PANews reported on February 26 that Safe responded to Bybit’s hacker forensics report on the X platform:

A forensic review of the targeted attack on Bybit by the Lazarus Group concluded that the attack on Bybit Safe was achieved through a compromised Safe{Wallet} developer machine, resulting in disguised malicious transactions. Lazarus is a government-backed North Korean hacking group known for performing sophisticated social engineering attacks on developer credentials, sometimes combined with zero-day vulnerabilities. The forensic review by external security researchers did not indicate any vulnerabilities in the source code of the Safe smart contract or frontend and service.

Following the recent incident, the Safe{Wallet} team conducted a thorough investigation and has now restored Safe{Wallet} on the Ethereum mainnet in phases. The Safe{Wallet} team has completely rebuilt, reconfigured all infrastructure, and rotated all credentials, ensuring that the attack vector is completely eliminated. The Safe{Wallet} team will publish a full post-mortem after the final results of the investigation are known. The Safe{Wallet} frontend is still operational with additional security measures in place. However, users need to be extra careful and vigilant when signing transactions.