Why Large Entities Using Safe are at Risk
I'm more than certain that WazirX and Bybit were victims of this same attack vector. In both situations we have exchanges carrying hundreds of millions of dollars in Safe smart contracts (multi-sig; upgradeable proxy). Each signature provided for both hacks had a
v > 30 (**what a coincidence**) and the signatures were validated against hashes that are ENTIRELY different than what we can see in the transaction log, most stack exec traces or other online visualizers. We still don't have an official story on the WazirX situation. Remember that one required 4+ signers. Three on the exchange's end that all confirmed (via 3rd-party audit) none of their devices were compromised. Beyond that, the 4th and final signer was an entity called 'Liminal', whose sole duty was to effectively play 'last line of defense' for WazirX in the case that one or more of their signers did end up being compromised somehow. Neither party (Liminal / WazirX) willing to budge on their declaration that neither was operationally compromised in any way, shape or form. No private keys were siphoned or leaked and there is scant (or no) evidence to corroborate the idea that the exchange owners blind signed something foolishly (again, worth noting that they contracted Liminal to serve as that last line of defense in the event they did somehow get compromised or bamboozled into letting a suspicious / weird transaction get signed).
What are the chances that these two exchange hacks weren't due to their respective owners or related custodians being dipshits too lazy to double check before signing off on a transaction from a wallet holding hundreds of millions of their funds despite possessing enough wherewithal and motivation to deploy an extensively secure, clandestine and comprehensive authorization scheme for those same funds? What are the chances that this disease of apathy and carelessness didn't actually afflict every single authorized signer of these two respective exchanges, simultaneously, right when the culprit (Lazarus) had decided to strike?
This exploit/vulnerability likely won't impact smaller users (small in terms of funds), because the risk/reward ratio doesn't justify it. The effort/resource/brain power necessary to pull this off mandates a sizable payout. But when we look at WazirX losing >$250 million and Bybit losing >$1.5 billion (both in the space of less than a year) ...this has been a lucrative ass campaign for Lazarus.