Blockchain analytics firm Arkham Intelligence said North Korea’s Lazarus Group was behind Bybit’s $1.46 billion hack. In an earlier post on social media platform X, Arkham offered a bounty of 50,000 ARKM tokens for anyone who could identify the attackers for Friday’s hack.
Later, the platform said onchain sleuth ZachXBT submitted “definitive proof” that the attackers were the North Korean hacker group. “His submission included a detailed analysis of test transactions and connected wallets used ahead of the exploit, as well as multiple forensics graphs and timing analyses,” the post said.
Read more…
Source: Coindesk News
Related:
- Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set
September 1, 2026
While monitoring Mirage Kitten activity, Kaspersky researchers uncovered a previously undocumented malware family that we dubbed NodeRabbit. The researchers identified the first sample on a system in Afghanistan. Further threat hunting revealed two additional, more advanced, variants: one on a system in Egypt and another on a system in Ethiopia. NodeRabbit is a cross-platform remote access ...
- Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing
September 1, 2026
Since late 2025, malicious cyber actors have been targeting prominent victims, their family members, and personal acquaintances by directly messaging personal accounts with malicious links leveraging a technique known as “OAuth consent phishing.” Recently observed activity includes impersonating government officials, media, and other publicly known personalities on a commercial messaging application (CMA) and soliciting the targeted ...
- P&O Ferries data blunder as it sends out passengers’ personal details by text message
August 31, 2026
P&O Ferries was hit by a data breach after mistakenly sending out a full list of passengers’ personal details by text message this morning, we can reveal. A blunder saw the details of 432 passengers travelling on the 12pm P&O ferry from Calais to Dover sent as an attachment in a customer services text message. It is ...
- ValleyRAT masquerading as adware
August 31, 2026
Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the ...
- Healthcare data breach exposes 3.75M patient records
August 30, 2026
Hackers stole medical records, Social Security numbers, government IDs and financial data from millions of CareCloud patients You can be careful with your passwords and still get caught in a breach at a company you may have never heard of. That is one of the frustrating parts of the CareCloud data breach. More than 3.75 million ...
- TerminalFix campaign deploys a reverse tunnel through multistage intrusion
August 28, 2026
Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare CAPTCHA verification overlay that tricks users into copying and executing a malicious PowerShell command. While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply ...