Bybit’s Evil Twin Strikes Again! $230M Crypto Heist Revealed!

by

Key Highlights (Because Who Doesn’t Love a Good Scandal?)

  • Ledger CTO Charles Guillemet claims the $230 million Drift Protocol hack was orchestrated by a team of masterminds who either stole private keys or convinced signers to approve a transaction while pretending it was a “routine coffee run.”
  • Guillemet compared the attack to the Bybit heist, which was allegedly pulled off by North Korean hackers, the original crypto villains. “It’s like watching a sequel with no new ideas,” he said.
  • He demanded the industry adopt a “security reset” involving hardware wallets, better passwords, and a return to paper-and-pencil signing. “Because nothing says ‘sophistication’ like a 1990s-era security protocol,” he quipped.

Charles Guillemet, Ledger’s CTO, declared the Drift Protocol exploit “yet another reminder that in crypto, trust is the only thing you can’t hack-unless you’re a human being.” He likened it to the 2025 Bybit heist, which was “so good, even the FBI had to check the credits.”

Guillemet admitted the full story is still being written, but the plot thickens: the multisig was compromised, possibly days before the funds vanished. “It’s like finding out your house was robbed while you were busy watching Netflix,” he said.

“Either the hackers stole enough keys to break the multisig, or they tricked signers into approving a transaction while pretending it was a “legitimate operation.” “Like convincing your grandma to sign a contract for a timeshare she doesn’t need,” Guillemet added.

This “patient, sophisticated supply-chain-level compromise” has become the go-to move for crypto villains. Guillemet called it “the DPRK’s new franchise,” citing the Bybit heist as the original blockbuster.

The Bybit Playbook: Human Layer, Not Code

The Bybit heist was a masterclass in crypto crime. In 2025, North Korean hackers (because why not?) compromised Bybit’s multisig by targeting signers’ machines. “They didn’t need a smart contract-they just needed a little phishing and a lot of patience,” Guillemet said.

Signers thought they were approving a “routine transaction” but instead authorized a $1.4 billion drain. “It’s the digital equivalent of signing a check for your life savings while distracted by a squirrel,” he noted.

Guillemet warns the same blueprint is being reused. Drift’s $230 million exploit followed the exact same script: multisig compromise, compromised machines, and a malicious transaction disguised as a “normal” operation. “It’s like watching a sequel with no new ideas,” he said.

On-chain researchers found the attacker funded an address with 1 SOL a week before the heist. “Pre-positioning? More like pre-planning a heist while sipping a latte,” Guillemet joked.

Three Pillars: Detection, Key Management, Clear Signing

Guillemet outlined three “must-haves” for the industry:

First, better detection mechanisms. “Because waiting until it’s too late is so 2024,” he said. “If your system can’t spot a compromised environment, you’re already dead.”

Second, secure key management. “Hardware-backed signing? Because software wallets are just invitations for hackers to crash your party,” he quipped.

Third, clear signing. “Signers need to know exactly what they’re approving. Otherwise, they’re just signing away their future,” he said.

“Security isn’t just about code,” Guillemet concluded. “It’s about making sure your operators don’t accidentally sign a contract with the devil.”

Drift Fallout

The exploit left Drift Protocol in ruins. Its TVL plummeted from $550 million to $250 million. “It’s like watching your favorite TV show get canceled after one season,” Guillemet said.

Drift confirmed the attack, suspended transactions, and blamed the “usual suspects.” The attacker swapped assets into USDC and bridged them to Ethereum, with no help from Circle. “Because why would they stop a heist?” Guillemet asked.

Forward Industries and DeFi Development Corp claimed no damage, while Phantom warned users. “Because nothing says ‘security’ like a pop-up ad,” Guillemet said.

As Guillemet put it, “Security is about giving users the right info at the right time. Or, as I like to call it, ‘not getting robbed.’”

The $230 million question: Will the industry finally learn from its mistakes-or just roll out the same tired playbook? “Let’s hope they’re not as lazy as the hackers,” he said.

Read More

2026-04-02 15:35