Hacking a $4 billion piece of code
summary
Claim: attackers steal $1.5 billion from Bybit by compromising a developer + S3 JS injection that alters multisig UX, a social‑engineering vector attributed to Lazarus. Evidence: chain of events, S3-hosted web UI change, transaction signatures that moved funds. Countermeasures and payoffs: Polygon pays up to $1M bounties, Wormhole rewarded $10M for an uninitialized proxy, Uniswap advertises $15M for critical bugs, and competition platforms (Immunifi, Cantina) distribute millions to find simple web2/cloud mistakes.
AI-written summary · about
chapters (9)
- 0:00Blockchain hacking potential
- 1:05Bybit hack explained
- 3:54Social engineering risks
- 7:03Lazarus Group attribution
- 8:47Crypto hacks lessons
- 9:29Bug bounty: Cantina & Immunifi
- 12:36Bug bounty competitions
- 15:27Top crypto bug bounties
- 19:43Why pay for security findings
related talks
42mHOW VULNERABLE IS YOUR APP? AND HOW TO FIX IT.
46mNavigating The Landscape Of Client-Side Request Hijacking On The Web
19mCritical Security Mistakes in Frontend Applications
19mFireside With
17mConor Howe: Why Web3 is Broken & How to Fix It
14mThe Liquidity Gap: How LPs Are Leaving Billions on the Table
17mWallets across NFT aggregators: Monetization & Build Architecture
15mLocking Down PII: Why a Strong Frontend is Your First Defense