Blind Signing Vulnerabilities: ZKPs Offer Potential Fix After Bybit Hack

The hackers behind the Bybit hack have managed to cash out approximately $300 million of the stolen $1.4 billion in digital assets, despite industry efforts to prevent them.The hack has sparked debate about how Web3 firms can prevent similar attacks in the future.

Bybit Hack: 20% of Stolen Funds ‘Gone Dark’

Reports suggest cybercriminals behind the Bybit hack have cashed out approximately $300 million of the $1.4 billion in digital assets they stole. The hackers have achieved this despite concerted efforts by the crypto industry to thwart them. Tom Robinson, co-founder of crypto investigator Elliptic, said the hackers are now focused on evading security experts who are trying to block the stolen funds.

Robinson, who asserts 20% of the funds have “gone dark,” said the hackers’ activity, which his team can see, suggests they are working nearly 24 hours a day.

“Every minute matters for the hackers, who are trying to confuse the money trail, and they are extremely sophisticated in what they’re doing,” the Elliptic co-founder reportedly said.

As previously reported by Bitcoin.com News, the North Korea-backed Lazarus Group, thought to be behind the Bybit hack, successfully swapped some of the stolen ether (ETH) for more than 6,000 bitcoin (BTC). Conversion to BTC, which is censorship-resistant, is said to make it nearly impossible for Bybit to recover the stolen funds.

Furthermore, North Korea’s alleged prowess in hacking and laundering has made the task of security experts — who have identified $40 million of the stolen funds — much more challenging.

ZKPs a Shield Against Blindness

Meanwhile, the scale of the Bybit hack, as well as the hackers’ apparent ability to evade defenses, has sparked debate on what Web3 firms should do to prevent similar attacks in the future. Some believe the transparency and industry cooperation seen after the attack are the best ways to counter hackers.

Critics, however, assert the fact that hackers, known to keep stolen funds for years before liquidating them, have already cashed out undermines this argument. Others, like Nanak Nihal Khalsa, co-founder of Holonym, believe zero-knowledge proofs (ZKPs) could have prevented an attack attributed to blind signing vulnerabilities on Ledger hardware wallet devices.

Although it’s said to be the bedrock of many privacy-preserving protocols, Khalsa and others believe blind signing may be on borrowed time, and steps must be taken to get further ahead of criminals. Explaining how Holonym could have prevented the attack, Khalsa said:

“Our Human Wallet has a feature that prevents blind signing by showing a human-readable transaction on a hardware wallet instead of undecipherable data.”

Unlike current solutions that overpromise safety but underdeliver, Khalsa said ZKP solutions like Holonym can prove to be the much-needed “shield” that keeps signers informed without jeopardizing speed or security.

While there is no broad consensus on how the industry moves on from what has been described as the biggest hack ever, ZKP proponents like Khalsa insist this technology can play a part in rebuilding trust in the industry.

Source