ZachXBT 利用社会工程发现了 1200 万美元的 Bybit 漏洞利用资金

链上调查员 ZachXBT 揭示了社会工程如何帮助追踪与 Bybit 漏洞相关的超过 1200 万美元的资金，这标志着加密货币取证的一种新策略。

ZachXBT Uncovers $12M in Bybit Exploit Funds Using Social Engineering

ZachXBT 利用社会工程发现了 1200 万美元的 Bybit 漏洞利用资金

In a groundbreaking move that blends technical blockchain analysis with a dash of daring social engineering, on-chain investigator ZachXBT has successfully traced over $12 million in funds connected to the massive Bybit exploit. This sophisticated approach, which involved posing as a potential client, allowed ZachXBT to infiltrate money-laundering networks and follow the digital trail of stolen assets, adding a novel dimension to crypto forensics.

链上调查员 ZachXBT 将区块链技术分析与大胆的社会工程相结合，这是一项突破性举措，已成功追踪到与大规模 Bybit 漏洞相关的超过 1200 万美元的资金。这种复杂的方法涉及冒充潜在客户，使 ZachXBT 能够渗透到洗钱网络并追踪被盗资产的数字踪迹，为加密货币取证增添了新的维度。

A Client's Gambit: Infiltrating the Network

客户的策略：渗透网络

ZachXBT's strategy was to present himself as a legitimate client, gaining access to the very channels being used to launder the illicit gains. By operating from within these networks, rather than merely observing from the outside, he was able to map fund flows that would have otherwise remained elusive. This isn't the first time ZachXBT has employed such infiltration tactics; previous investigations, as reported by CryptoSlate, have linked similar methods to uncovering connections with the Lazarus Group, a notorious North Korean state-linked hacking collective.

ZachXBT 的策略是将自己呈现为合法客户，从而进入用于洗钱非法收益的渠道。通过在这些网络内部运作，而不是仅仅从外部观察，他能够绘制出原本难以捉摸的资金流向。这并不是 ZachXBT 第一次采用此类渗透策略；据 CryptoSlate 报道，之前的调查已经将类似的方法用于揭露与 Lazarus Group 的联系，Lazarus Group 是一个臭名昭著的与朝鲜国家有关的黑客组织。

This method stands in stark contrast to traditional blockchain forensics, which primarily relies on passive wallet-graph analysis. Direct engagement with the operators of a laundering network is a considerably higher-risk endeavor, rarely attempted by independent investigators. ZachXBT's established track record in exposing token fraud, including instances where the LAB token plummeted 97% after he linked its selling to team-funded wallets, underscores his penchant for unconventional investigative techniques.

这种方法与传统的区块链取证形成鲜明对比，传统的区块链取证主要依赖于被动钱包图分析。与洗钱网络运营商直接接触是一项风险相当高的工作，独立调查人员很少​​尝试这样做。 ZachXBT 在揭露代币欺诈方面有着良好的记录，包括在他将 LAB 代币的销售与团队资助的钱包联系起来后暴跌 97% 的情况，这突显了他对非常规调查技术的偏爱。

The $12 Million Trail: What It Signifies

1200 万美元的旅程：它意味着什么

The investigator's claim is that over $12 million in exploit-linked funds have been traced. It's crucial to understand that 'tracing' signifies identification and mapping on the blockchain, not necessarily the freezing, seizure, or return of the assets. While tracing establishes a clear provenance trail that can be acted upon by law enforcement or exchanges, it does not, in itself, constitute recovery.

调查人员声称已追踪到超过 1200 万美元的与漏洞利用相关的资金。重要的是要理解，“追踪”意味着在区块链上进行识别和映射，而不一定是冻结、扣押或返还资产。虽然追踪建立了明确的来源线索，可供执法或交易所采取行动，但它本身并不构成恢复。

The Bybit exploit, which the FBI has attributed to North Korean cyber actors, involved an estimated $1.5 billion in stolen cryptocurrency. The $12 million figure, while a fraction of the total, represents a significant piece of the puzzle. Documenting and linking traceable amounts to specific wallets strengthens the evidentiary record substantially. Bybit itself has maintained a public bounty program to incentivize information leading to the recovery of stolen ETH from its cold wallet.

FBI 将 Bybit 漏洞归咎于朝鲜网络攻击者，该漏洞涉及价值约 15 亿美元的被盗加密货币。 1200 万美元虽然只占总数的一小部分，但却代表了这个难题的重要组成部分。记录可追踪金额并将其链接到特定钱包可以大大加强证据记录。 Bybit 本身一直维持着一项公共赏金计划，以激励从其冷钱包中追回被盗 ETH 的信息。

Independent Verification: The Crucial Next Step

独立验证：下一步至关重要

ZachXBT operates as an independent investigator, not an official authority. While his findings carry considerable weight within the crypto security community, they are not law enforcement conclusions. Claims made through such channels should be viewed as valuable leads that require independent confirmation, especially when specific wallet addresses or laundering routes are identified.

ZachXBT 作为独立调查员而非官方机构运作。虽然他的发现在加密安全社区中具有相当大的影响力，但它们并不是执法结论。通过此类渠道提出的索赔应被视为需要独立确认的有价值的线索，尤其是在识别出特定钱包地址或洗钱路线的情况下。

The Bybit case remains an active investigation, with exchanges, analytics firms, and regulators closely monitoring fund movements associated with the February exploit. Any confirmed tracing of $12 million in exploit proceeds would serve as a meaningful data point in an investigation spanning multiple chains and jurisdictions. However, published figures from a single investigator naturally warrant corroboration before being considered definitive.

Bybit 案件仍在积极调查中，交易所、分析公司和监管机构正在密切监视与 2 月份漏洞相关的资金动向。任何已确认的 1200 万美元漏洞利用收益追踪都将成为跨多个区块链和司法管辖区的调查中有意义的数据点。然而，单个调查员公布的数据在被认为是确定的之前自然需要得到证实。

So, while the digital breadcrumbs lead to some interesting places, it’s always good to remember that the crypto world keeps us on our toes, doesn't it? Keeps things interesting, that's for sure!

因此，虽然数字面包屑会带来一些有趣的地方，但记住加密世界让我们保持警惕总是好的，不是吗？让事情变得有趣，这是肯定的！