Blind Signature Vulnerability: ZKPs Offer Potential Solution After Bybit Hack

The hackers behind the Bybit hack have managed to cash out about $300 million of the $1.4 billion in stolen digital assets, despite industry efforts to stop it. The hack has sparked a debate on how Web3 companies can prevent similar attacks in the future.

Bybit hack: 20% of stolen funds “disappeared”.

The hackers behind the hack have reportedly cashed out about $300 million of the $1.4 billion in digital assets they stole in the Bybit hack. The hackers succeeded despite a concentrated crackdown by the crypto industry. Tom Robinson, co-founder of crypto investigation firm Elliptic, said the hackers are currently focused on evading security experts who are trying to stop them from moving the stolen funds.

Claiming that 20% of the funds “disappeared,” Robinson said the hackers’ activities, which his team could observe, showed that they were working almost 24 hours a day.

“Every minute counts for these hackers, they try to obfuscate where the funds are going, and they are very skilled,” the co-founder of Elliptic reportedly said.

As previously reported by Bitcoin.com News, the Lazarus Group, believed to be backed by North Korea, has successfully exchanged some of the stolen Ethereum (ETH) for more than 6,000 Bitcoin (BTC). The conversion into censorship-resistant BTC allegedly made it nearly impossible for Bybit to recover the stolen funds.

In addition, North Korea’s alleged prowess in hacking and money laundering has made the task of security experts — who have already identified $40 million of the stolen funds — even more difficult.

Zero-knowledge proofs: a shield against blindness

Meanwhile, the scale of the Bybit hack and the hackers’ apparent ability to circumvent defenses have spurred debate about what Web3 companies should do in the future to prevent similar attacks. Some argue that transparency and industry collaboration, as seen in the aftermath of the attack, are the best way to combat hackers.

However, critics assert that the fact that hackers are known to have typically kept stolen funds for years before cashing out, and have now cashed out, undermines that argument. Others, like Holonym co-founder Nanak Nihal Khalsa, argue that zero-knowledge proofs (ZKPs) could prevent attacks like the one that occurred on Ledger hardware wallet devices due to the blind signature vulnerability.

While zero-knowledge proofs are known as the cornerstone of many privacy-preserving protocols, Khalsa and others believe that blind signatures may already be on the clock and steps must be taken to stay ahead of criminals. Explaining how Holonym can prevent such attacks, Khalsa said:

“Our Human Wallet has a feature that prevents blind signatures by displaying human-readable transactions instead of incomprehensible data on the hardware wallet.”

Unlike current solutions that over-claim security but under-perform, Khalsa said ZKP solutions like Holonym’s could prove to be the needed “shield” that keeps signers informed without sacrificing speed or security.

While there is no broad consensus on how to move the industry forward, ZKP proponents like Khalsa insist that the technology can play a role in rebuilding trust in the industry.