grep -rl "cryptocurrency" ./articles
The blockchain investigator ZachXBT says he posed as a client of a Chinese network he alleges laundered more than a billion dollars for North Korea's Lazarus Group, including most of the 1.5 billion taken from Bybit. He funded a wallet, placed orders, lost about five percent each time, and traced a cluster that led to a freeze.
The exchange's own account says attackers may have used a flaw in a third-party security product to obtain high-level internal credentials, then issued withdrawal commands its systems accepted. Mandiant and SlowMist are reported to date the access to 31 August, three and a half weeks before the transfers. Cold wallets were untouched and private keys were not taken.
Socket found 19 Chrome and Edge extensions draining wallets, harvesting hardware wallet seed phrases and stealing credentials. The operators wrote 14 of them and purchased the other five from previous owners — complete with existing users. Then they pushed an update, and Chrome installed it automatically.