploit was embedded two days before the attack, lying in wait for Bybit’s routine transactions. Initially, many believed the issue was related to Bybit’s local environment, but further analysis revealed that Safe’s server-side vulnerability was the real entry point. Had the attack gone unnoticed for longer, even more assets could have been at risk—an alarming prospect for multi-signature security.
Bybit’s Critical Signing Oversight
While Safe’s security lapse was the gateway for the attack, Bybit’s signing process played a major role in enabling the theft. According to reports from OneKey, Bybit engaged in blind signing, meaning transactions were approved without verifying the details. This is equivalent to signing a legal document without reading the terms—an open invitation for exploitation.
Had Bybit implemented a thorough verification process, such as parsing transaction data before signing, the attack could have been detected and halted. This oversight highlights a fundamental issue in security practices: even the most advanced wallets and multi-signature mechanisms can fail if users do not exercise due diligence.
Key Takeaways: Strengthening Multi-Signature Security
This breach exposes two critical weaknesses in multi-signature security:
Infrastructure Vulnerability – Safe’s compromised front-end created a systemic risk, proving that a single-point failure in wallet services can have devastating consequences.Lack of Transaction Verification – Bybit’s failure to scrutinize signing requests allowed hackers to exploit their funds effortlessly.
Moving forward, the industry must adopt more robust security measures, including enhanced front-end protections, stricter internal controls, and mandatory transaction verification processes. If similar attacks target other major players using Safe’s multi-signature setup, the implications could extend far beyond this single incident.
Who bears the greater responsibility in this breach—Safe for its compromised infrastructure, or Bybit for its lack of transaction security? Share your thoughts below.
This version delivers a professional, structured, and engaging analysis, eliminating any risk of similarity while ensuring accuracy and clarity. Let me know if you need further refinements! 🚀
#Blockchain
#BybitHack #CryptoSecurity