83% of Crypto Security Leaders Report Cyberattack Exposure as Sygnia Releases Bybit Investigation Findings
Sygnia’s investigation into the $1.5 billion Bybit hack reveals how North Korea’s Lazarus Group exploited human risk, social engineering, and crypto infrastructure weaknesses to execute the largest crypto theft in history.
- Sygnia releases digital forensics behind largest reported crypto heist in history to help narrow industry-wide cyber readiness gap
- New case study breaks down how North Korean threat actor avoided detection, exploited user trust and stole $1.5 billion in crypto in Bybit attack
- New eBook provides guidance for avoiding continuous attacks common for crypto platforms
TEL-AVIV & NEW YORK – June 18, 2026. Sygnia, the foremost global cyber readiness and response team, today unveiled the complete findings of their Bybit investigation, breaking down how the Lazarus group, a North Korean state-linked threat actor, carried out the largest documented digital asset heist in history. The report highlights how the threat actor leveraged social engineering, human risk and complex technology stacks within crypto environments to carry out the $1.5 billion theft, accounting for 44% of the total cryptocurrency stolen from private wallets worldwide ($3.4 billion) last year.
An industry-wide problem
The investigation highlights a wider industry cyber resilience gap. Sygnia’s 2026 CISO survey shows that 83% of security leaders in crypto and decentralized finance reported exposure to a cyberattack in the last 12 months, while 75% admit they are not fully prepared to withstand a significant cyberattack without disruption. In response to the rise in the number of attacks facing crypto platforms witnessed by Sygnia over the last 12 months, Sygnia is publishing its 2026 Crypto eBook to break down the common entry points used by threat actors, the anatomy of a crypto attack and how crypto organizations can build resilience and reduce the breach exposure time.
“Over the past year, we have seen an uptick in the number of cyber attacks hitting crypto exchanges, some repeatedly. The Bybit attack is a stark reminder for all that cyber resilience in digital assets companies needs to be considered a prerequisite. The industry must pride itself on cyber resilience maturity, governance, and recovery capabilities as much as it does speed, agility and innovation,” said Matan Naftali, Senior Enterprise Security Expert at Sygnia.
ByBit Investigation Breakdown:
- Social Engineering Initial Access – Carried out over a timeline of nearly three weeks, the initial entry involved compromising a Safe{Wallet} developer’s macOS workstation, via social engineering. The lure involved delivering a malicious Python application to establish access.
- Cloud Intrusion – The Lazarus Group leveraged stolen session tokens to access AWS resources and attempted to register a fraudulent Multi-Factor Authentication (MFA) device.
- Web Application Tampering – Malicious JavaScript was injected into Safe{Wallet}’s frontend application hosted on AWS S3. The injected JavaScript enabled the interception and manipulation of transaction data, specifically targeting Bybit’s transaction flows.
- Execution and Clean Up – Once the malicious transaction was executed, 400,000 ETH (~$1.5 billion) moved to North Korean -linked threat actor accounts. Immediately following the heist, the attacker removed the injected JavaScript payload to erase evidence and obscure pathways for forensic analysis.
Crypto cyber readiness
According to investigations by the FBI, cryptocurrency investment scam losses grew 25% from 2024 to 2025. The growing trend of attacks plaguing the crypto industry calls for stronger alignment in cyber readiness. Sygnia’s Crypto eBook provides security leaders and executives in cryptocurrency real-world insights into how incidents begin, how transaction authority is compromised, and the architectural conditions to prevent irreversible asset movement.
2026 Crypto eBook Key Takeaways
- Disproportionate Risk Facing Crypto Platforms – Unlike traditional financial institutions, cryptocurrency infrastructure allows assets to move instantaneously once the appropriate credentials or signing mechanisms are accessed. While transactions are publicly visible, linking wallet addresses to real-world actors and recovering stolen assets can be extremely difficult.
- Top Methods Attackers Gain Access – Threat actors leverage social engineering, malware, supply chain exploitation and insider access to target crypto platforms. Additionally, complex technology stacks increase attack surface, enabling threat actors to exploit poor system integrity and patch delays.
- Visibility Must Be a Priority – In cryptocurrency environments, the window between compromise and financial loss can be within seconds rather than hours or day, requiring detection capabilities to simultaneously identify compromises in parallel with recognizing signals before unauthorized transactions are executed.
- Resilience Begins With Organization Alignment – Baking in resiliency within a crypto platform requires alignment of safeguards that protect transaction authority. Digital asset environments combine infrastructure, identity systems, custody mechanisms, and blockchain operations into a single operational stack. Weakness in any one of these layers can create a pathway to asset movement.
Naftali, continues, “Attacks facing crypto platforms are unique because they hold and transact high reserves of money using single-signing mechanisms, without the rigorous controls and distributed authorization that traditional financial organizations offer. A single attack could grant threat actors millions within minutes, with little to no recovery window between compromise and consequence.”
For more information on the threats facing crypto platforms and what separates organizations that can effectively contain and recover from incidents from those where losses escalate beyond control, read the full Sygnia Crypto eBook here.
About Sygnia
Sygnia is the world’s foremost incident response and cyber readiness team. It applies creative approaches and bold solutions to each phase of an organization’s security journey, meeting them where they are to ensure cyber resilience. Sygnia is the trusted advisor and service provider of leading organizations worldwide, including Fortune 100 companies. Sygnia is a Temasek company, part of the ISTARI Collective.
83% of Crypto Security Leaders Report Cyberattack Exposure as Sygnia Releases Bybit Investigation Findings. (2026, June 18). 83% of Crypto Security Leaders Report Cyberattack Exposure as Sygnia Releases Bybit Investigation Findings, Sygnia.
https://sygnia-stg.prpl.global/press-release/bybit-investigation-largest-crypto-heist-lazarus-group/
Related Resources
By clicking Subscribe, I agree to the use of my personal data in accordance with Sygnia Privacy Policy. Sygnia will not sell, trade, lease, or rent your personal data to third parties.