The recent Bybit $1.4 billion theft sparked new security checks in crypto that led SafeWallet developer Safe to provide an investigation report. Binance co-founder CZ Zhao reacted negatively to learning that a hacker targeted Bybit through its developer machine.
Safe determined through their forensic analysis that its smart contracts and front-end portal could not be exploited for the attack to occur. Gnosis blockchain network co-founder Martin Köppelmann explained that an illegal hardware wallet had been added to a compromised machine to exclusively steal resources from Bybit’s SafeWallet.
Bybit Funds Linked To Lazarus Group
Zhao demanded clearer details from the response because it did not provide sufficient information. On February 26 Zhao posted on X asking how several signers got deceived to approve fake transactions and how the hackers infiltrated Bybit’s computers yet left other addresses untouched.

Forensic tests from Sygnia and Verichains confirmed that someone stole into the SafeWallet servers using a stolen developer token. They used this access to trick authorized transactors into taking part in illegal financial deals. Data stored on the blockchain shows the Noion total 135,000 ETH valued at $335 million.
Blockchain researcher EmberCN believes the mrth Korean group Lazarus Group committed this attack. Security experts discovered Lazarus moving 45,900 Ether worth $113 million during the last day making their overall criminal financial transactoney thieves can transfer stolen money through multiple accounts in a week to ten days.

The hacking group Lazarus controls more than 11,000 wallets and Bybit together with Elliptic found the stolen funds there. After the analysis Elliptic offers a list of addresses linked to Lazarus for market participants to prevent money laundering and avoid any related risks.
The crypto security breach highlights existing weakness in the digital asset market while leaders in the industry ask for stronger measures to protect digital resources.