The solution to crypto’s Lazarus problem could be simpler than expected

In just over 18 months, North Korean hackers, including the infamous Lazarus group, have used the same “hijacked multisig” technique to steal over $1.75 billion worth of crypto, a figure dwarfing all other losses in the sector over the same period.

There may be a solution, however, and it’s simpler than one might think.

A thread posted to X by veteran security researcher Daniel Von Fange, until recently of Origin Protocol, suggests adding a step to the typical multisig workflow.

The change would insert a surprisingly simple sanity check on any approved action, to be ratified between signing and execution.

Read more: Radiant Capital’s $50M crypto hack underlines DeFi’s multisig dependence

What is a hijacked multisig?

Multisig wallets require any transaction to be signed by a certain threshold of trusted addresses. They aim to increase security by ensuring that a single compromised address cannot cause outsized damage on its own.

However, Lazarus’ preferred attack vector relies on tricking multiple members of a crypto company’s team into signing malicious transactions disguised as normal operational activities.

The signatures then “hijack” the organization’s multisig wallet, granting the hackers free reign over the funds contained within.

Compromised multisigs have led to truly staggering losses over the past year or so. First, Indian crypto exchange WazirX was drained of $230 million worth of assets in July last year.

Three months later, DeFi protocol Radiant Capital was hit for $50 million.

Finally, the largest heist in history saw ByBit lose $1.5 billion to Lazarus-linked hackers in February of this year.

The signers can be duped into signing over control of the multisig via spoofed front-ends, which present perfectly normal-looking transactions. In the Radiant case, developer devices were infected with malware, whereas preparation for the ByBit hack involved compromising the Safe {Wallet} UI separately.

How to solve the Lazarus problem

So far, the security community has been focused on workflow discipline and improving the readability of transaction data on hardware devices, such as the script written by Security Alliance’s Pascal Caversaccio in the wake of the Radiant hack.

Read more: DeFi security researcher implicated in $50M Radiant Capital hack

Von Fange highlights the immediacy of the hijacking attack vector, stating “when the signatures land on chain from the attacker, the game is over and that’s when you find out. Some could have been collected weeks or months ago.”

Consulting with other researchers from Optimism, Security Alliance and Origin Protocol, he suggests adding what amounts to an “undo button” which allows teams a second chance to revert any malicious transaction before it takes effect.

Read more: North Korean hackers posing as devs exposed with ‘I Hate Kim Jong Un’ test

He urges “a few large teams that need the protection badly enough” to try out such a workflow in order to prove its effectiveness.

“Clever, evil, people are at this moment controlling projects’ computers, getting ready to try this again,” he says.

“We can save a billion dollars.”