We're sunsetting PodQuest on 2025-07-28. Thank you for your support!
Export Podcast Subscriptions
cover of episode Inside the Biggest Heist

Inside the Biggest Heist

2025/3/8
logo of podcast web3 with a16z crypto

web3 with a16z crypto

AI Deep Dive AI Chapters Transcript
People
R
Robert Hackett
Topics
Robert Hackett: 本集讨论了 Bybit 遭遇的 15 亿美元加密货币盗窃案,这是可能是历史上最大规模的盗窃案之一。这次事件突显了加密货币安全领域的脆弱性,特别是多重签名钱包和硬件钱包的安全问题。我们还讨论了攻击的细节、不同类型钱包和组织的加密货币安全现状,以及如何保护自己免受类似攻击。 Matt Gleason: 这次攻击利用了 Safe 多重签名钱包的漏洞,黑客通过修改 Safe Web 应用的 JavaScript 代码,在交易签署前替换了目标地址,从而窃取了 Bybit 的资金。攻击者可能掌握了 Bybit 的内部信息,并针对性地进行了攻击。这次攻击也暴露了硬件钱包的安全性并非绝对,以及社会工程学攻击的风险。 为了提高安全性,公司应该进行详细的威胁建模,将资金分散存储到多个钱包中,并验证交易的哈希值。个人用户应该避免下载可执行文件,并在工作机器上运行可疑软件。软件供应商应该加强软件开发生命周期中的安全措施,以防止供应链攻击。

Deep Dive

Shownotes Transcript

with @mg_486662) and @rhhackett)

Welcome to web3 with a16z. I’m Robert Hackett and today we’re talking about what is potentially the biggest heist of all time — a hack of the Dubai-based crypto exchange ByBit which took place last month for a total of $1.5 billion and which the Federal Bureau of Investigation has attributed to a North Korean state-sponsored hacking group.

In this episode, we cover details of how the attack went down, the state of crypto security across different types of wallets and organizations, and what you can do to help protect yourself from similar attacks.

We’re joined by Matt Gleason, a security expert at a16z crypto, whose excellent write-up of the incident you can find below. We’ve also included an FBI PSA about the hack and other useful links as well.

Resources:

As a reminder, none of the content should be taken as investment, business, legal, or tax advice. Please see a16z.com/disclosures for more important information, including a link to a list of our investments.