Post

New details on the ByBit/Safe{Wallet} breach, and uhhh wow, some really silly blunders on the DPRK side. They still succeeded which is the most upsetting part of all of this. Let's bully some threat actor tradecraft! A🧵 x.com/safe/status/...

x.comSafe.eth on X: "Investigation Updates and Community Call to Action" / XInvestigation Updates and Community Call to Action

6/3/25, 5:21 pm12 reposts22 likes

Nick Frichette

@frichetten.com

6 Mar 2025

Step 1: How did they get access on the Safe{Wallet} dev's box? Answer: Social Engineering (isn't it always?)

Nick Frichette

@frichetten.com

6 Mar 2025

Step 2: How did they get access to AWS? With code execution on the developer's workstation they were able to exfiltrate AWS keys and use them locally. Let's comment on the IP/VPN setup first.

Nick Frichette

@frichetten.com

6 Mar 2025

If you have C2 on a developer's workstation you have two choices when it comes to creds. You can either use them FROM the compromised workstation, OR you can exfiltrate creds and use them remotely. Using them from the workstation has several advantages...

Nick Frichette

@frichetten.com

6 Mar 2025

particularly, you originate from an IP address already known to that organization. It looks like regular activity. It also protects you from the risk of impossible travel. It's weird if the dev is using the keys from New York and then 5 seconds later those same keys are in London