The worst mistake you ever made at work can't compare to the one that Ben Zhou, CEO of the cryptocurrency exchange Bybit, made on the evening of Feb. 21.
Zhou merely approved a routine transaction, transferring large amount of the digital currency Ether into another account.
Just 30 minutes later Bybit's chief financial officer dropped a bomb: Their systems had been hacked, and cybercriminals had looted all of Bybit's 500,000 tokens, worth about $1.5 billion.
According to the New York Times, it was the largest cryptocurrency heist to date. Within just a few hours, blockchain analyst ZachXBT had identified the attackers: the notorious North Korean state-backed Lazarus Group.
The hackers' approach was surprisingly mundane, according to CCN. Bybit relied on free software to safeguard customer deposits. Experts say that the widely-used software, developed by the technology provider Safe, is fine for individuals and hobby traders, but wasn't appropriate for protecting billions in customer deposits.
Cybersecurity experts sounded the alarm. According to the security firm Cubist, the attack was "completely preventable."
After the attack, Bybit customers withdrew nearly $10 billion, about half its total deposits. Zhou rushed to reassure them that their funds remained available and secure. Three days later, Bybit had recovered $1.23 billion worth of stolen tokens and frozen more than $40 million in still-missing funds. But despite the rapid recovery, the incident still rocked the crypto markets.
There are national security concerns too. Twenty percent of those funds, or about $300 million, vanished. It's impossible to say how the North Korean government will use the stolen funds.