The solution to crypto’s Lazarus problem could be simpler than expected

What is a hijacked multisig?

Multisig wallets require any transaction to be signed by a certain threshold of trusted addresses. They aim to increase security by ensuring that a single compromised address cannot cause outsized damage on its own.

However, Lazarus’ preferred attack vector relies on tricking multiple members of a crypto company’s team into signing malicious transactions disguised as normal operational activities.

The signatures then “hijack” the organization’s multisig wallet, granting the hackers free reign over the funds contained within.

Compromised multisigs have led to truly staggering losses over the past year or so. First, Indian crypto exchange WazirX was drained of $230 million worth of assets in July last year.

Three months later, DeFi protocol Radiant Capital was hit for $50 million.

Finally, the largest heist in history saw ByBit lose $1.5 billion to Lazarus-linked hackers in February of this year.

The signers can be duped into signing over control of the multisig via spoofed front-ends, which present perfectly normal-looking transactions. In the Radiant case, developer devices were infected with malware, whereas preparation for the ByBit hack involved compromising the Safe {Wallet} UI separately.

How to solve the Lazarus problem

So far, the security community has been focused on workflow discipline and improving the readability of transaction data on hardware devices, such as the script written by Security Alliance’s Pascal Caversaccio in the wake of the Radiant hack.