1. Whenever a wallet encounters such a hack incident, first find the wallet involved. Exchange wallets are usually tagged on etherscan, and you can search directly.

Look at this unfortunate wallet, tagged as Bybit cold wallet 1, but it only has a pitiful 22 dollars, likely meaning it’s done for. Scrolling down to see the historical transactions, indeed:

17 hours ago, the money in this wallet was withdrawn in one go, leaving not a single cent behind. 2. In the process of committing the crime, having found the wallet involved, we can now analyze the crime process. First, let’s see what this unfortunate wallet is all about.

First of all, it is a smart contract wallet, meaning it has code logic. A closer look at the open-source code logic reveals the keywords 'proxy' and 'gnosis.io', which means it is likely a safe wallet. For those unfamiliar, let me introduce: a safe wallet is a multi-signature wallet widely used for managing institutional funds. Various cryptocurrency institutions either have a custodian or self-manage, generally using a safe wallet. Besides directly storing cryptocurrencies, it may also be used for various multi-signature operations, such as airdrops, upgrading contract codes, and changing strategies for vaults, etc. Just understand that it is a very important wallet. The code has been on-chain for 7 or 8 years, experiencing various ups and downs in the crypto world, and has never had any problems; it can be called the evergreen pine of the crypto world.

Now this is a big deal; the funds in the safe wallet alone amount to over 100 billion dollars, not to mention various related contracts. If the underlying contract of this wallet is compromised, the impact would be unimaginable, far more explosive than any exchange crashing. You might wonder, if this has such a huge impact, wouldn’t the crypto market plummet?

Don’t rush, let’s continue to look. Knowing the wallet type allows us to start analyzing the transaction:

Looking at the first few transactions named sweepERC20 and sweepETH, just by looking at the names, we know they are theft operations. The safe wallet itself does not have those functions, so let’s not worry about them. At the bottom, the transaction name is Exec Transaction, which is a built-in function of the safe wallet, and all transactions go through it. This must be the starting point of this case, so let’s take a close look. The detailed content of the transaction is as follows:

Let's first examine the signatures in detail.

I looked at it with keen eyes for a long time (how I looked at it is too long to write, if someone wants to see it, I’ll expand), and I found no issues. This is indeed a serious signatures. It indicates that this transaction did collect signatures from multiple wallet owners; one can understand this as the safe having multiple keys, and this transaction indeed collected all the keys. Well, at least we can confirm that the underlying contract of the safe wallet is still secure, and the hacker must have found a way to get these keys to unlock this safe wallet. How they got these keys, let’s hold off on that for now.

Now let's take a look at the specific operations of this transaction and see how the hacker operated after opening the safe; this part is crucial.

First, the value is 0, indicating that this transaction did not make an ETH transfer. Considering this is likely an operation to open the safe, and most of the assets stored are interest-bearing assets like stETH, it is quite normal. The 'to' is a smart contract, and the 'data' is the content for interacting with this smart contract.

In simple terms, it called the method 0xa9059cbb of the contract 0x96221423681A6d52E184D440a8eFCEbB105C7242, passing the parameter bdd077f651ebe7f7b3ce16fe5f2b025be2969516.

So let’s first take a look at what this contract 0x96221423681A6d52E184D440a8eFCEbB105C7242 is about.

Opening it reveals, well, it's not open source; it’s likely a contract deployed by the hacker. Now that we can’t analyze the contract, does that mean we’ve hit a dead end? Nonono, smart as you are, you must have thought that even without open source, we can see what this transaction changed, right?

Carefully examine the transaction, okay, we found the problem. This transaction changed the proxy direction. To explain simply, the deployment of the safe wallet uses the proxy model to save gas and facilitate upgrades, meaning the wallet logic used by users points to one piece of code.

The wallet address itself has no code logic, it just stores money. The hacker modified the code logic of the wallet it pointed to with this transaction, causing this wallet to no longer be a safe wallet.

It merely wore the skin of a safe wallet; its core is the code logic deployed by the hacker at 0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516. It can be said that it was cyber possession, and the hacker could do whatever they wanted.

We can understand this by looking back at a pile of sweep operations in the wallet. After the hacker took control, a series of commands made the wallet spit out money, and the wallet obediently complied.

1.5 billion dollars and not a single cent left.

Bybit's 1.5 billion dollars is expected to be washed clean over the years through the path ETH→BTC→fiat currency, ultimately becoming the funding for the Enqingguo h plan. The security vulnerabilities of the exchange are also very obvious. They thought three signatures meant absolute security.

In fact, as long as one signer’s device is compromised, the entire system collapses instantly.

The administrator signed on a counterfeit Safe official website, unaware that the underlying transaction had already been swapped. It's like trying to create a chip with a PPT; no matter how extravagant the interface, the code is riddled with bugs. To avoid raising the ETH price, Bybit would rather borrow than buy coins to fill the hole. When the people of Enqingguo start to sell ETH, the exchange and the hacker will trample each other, and the retail investors will be slaughtered again.

After the incident was exposed, ETH plummeted, leveraged players suffered severe losses, and within 24 hours, 170,000 people were liquidated, and the rooftops began to queue again.

Bybit has always touted its cold wallet as absolutely secure, but was quickly exposed. No matter how thick the safe, it cannot prevent an insider from handing over the keys. Despite Bybit losing a year's profit, users still frantically withdrew their funds, while the CEO's live stream was flooded with support messages, a typical case of Stockholm syndrome.