Safe{Wallet} has confirmed a full infrastructure reset in response to the February 21, 2025, cyberattack that compromised Bybit’s systems. The attack has been attributed to the North Korea-linked TraderTraitor group, raising serious concerns about security risks across the crypto industry.
In response, Safe has rotated credentials, reset clusters, updated builds, and redeployed container images to strengthen its security framework.
In addition to overhauling its infrastructure, Safe has enhanced its security measures by introducing advanced real-time threat detection, tightening hardware wallet access, and integrating third-party transaction verification tools. The platform has partnered with Blockaid to improve malicious transaction detection, ensuring better protection against unauthorized activities.
Safe has also been collaborating with cybersecurity firm Mandiant to investigate the breach. Findings indicate that attackers hijacked AWS session tokens, bypassing multi-factor authentication to gain unauthorized access. Mandiant’s report confirms the involvement of the TraderTraitor group, which has been linked to high-profile crypto heists. Meanwhile, blockchain research firm Arkham has tracked laundering activities by the Lazarus group, revealing that stolen funds were moved through Bitcoin transactions and other channels.
To further bolster security, Safe temporarily restricted external access to its Transaction Service, enforced stricter firewall rules, and disabled native hardware wallet signing to mitigate risks. Additionally, it cleared all pending queued transactions and introduced a third-party verification tool, “Safe Utils,” allowing users to verify transaction hashes independently. These steps are part of Safe’s ongoing effort to fortify its security infrastructure and prevent future cyber threats.
0 Comments