Sebastian Sinclair

The FBI has issued a warning to crypto companies over recent blockchain activities tied to the theft of hundreds of millions of dollars by the Democratic People&#8217;s Republic of Korea (DPRK).



TraderTraitor-affiliated actors, also known as the <a href="https://blockworks.co/tag/lazarus-group">Lazarus Group</a> and APT38, are accused by the state of siphoning off funds from several crypto protocols and projects last year.



Over the last 24 hours, the FBI said it has tracked about 1,580 bitcoin (<a href="https://blockworks.co/price/btc">BTC</a>), worth more than $40 million, stolen by the DPRK and held in six Bitcoin addresses. The Bureau believes the DPRK may attempt to liquidate the digital assets held therein, according to a <a href="https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk">statement</a>.



Private sector entities are urged to examine the recent blockchain data linked to the addresses provided by the FBI on Tuesday and be vigilant against transactions directly with or derived from them.



“The FBI will continue to expose and combat the DPRK’s use of illicit activities — including cybercrime and virtual currency theft — to generate revenue for the regime,” it said in a statement.



Among the high-profile international crypto heists attributed to DPRK includes the theft of $60 million from payment providers Alphapo on June 22 and $37 million from CoinsPaid on the same day. A further $100 million from Atomic Wallet at the start of that month has also been flagged.



The thefts from Lazarus last year prompted warnings from several nations, including <a href="https://blockworks.co/news/japan-based-crypto-businesses-warned-of-possible-cyberattack-threat">Japanese local authorities</a>, to provide preventive measures against further attacks. On Monday, cybersecurity firm Palo Alto Networks’ CEO Nikesh Arora told <a href="https://www.cnbc.com/2023/08/21/palo-alto-networks-ceo-stresses-modern-integrated-cybersecurity.html#:~:text=with%20Jim%20Cramer-,Palo%20Alto%20Networks%20CEO%20Nikesh%20Arora%20told%20CNBC%27s%20Jim%20Cramer,gaining%20access%20to%20sensitive%20information.">CNBC</a> in an interview, that companies needed to beef up and modernize their systems in a bid to shield themselves from “bad actors.”



The FBI previously confirmed attacks against Harmony’s Horizon bridge and Sky Mavis’ <a href="https://blockworks.co/news/fbi-says-north-korea-behind-625m-ronin-hack">$625 million</a> hack on Ethereum-linked sidechain Ronin Bridge last year, alongside a Cybersecurity Advisory on TraderTraitor.&nbsp;



Lazarus made attempts to move funds worth <a href="https://blockworks.co/news/north-koreas-lazarus-hackers-try-to-exfiltrate-harmony-funds">$63 million</a> linked to the Horizon bridge, though concerted efforts from the industry, including exchanges, blocked the transfers.



In April, the US Treasury’s Office of Foreign Assets Control <a href="https://blockworks.co/news/treasury-sanctions-lazarus-group-members">sanctioned</a> three individuals, Wu Huihui, Cheng Hung Man and Sim Hyon Sop with alleged ties to the group.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

FBI flags imminent sale of $40M in stolen crypto funds linked to North Korea

Casey Wagner

The Federal Bureau of Investigations (FBI) seized nearly $400,000 worth of cryptocurrencies from Binance accounts in May, according to public notices filed this month. 



The agency seized bitcoin and tether valued at about $397,221 from six Binance accounts between May 2 and 23, federal forfeiture documents show. 



The assets were seized “for violation of federal law,” the FBI wrote in the <a href="https://www.forfeiture.gov/pdf/FBI/OfficialNotification.pdf">notice</a>.&nbsp;



Despite now being the defendant in two lawsuits with US agencies – the <a href="https://blockworks.co/tag/sec">US Securities and Exchange Commission</a> and the <a href="https://blockworks.co/tag/cftc">Commodity Futures Trading Commission</a> – Binance maintains that it still aids in these types of investigations.&nbsp;



“Binance actively collaborates with law enforcement agencies worldwide &#8211; this includes identifying funds connected to criminal activities to help thwart bad actors,” a spokesperson from <a href="http://blockworks.co/tag/binance">Binance</a> told Blockworks.&nbsp;



People in the US have been blocked from using Binance since 2019. Some residents, including those in New York, Texas and Vermont, are still unable to access Binance.US, the exchange’s American affiliate.&nbsp;



Binance claims to enforce global know-your-customer (<a href="https://blockworks.co/tag/kyc">KYC</a>) policies and restricts access for anyone identified as a US citizen, irrespective of their actual location. Additionally, it says that devices connected via US cellular providers or with US IP addresses are blocked. The exchange also does not allow withdrawals or deposits from US banks and credit card companies.



“We implement industry-leading controls to prevent people in the US from accessing services on Binance.com. We take pride in being a responsible member of the cryptocurrency community and are committed to playing our role in combating crimes that victimize cryptocurrency users globally,” the spokesperson added.&nbsp;



Crypto investors and Binance fans have found ways around the ban and efforts to block US persons. Users have taken to sites like <a href="https://www.reddit.com/r/binance/comments/km1590/using_binance_in_america/">Reddit</a> to share <a href="https://crypticjungle.medium.com/how-to-access-binance-using-a-vpn-e3da18fb382b">tips</a> for bypassing geographic blocks, such as using a virtual private network (VPN), to conceal their IP address.&nbsp;



The <a href="https://blockworks.co/tag/fbi">FBI</a> declined to comment on the seizures or its relationship with Binance.&nbsp;



The FBI also seized crypto assets from accounts on other exchanges in May, FBI public notices show. Around $30,000 was seized from accounts on <a href="https://blockworks.co/tag/bybit">Bybit</a> and $16,000 from Freewallet users.&nbsp;







<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

FBI seized almost $400,000 from Binance account users in May

David Canellis

It’s the heat of a bitcoin bull market and you’ve just been phished for all your crypto.



If you’re anything like Colorado resident Andrew Schober, you’d turn to Reddit.



Back in 2018, Schober unknowingly downloaded a compromised iteration of the Electrum bitcoin <a href="https://blockworks.co/news/what-is-a-crypto-wallet">wallet</a> he’d found on the /r/BitcoinAirdrops subreddit.



Buried inside the phony wallet was malware: a clipboard hijacker designed specifically to phish bitcoin.&nbsp;



The malware would take any outbound Bitcoin address on Schober’s machine and mimic it, replacing the intended recipient address with one controlled by the hacker.&nbsp;



Schober, who’d been slowly acquiring bitcoin since 2014, ended up losing 16.5 <a href="https://blockworks.co/price/btc">BTC</a> ($487,000) sent via the dodgy software — 95% of his net worth.



The bitcoin was valued at $180,000 when he was phished, but $1.1 million at bitcoin’s all-time high in 2021. Schober considered it “life-changing money.”&nbsp;



“I came across a link to the malware on Reddit and installed it on my PC and realized pretty quickly that it wasn&#8217;t doing what it was advertised to do,” Schober told Blockworks. “So I just deleted it off my PC and didn&#8217;t think about it anymore.”



“But unfortunately, once that Trojan is installed on your hard drive, deleting the original source program doesn&#8217;t get rid of the Trojan. So from that point forward, it was monitoring my hard drive for any time I copied a Bitcoin address.”



The malware was pre-coded with 195,112 different BTC addresses. “It doesn&#8217;t just change the Bitcoin address to some random new address,” Schober explained. “It matches the first few characters of the address you copied. So it looks pretty visually similar and if you&#8217;re not really paying attention, you won&#8217;t catch the difference and that&#8217;s what happened to me.”



Four of those addresses ended up receiving BTC from unknowing victims around the time of Schober’s attack, which considerably narrowed his scope.



<h2 class="wp-block-heading">Tracing stolen bitcoin through Monero</h2>



The beauty of the blockchain is in its open ledger. Almost all crypto transactions leave breadcrumbs that form a digital paper trail.&nbsp;



Most often, following that trail involves stepping through transfers to track where coins end up. But for anonymity-focused Monero, secondary data such as IP addresses, social media activity and even protected crypto exchange data helps link transactions beyond a reasonable doubt.



In Schober’s case, he’d traced bitcoin that had been stolen by the same malware to <a href="https://blockworks.co/news/shapeshift-dao-releases-decentralized-mobile-app">ShapeShift</a>, the long-serving platform for atomically swapping between cryptocurrencies.&nbsp;



ShapeShift, for a time, maintained an API that shared addresses involved in its swaps. The API data showed Schober’s attacker had swapped <a href="https://blockworks.co/price/btc">BTC</a> for XMR, as well as the addresses used.



So, Schober <a href="https://www.reddit.com/r/Monero/comments/cugjd6/deleted_by_user/">posted</a> on Reddit, asking if it were possible to trace <a href="https://blockworks.co/tag/monero">Monero</a> transactions. Nick Bax, an on-chain investigator and asset recovery specialist, answered the call.



“He got like five replies that were like: ‘No, that&#8217;s impossible.’ I sent him a direct message that said: ‘This is really hard to do. But I’ve done it before. And I know one lawyer who managed to get funds recovered once,’” Bax told Blockworks.



Bax ended up submitting on-chain evidence identifying the hacker as part of Schober’s lawsuit filed in May 2021 — more than two years ago. Part of that process involved analyzing Monero transactions to determine, with high confidence, the provenance of XMR featured in attempts to launder Schober’s stolen BTC.



<figure class="wp-block-image"><img decoding="async" src="https://lh3.googleusercontent.com/E7KCToWJVUJi-Y2BQM1zv0m8EhG91OQ4n7Kpzj2U0PpYn0FmHFJeXVPoWM_sJk2Ut06ysvedBjCXjG6x0p2KHi5mAc3UuYMZ0egKQqoC4QQDRSk04Q__S9EsGz7J2zeNJxYlIAhCt8bRUQlcmEfBNhg" alt=""/><figcaption class="wp-element-caption">ShapeShift’s API made tracking the stolen BTC a cinch | Source: <a href="https://medium.com/@nbax/anatomy-of-a-bitcoin-heist-the-electrum-atom-malware-saga-1685abf7c903">Nick Bax</a></figcaption></figure>



He coded the Monero-tracing software himself. “You flag an output [strings that instruct the Monero blockchain where to direct transactions] and look for every transaction that could possibly have spent that flagged output. When you do that, patterns start to emerge.”



This <a href="https://medium.com/@nbax/tracing-the-wannacry-2-0-monero-transactions-d8c1e5129dc1">method</a> of cracking Monero ring signatures — now known as an <a href="https://www.youtube.com/watch?v=iABIcsDJKyM">Eve-Alice-Eve</a> (EAE) attack — popped up in the fallout of the prolific North Korea-fueled ransomware campaign <a href="https://www.csoonline.com/article/563017/wannacry-explained-a-perfect-ransomware-storm.html">WannaCry</a> that started in 2017.



“Monero’s RingCT…hides the exact <a href="https://www.youtube.com/watch?v=ZCsakXHiwlw">UTXO</a> being spent, but does provide blockchain analysts with a list of plausible ‘ring members,’ one of which is being spent and the remainder of which are ‘decoys,’” Bax wrote in a <a href="https://medium.com/@nbax/anatomy-of-a-bitcoin-heist-the-electrum-atom-malware-saga-1685abf7c903">blog</a> unpacking his investigation.&nbsp;



A now-patched bug in Monero may have made separating real UTXOs from the decoys — and thus tracing the transactions — easier at the time.



<h2 class="wp-block-heading">A brilliant idea: Subpoena the FBI&nbsp;</h2>



Bax determined that Schober’s alleged hacker had converted some BTC stolen from another victim to XMR through ShapeShift, before sending it back through the protocol to transform it into BTC once more.&nbsp;



The washed BTC was directed to what’s known as a “<a href="https://en.bitcoin.it/wiki/Vanitygen">vanity address</a>” that started with “1BeNEdict.”&nbsp;



As for Schober’s bitcoin, that ended up on Bitfinex. Crypto exchange hot wallets are effectively black boxes, as their balances represent pooled customer funds.&nbsp;



Once crypto goes into a hot wallet, it’s almost impossible to determine where they’re withdrawn to unless the amounts are identical and uncommon — and even that proof is not definitive.



That’s where Schober and Bax’s investigation sat for more than a year. Stuck. Schober had subpoenaed Bitfinex to disclose the owner of the accounts which received the pilfered BTC, but he was stonewalled.



&#8220;Bitfinex will only respond to law enforcement requests for customer information, not civil requests, because Bitfinex does not get involved in civil matters, in particular in the United States since US courts do not have jurisdiction over us,” Sarah Compani, Bitfinex legal adviser, told Schober’s lawyer Ethan Mora via email in response.



“The reason that some of these crypto exchanges like FTX and Bitfinex incorporate in the British Virgin Islands or the Caymans is for those legal reasons, where they don&#8217;t necessarily have to abide by US law, or any other law,” Schober said.



“They can just be down there and be kind of extrajudicial. They didn&#8217;t even really give us an answer.”&nbsp;



Blockworks has reached out to Bitfinex for comment.



With no way into Bitfinex directly, Mora initiated what’s known as a <a href="https://www.vba.org/blogpost/1352780/365115/Getting-Documents-and-Testimony-from-the-United-States-When-it-is-Not-a-Party-to-the-Case">Touhy request</a> to the Cyber Division of the FBI — demanding documents and other information related to the agency’s own investigations into the malware. Schober had reported the hack to the FBI just after he lost the bitcoin.



“The FBI started to issue subpoenas to companies that were involved in the malware, like Reddit [where it was posted] and GitHub, which was hosting it,” Schober said. The subpoenas happened in late 2018, early 2019. The FBI had even seized his computer for a few months as part of their investigation.



It took around 10 months, but the Touhy request worked. Suddenly, Schober’s team had internal Bitfinex data pointing to the exact IP and email addresses tied to the accounts which had received his stolen bitcoin.



“We really had no idea what the FBI investigation had uncovered until we got the response from the DOJ regarding the Touhy questions,” Mora said.



<h2 class="wp-block-heading">Vanity address comes back to bite</h2>



Thanks to the FBI subpoena, Schober’s team could identify the hacker’s accounts across a suite of online services: Gmail, Keybase, Reddit, Twitter and Github. Code necessary for the malware was found on the alleged hacker’s public GitHub repository, including the BTC address generator on which it hinged.



The 1BeNedict address used to launder stolen BTC through ShapeShift was also verified by some of those accounts — which Bax cited as proof of the hacker’s identity (the vanity address matched his first name).&nbsp;



A return address lodged with ShapeShift by the attacker during the apparent laundering process, where the protocol would send crypto in the case of transaction issues, was identical to the Bitfinex hot wallets which had received BTC stolen from Schober.



There was even a post on the bitcoin-dev mailing list, sent from an email address matching the alleged hacker’s real name, which described how easy it was to generate Bitcoin addresses with a striking resemblance to ones provided. The post matched the Electrum malware’s modus operandi to a tee.



After running enough diagnostics, Bax found that “every bitcoin transaction sent by the Electrum Atom malware operator went to a destination address that was linked” to the alleged hacker that had been investigated by the FBI. Addresses tied to the malware had received 17 BTC ($501,000) in total — 97% of it Schober’s. He was able to get in touch with another victim via long-running Bitcoin forum BitcoinTalk.



<figure class="wp-block-embed is-type-wp-embed is-provider-flourish wp-block-embed-flourish"><div class="wp-block-embed__wrapper">
<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" title="Interactive or visual content" src="https://flo.uri.sh/visualisation/14564410/embed#?secret=10ss4ahhxe" data-secret="10ss4ahhxe" frameborder="0" scrolling="no" height="575" width="700"></iframe>
</div><figcaption class="wp-element-caption">Bitcoin has been through an entire bull cycle since Schober’s phishing incident | Chart by David Canellis</figcaption></figure>



All this meant Schober could lodge a civil lawsuit against the suspected perpetrator — along with another individual who’d allegedly peddled the same malware on Reddit. Both were underage at the time of the heist, so the suit also named their parents. All parties deny any wrongdoing.



That was in May 2021, more than three years after Schober was phished for his BTC. The price of bitcoin had more than doubled in that time.



Complicating matters is that the alleged hacker lives in the UK. The FBI referred the case to UK law enforcement, leading to a joint investigation. Both suspects were arrested, interrogated and had their devices seized and forensically searched, Schober said.



But before their arrest, desperation (and perhaps a touch of naivety) meant Schober contacted them and their parents to let them know they’d been identified. “I hoped they would come clean and just return it to me because all I was doing was asking them to return what was stolen, and they didn’t do it,” Schober said.



“The UK Crown Prosecution Service ended up telling me that after I contacted them, they likely destroyed their devices because they had entirely new devices and there wasn&#8217;t enough forensic evidence for them to warrant pressing charges.”



(Bax said he would have done the exact same thing as Schober did — they figured the parents were probably decent people on account they worked at a bank and at the UK National Health Service. &#8220;They should just give the money back and I&#8217;d think it all goes away.”)



Schober’s civil suit is now potentially his one-and-only shot at justice. But the case is moving slowly, with lawyers arguing over in which jurisdiction a trial should take place.&nbsp;



Lawyers for the alleged hacker say the suit should be dismissed because Schober, based in the US, doesn’t have jurisdiction over someone in the UK. They also argue that the statute of limitations has expired for him to file a complaint.



“But that&#8217;s not true from our perspective because it took so much time and effort and investigation to even identify that it was a human being that was on the other end of this,” Schober said.&nbsp;



He feels he shouldn’t be punished by the statute of limitations argument, considering he was forced to wait 10 months for an FBI subpoena after being stonewalled by Bitfinex over critical information to his case.



<h2 class="wp-block-heading">An unprecedented case&nbsp;</h2>



Schober’s situation could really be the first of its kind, as it stretches across the pond.



“There aren&#8217;t many cases like this one, in fact, I&#8217;m not aware of any cases where an individual has ever tracked down, properly served (under international law), and sued hackers like this&#8230; let alone hackers who stole cryptocurrency,” Mora said.



“I was involved in some cases here in California where some individual plaintiffs sued some domestic scammers/hackers from other US states, but those defendants had been arrested in the US.”



Mora highlighted cases in which the government brought criminal charges against blackhats foreign and domestic, as well as instances where tech giants like Amazon and Google sued their hackers, some of which demand ransoms in crypto.&nbsp;



Schober is anything but a multinational conglomerate — a typical guy, unlike some <a href="https://blockworks.co/news/att-crypto-sim-swap-lawsuit">high-profile wealthy victims</a> of crypto theft that have brought cases against their attackers.&nbsp;



“I believe this case is unprecedented in a number of ways…there&#8217;s no telling how long this case could be going on,” Mora said.



<figure class="wp-block-image"><img decoding="async" src="https://lh4.googleusercontent.com/nzXV5xYnx7JmxE_wFsdM7Lx5Y6wK6ySPrdSWTRoh_nc9PBQU8tMpFD2rKww5SJt1zLt-tyL-nvOzYUg3kucS50jrH3rS68ydGnCSP75q7ILpqoqCZ9rPaTJM_Wglv7Cpbx5oME8h6qlHdKzXaheppaA" alt=""/><figcaption class="wp-element-caption">GitHub couldn’t let Schober know if law enforcement had investigated, making the Touhy request a gamble that paid off</figcaption></figure>



Exactly how it might be resolved is really anyone’s guess. If a US court rules that the hacker owes Schober, then an English court would still need to recognize that ruling before it can enforce the judgment in the UK. Eventually, it could even come down to debt collection, liens or even wage garnishment.&nbsp;



Schober said they’d been able to trace a sizable amount of bitcoin sitting in addresses gleaned from the FBI subpoena, so it appears the alleged hackers do have funds to pay Schober back.&nbsp;



The situation is especially frustrating considering it seems Schober knows exactly who stole his crypto.



Still, Schober is pro-Bitcoin, despite everything that’s happened, legal fees and the half-million dollars in bitcoin lost. “I still love the promise of Bitcoin. That was what got me into it in the first place. But certainly, my early mover advantage has been erased, which is painful.”



“So it hurts but I&#8217;m still positive about it at this point. And I&#8217;m proud of the fact that I&#8217;ve been able to take this case to the point where it&#8217;s at now, because the odds against it were very, very slim.”&nbsp;



He’s optimistic that US courts will see that he’s a victim of theft. Had the alleged attackers been based in Russia or North Korea, for example, he&#8217;d hardly have any recourse.



“It’s been five years and I&#8217;m ready to move on from this as soon as possible,” Schober said. “But on the other hand, I&#8217;ve really put in so much effort and time and have people like Bax, and others, that are in my corner because they&#8217;ve heard the story and they think it&#8217;s kind of remarkable.”



“So I&#8217;m resolved to see it through to the end.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

What would you do if a hacker stole all your bitcoin?

James Cirrone

The FBI searched the Potomac, Maryland home of former FTX executive Ryan Salame at around 7 am on Thursday, the New York Times reported. 



Information on what the FBI was attempting to uncover at Salame’s $4 million home is not currently available.



Blockworks reached out to Salame’s lawyer, Jason Linder, but did not receive an immediate response.



Salame was co-chief executive of FTX Digital Markets, which principally operated in the Bahamas before the crypto exchange <a href="https://blockworks.co/news/ftx-bankrupt-hacked-investigated-a-timeline-of-events">went bankrupt in November 2022</a>. He also worked at Alameda Research and became a member of Sam Bankman-Fried’s inner circle along with Gary Wang and Caroline Ellison.&nbsp;



The Times also reported that Salame’s $24 million in political contributions in the 2022 midterm elections are being scrutinized by federal authorities. And unlike SBF’s $40 million in donations to mostly Democrats, Salame was a <a href="https://blockworks.co/news/the-gop-also-got-millions-from-ftx-execs">major contributor to Republican politicians and causes</a>. The majority of the $90 million FTX employees donated to politicians were inappropriately taken from customer funds, the Times reported. 



This most recent escalation by the FBI seemingly demonstrates that authorities are not done <a href="https://blockworks.co/news/ftx-bankrupt-hacked-investigated-a-timeline-of-events">investigating the still-unraveling FTX</a> and the individuals who led the exchange to its demise.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

FBI Searches Home of Former FTX Exec Ryan Salame

<div id="highlights-block_630ddd07f71d7" class="highlights">
 <ul>
 <li>The FBI has detailed various DeFi hacks and exploits faced by the cryptocurrency industry over the past year</li>
 <li>Due diligence has been urged to ensure investors understand protocols and verify code audits have taken place</li>
 </ul>
 
</div>



Criminals are ramping up efforts to exploit DeFi (decentralized finance) vulnerabilities to steal crypto, the US Federal Bureau of Investigation (FBI) has warned.



The agency said it has noticed a rise in smart contract hacks and is urging investors who’ve fallen victim to related theft to reach out.



“Cyber criminals seek to take advantage of investors’ increased interest in cryptocurrencies, as well as the complexity of cross-chain functionality and open source nature of DeFi platforms,” the agency said in a <a href="https://www.ic3.gov/Media/Y2022/PSA220829" target="_blank" rel="noreferrer noopener">statement</a>.



More than $1.8 billion in digital assets were <a href="https://cms.blockworks.co/defi-exploits-top-1-8b-ytd-though-security-getting-better-immunefi-says/" target="_blank" rel="noreferrer noopener">stolen</a> from DeFi protocols in this year’s first quarter alone — an almost eightfold increase from 2021’s equivalent period.



The FBI made note of several attack vectors specific to DeFi protocols in the last 12 months, including flash loans, token bridges and oracle price pairs.



Indeed, token bridges in particular have been major targets this year. Harmony’s cross-chain <a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/" target="_blank" rel="noreferrer noopener">Horizon Bridge</a> was hacked for $100 million in June while <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Ronin Network</a>, the Ethereum-linked sidechain for blockchain game Axie Infinity, lost a whopping $625 million three months earlier — the crypto industry’s largest exploit to date.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The <a href="https://twitter.com/hashtag/FBI?src=hash&amp;ref_src=twsrc%5Etfw">#FBI</a> warns that cyber criminals are increasingly exploiting vulnerabilities in decentralized finance (DeFi) platforms to steal investors cryptocurrency. If you think you are the victim of this, contact your local FBI field office or IC3. Learn more: <a href="https://t.co/fboL1N17JN">https://t.co/fboL1N17JN</a> <a href="https://t.co/VKdbpbmEU1">pic.twitter.com/VKdbpbmEU1</a>&mdash; FBI (@FBI) <a href="https://twitter.com/FBI/status/1564337233217273857?ref_src=twsrc%5Etfw">August 29, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Authorities <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">believe</a> North Korean hacking unit Lazarus Group was behind both the Horizon and Ronin bridge incidents. 



Some of the stolen funds were traced to Ethereum-powered crypto mixer <a href="https://cms.blockworks.co/funds-from-100m-horizon-bridge-exploit-sent-to-tornado-cash-mixing-service/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>. Tornado Cash was blacklisted by the US earlier this month, barring citizens from engaging with the protocol — and, technically, even interacting with digital assets that have passed through it.



<h3 class="wp-block-heading">FBI says open source code allows &#8216;unfettered access&#8217; to bad actors</h3>



The FBI laid out four recommendations for crypto investors; precautionary measures to reduce their susceptibility to theft on the blockchain.



Those include the usual caveats of enlisting professional financial advice and undertaking proper research while ensuring their investments have verifiable code audits.



Investors should also be aware of DeFi liquidity pools with “extremely limited timeframes” to join. The FBI also warned of potential risks associated with open source development, on which much of the crypto ecosystem relies.



“Open source code repositories allow unfettered access to all individuals, to include those with nefarious intentions,” the agency said.



It should be noted that several protocols who’ve undergone code audits have fallen victim to exploits outside their control, though security appears to be “getting better,” Immunefi’s CEO Mitchell Amador told Blockworks in an interview in July.



As for the platforms themselves, the FBI advised they should institute real-time analytics and monitoring while continuously testing their code.



Development of an incident response plan to make investors aware of when an exploit has occurred should also be front and center, it said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

FBI Issues Warning Over DeFi Exploits, Open Source Development

<div id="highlights-block_625dcee381ae5" class="highlights">
 <ul>
 <li>The Lazarus Group and APT38 have been named as those responsible for the theft</li>
 <li>Exploiters used hacked private keys to forge withdrawals on March 23, Ronin said</li>
 </ul>
 
</div>



The US Federal Bureau of Investigation has placed &#8220;cyber actors&#8221; from North Korea at the heart of last month&#8217;s $625 million hack on the Ethereum-linked sidechain Ronin Network.



Through an investigation, the agency said it was able to &#8220;confirm&#8221; hacker collectives Lazarus Group and APT38 are responsible for the theft of hundreds of millions of dollars in crypto, a Thursday <a href="https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-attribution-of-malicious-cyber-activity-posed-by-the-democratic-peoples-republic-of-korea" target="_blank" rel="noreferrer noopener">statement</a> reads.



Exploiters, according to Ronin, used <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">hacked private keys</a> to forge withdrawals on March 23. The breach wasn’t discovered until several days later, when a user was unable to withdraw 5,000 ETH.



State-sponsored Lazarus has been accused of multiple digital asset-based hacks, including a year-long endeavor beginning in 2017 in which the group reportedly managed to siphon off <a href="https://thenextweb.com/news/cryptocurrency-attack-report" target="_blank" rel="noreferrer noopener">$571 million</a>.



The Treasury Department last week <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">sanctioned the hacking collective</a> and the Ethereum address allegedly behind the theft.



As part of its efforts to combat blockchain-related crime, the FBI established a new unit last month led by Eun Young Choi, a former senior counsel to the deputy attorney general.



The group, along with APT38, operates at the behest of the Democratic People&#8217;s Republic of Korea (DPRK) under dictator Kim Jong Un. The isolated northern nation on the Korean Peninsula is strangled by economic sanctions and threatened by military encirclement from Western allies over its continued use of nuclear arms.



Cryptocurrency is viewed by some experts as a means to circumvent capital controls and economic sanctions, as well as to hide the wealth of North Korea&#8217;s political elite. It has also been speculated it is one of several mechanisms that fund Kim&#8217;s heavily sanctioned regime.



&#8220;The FBI&#8230;will continue to expose and combat the DPRK’s use of illicit activities – including cybercrime and cryptocurrency theft,&#8221; the statement said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

North Korean Hackers Responsible for Last Month’s Ronin Theft, FBI Confirms

<div id="highlights-block_620ec093bb1f7" class="highlights">
 <ul>
 <li>Federal investigators now have a dedicated division to probe blockchain-based crimes</li>
 <li>The unit&#8217;s formation comes as the Biden administration is expected to issue an executive order on cryptocurrencies as soon as next week</li>
 </ul>
 
</div>



The FBI is ramping up its enforcement efforts when it comes to cryptocurrency crimes.



The Justice Department on Thursday touted a new unit focused on digital asset seizure and blockchain-based lawbreaking. Eun Young Choi, former senior counsel to the Deputy Attorney General, will serve as director of the National Cryptocurrency Enforcement Team (NCET).



“The department has been at the forefront of investigating and prosecuting crimes involving digital currencies since their inception,” Choi said in a <a href="https://www.justice.gov/opa/pr/justice-department-announces-first-director-national-cryptocurrency-enforcement-team" target="_blank" rel="noreferrer noopener">statement</a>. “The NCET will play a pivotal role in ensuring that as the technology surrounding digital assets grows and evolves, the department in turn accelerates and expands its efforts to combat their illicit abuse by criminals of all kinds.”&nbsp;



The NCET will identify and pursue cases involving the criminal use of digital assets, especially when it comes to crypto exchanges and infrastructure companies.&nbsp;&nbsp;



Its formation could bring overdue oversight to the space, according to industry participants.



“As a custodian, we need very powerful cybersecurity,” said Henson Orser, president of cryptocurrency custodian Komainu. “In 2022, we now see more traditional financial institutions looking to come into the space, but they can&#8217;t do that through self-custody, and so they&#8217;re very much welcoming and using regulated instances.”



Additional regulatory scrutiny is only going to be welcomed by traditional financial players dabbling in digital assets, Orser said.



The new unit comes weeks after the Justice Department notched its <a href="https://cms.blockworks.co/couple-arrested-as-government-recovers-3-6b-in-stolen-bitcoin/" target="_blank" rel="noreferrer noopener">largest seizure</a> of financial assets ever, clawing back more than $3.6 billion in bitcoin stolen during a 2016 hack of the exchange Bitfinex.



Though assets and transactions in crypto are traceable on the blockchain, identifying who owns a wallet is more challenging, according to Orser. Investigators were able to pin down the alleged couple in question as they shifted funds around to use them, he added.



“At some point, those publicly viewable wallets have to figure out a way to intersect with NCET-legitimate exchanges and payment mechanisms,” he said. “The more that regulators embrace making sure that the legitimate exchanges and payment apps and platforms have oversight, then the more likely it is they&#8217;re going to catch people at that point of friction.”



NCET is already calling on crypto companies to help root out bad actors.



&#8220;We are issuing a clear warning to criminals who use cryptocurrency to fuel their schemes,&#8221; Deputy Attorney General Lisa Monaco said at the Munich Cyber Security Conference. &#8220;We also call on all companies dealing with cryptocurrency — we need you to root out cryptocurrency abuses. To those who do not, we will hold you accountable where we can.&#8221;



With regulators increasingly on the lookout, crypto professionals may need to be more mindful about their dealings with policymakers and law enforcement.



Andrew Morfill, chief information security officer at Komainu, said the industry’s narrative “needs to mature, especially from a regulatory perspective.”



“Telling people that you&#8217;re the new kid in town and you’re going to revolutionize the industry is probably not the best way to go about influencing and cajoling the regulator that is cautious and has key stakeholders [in] traditional finance,” Morfill said.



The Biden administration, meanwhile, is reportedly planning to issue an executive order on cryptocurrencies as soon as next week in an effort that could add clarity to fragmented past policy.&nbsp;



“I do have a concern about the patchwork quilt of initiatives surrounding this space, with no formal ‘tip of the spear,’” said Michael Fasanello, director of training and regulatory affairs at Blockchain Intelligence Group. “I am cautiously optimistic that the executive branch will issue a mandate providing clarity and guidance for a more uniform approach to oversight of the digital assets ecosystem.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

FBI Doubles Down on Crypto Crimes With New Unit

<div id="highlights-block_fb72f42b604bc4d27d18c3d6af768663" class="highlights">
 <ul>
 <li>The FBI issued a warning to cryptocurrency holders and exchanges about active security threats</li>
 <li>The FBI alert comes shortly after Senator Elizabeth Warren called for increased SEC crypto regulations</li>
 </ul>
 
</div>



The Federal Bureau of Investigation (FBI) issued a warning to cryptocurrency exchanges and digital asset owners about active security threats that may result in loss of assets.&nbsp;



“Cybercriminals are targeting cryptocurrency users, exchanges, and third-party payment platforms in the virtual asset industry, resulting in large amounts of financial loss to victims,” the report read.&nbsp;



The FBI released the alert via the Traffic Light Protocol, a system for distributing sensitive information to selected groups and individuals, on Thursday. The alert was classified as green, which means that alerted parties may share the information with other relevant groups, but the report cannot be distributed through public channels.&nbsp;



Hackers may use techniques including SIM swapping, tech support fraud, and account stealing, the FBI said. SIM swapping is when a hacker uses a victim’s phone number to go around two-factor authentication security and access an account. It is a process that the FBI has warned about in the <a href="https://www.fbi.gov/contact-us/field-offices/sanfrancisco/news/press-releases/fbi-san-francisco-warns-the-public-of-the-dangers-of-sim-swapping">past</a>.&nbsp;



Officials recommended that individuals and groups with crypto holdings keep an eye out for phishing emails and monitor accounts closely. Crypto experts largely agree that hackers pose a significant threat to the industry.&nbsp;



“Once a crypto account is hacked, attackers often use the unique structure, trading and economics of crypto markets to withdraw the funds and make other gains,” said Chen Arad, COO of risk monitoring firm Solidus Labs. “For example, often if hackers can&#8217;t immediately withdraw the funds, they may try to get them out of the account by trading valuable cryptos for less valuable altcoins in another account the hacker owns. Hacked accounts can also be used for market manipulation like wash trading or spoofing.”&nbsp;&nbsp;



As retail and institutional interest in digital assets continues to grow, industry members expect federal organizations to become more involved in regulating the space.&nbsp;



&#8220;The industry-wide warning from the FBI does not come as much of a surprise. As the cryptocurrency market grows and there is more money on the line, the threat from attackers online becomes more prevalent,” said Marcus Sotiriou, sales trader GlobalBlock. “I believe the FBI&#8217;s involvement in the industry will be a net positive, as it will hopefully result in a more secure digital economy and protect more cryptocurrency owners.&#8221;



The FBI alert comes shortly after Senator Elizabeth Warren released a <a href="https://www.warren.senate.gov/imo/media/doc/Draft%20SEC%20Crypto%20Exchange%20Letter%2007.7.2021%20clean.pdf">letter</a> to Securities and Exchange Commission Chairman Gary Gensler about the importance of cryptocurrency market regulation.&nbsp;



“I write to request information regarding the Security and Exchange Commission’s (SEC’s) authority to properly regulate cryptocurrency exchanges and to determine if Congress needs to act to ensure that the SEC has the proper authority to close existing gaps in regulation that leave investors and consumers vulnerable to dangers in this highly opaque and volatile market,” Warren wrote.&nbsp;



Warren claimed that unregulated exchanges leave investors vulnerable to market manipulation and fraud, particularly with decentralized platforms, citing <a href="https://www.cftc.gov/PressRoom/SpeechesTestimony/opaberkovitz7">recent comments</a> made by Commodity Futures Trading Commission (CFTC) Commissioner Dan M. Berkovitz.&nbsp;



“Berkovitz stated: ‘In a pure ‘peer-to-peer’ DeFi system… [t]here is no intermediary to monitor markets for fraud and manipulation, prevent money laundering, safeguard deposited funds, ensure counterparty performance, or make customers whole when processes fail,’” Warren wrote.&nbsp; As investors and industry leaders <a href="https://cms.blockworks.co/sec-postpones-decision-on-valkyrie-bitcoin-etf-to-august/">continue to wait</a> for SEC guidance on crypto, Congress recently heard from crypto industry experts during the <a href="https://cms.blockworks.co/washington-is-divided-on-crypto-hearing-reveals/">“America on FIRE” hearing</a> last month. It was made clear that lawmakers have vastly different thoughts when it comes to determining how to address cryptocurrency regulation.