Solana multisig provider conducting ‘comprehensive review’ after Safe exploit

This is a segment from the Lightspeed newsletter. To read full editions, subscribe.

Yesterday, Bybit CEO Ben Zhou posted on X that the platform’s $1.4 billion hack had been caused by “malicious code originating from Safe{Wallet}’s infrastructure.” Solana CEOs had many words, including “nightmare season,” “holy hell,” and “holy shit.”

Preliminary reports indicate Safe’s frontend was exploited to trick Bybit into signing a malicious transaction, and Safe’s actual smart contracts appeared to perform as intended. Still, the foul language likely stemmed from the fact that wallets being exploitable gives hackers access to a whole lot of assets — Safe’s smart accounts secure over $100 billion in digital assets.

In other words, hackers could go further than Bybit.

Squads, a multisig wallet used by a number of prominent Solana teams including Helium, Kamino, Pyth, Helius, Drift, Jupiter and Ellipsis, is “conducting a comprehensive review of our infrastructure to mitigate the possibility of such an attack,” CEO Stepan Simkin told me.

Simkin emphasized that “high value accounts” need purpose-built wallet solutions because sophisticated hackers can “potentially compromise any frontend.”

The Bybit hackers — whom the FBI has now accused of being linked to North Korea — injected malicious code into Safe’s JavaScript files to alter Bybit’s multisig transactions and send the funds to the attacker’s address, according to a report from blockchain security firm Slowmist. While the crypto industry puts a lot of effort into auditing smart contracts, it focuses less than it should on “conventional infrastructure” — like leaked Amazon Web Services credentials, which was the culprit in this case, Simkin said.

Source