Sebastian Sinclair

<div id="highlights-block_630ddd07f71d7" class="highlights">
 <ul>
 <li>The FBI has detailed various DeFi hacks and exploits faced by the cryptocurrency industry over the past year</li>
 <li>Due diligence has been urged to ensure investors understand protocols and verify code audits have taken place</li>
 </ul>
 
</div>



Criminals are ramping up efforts to exploit DeFi (decentralized finance) vulnerabilities to steal crypto, the US Federal Bureau of Investigation (FBI) has warned.



The agency said it has noticed a rise in smart contract hacks and is urging investors who’ve fallen victim to related theft to reach out.



“Cyber criminals seek to take advantage of investors’ increased interest in cryptocurrencies, as well as the complexity of cross-chain functionality and open source nature of DeFi platforms,” the agency said in a <a href="https://www.ic3.gov/Media/Y2022/PSA220829" target="_blank" rel="noreferrer noopener">statement</a>.



More than $1.8 billion in digital assets were <a href="https://cms.blockworks.co/defi-exploits-top-1-8b-ytd-though-security-getting-better-immunefi-says/" target="_blank" rel="noreferrer noopener">stolen</a> from DeFi protocols in this year’s first quarter alone — an almost eightfold increase from 2021’s equivalent period.



The FBI made note of several attack vectors specific to DeFi protocols in the last 12 months, including flash loans, token bridges and oracle price pairs.



Indeed, token bridges in particular have been major targets this year. Harmony’s cross-chain <a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/" target="_blank" rel="noreferrer noopener">Horizon Bridge</a> was hacked for $100 million in June while <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Ronin Network</a>, the Ethereum-linked sidechain for blockchain game Axie Infinity, lost a whopping $625 million three months earlier — the crypto industry’s largest exploit to date.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The <a href="https://twitter.com/hashtag/FBI?src=hash&amp;ref_src=twsrc%5Etfw">#FBI</a> warns that cyber criminals are increasingly exploiting vulnerabilities in decentralized finance (DeFi) platforms to steal investors cryptocurrency. If you think you are the victim of this, contact your local FBI field office or IC3. Learn more: <a href="https://t.co/fboL1N17JN">https://t.co/fboL1N17JN</a> <a href="https://t.co/VKdbpbmEU1">pic.twitter.com/VKdbpbmEU1</a>&mdash; FBI (@FBI) <a href="https://twitter.com/FBI/status/1564337233217273857?ref_src=twsrc%5Etfw">August 29, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Authorities <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">believe</a> North Korean hacking unit Lazarus Group was behind both the Horizon and Ronin bridge incidents. 



Some of the stolen funds were traced to Ethereum-powered crypto mixer <a href="https://cms.blockworks.co/funds-from-100m-horizon-bridge-exploit-sent-to-tornado-cash-mixing-service/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>. Tornado Cash was blacklisted by the US earlier this month, barring citizens from engaging with the protocol — and, technically, even interacting with digital assets that have passed through it.



<h3>FBI says open source code allows &#8216;unfettered access&#8217; to bad actors</h3>



The FBI laid out four recommendations for crypto investors; precautionary measures to reduce their susceptibility to theft on the blockchain.



Those include the usual caveats of enlisting professional financial advice and undertaking proper research while ensuring their investments have verifiable code audits.



Investors should also be aware of DeFi liquidity pools with “extremely limited timeframes” to join. The FBI also warned of potential risks associated with open source development, on which much of the crypto ecosystem relies.



“Open source code repositories allow unfettered access to all individuals, to include those with nefarious intentions,” the agency said.



It should be noted that several protocols who’ve undergone code audits have fallen victim to exploits outside their control, though security appears to be “getting better,” Immunefi’s CEO Mitchell Amador told Blockworks in an interview in July.



As for the platforms themselves, the FBI advised they should institute real-time analytics and monitoring while continuously testing their code.



Development of an incident response plan to make investors aware of when an exploit has occurred should also be front and center, it said.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

FBI Issues Warning Over DeFi Exploits, Open Source Development

<div id="highlights-block_625dcee381ae5" class="highlights">
 <ul>
 <li>The Lazarus Group and APT38 have been named as those responsible for the theft</li>
 <li>Exploiters used hacked private keys to forge withdrawals on March 23, Ronin said</li>
 </ul>
 
</div>



The US Federal Bureau of Investigation has placed &#8220;cyber actors&#8221; from North Korea at the heart of last month&#8217;s $625 million hack on the Ethereum-linked sidechain Ronin Network.



Through an investigation, the agency said it was able to &#8220;confirm&#8221; hacker collectives Lazarus Group and APT38 are responsible for the theft of hundreds of millions of dollars in crypto, a Thursday <a href="https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-attribution-of-malicious-cyber-activity-posed-by-the-democratic-peoples-republic-of-korea" target="_blank" rel="noreferrer noopener">statement</a> reads.



Exploiters, according to Ronin, used <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">hacked private keys</a> to forge withdrawals on March 23. The breach wasn’t discovered until several days later, when a user was unable to withdraw 5,000 ETH.



State-sponsored Lazarus has been accused of multiple digital asset-based hacks, including a year-long endeavor beginning in 2017 in which the group reportedly managed to siphon off <a href="https://thenextweb.com/news/cryptocurrency-attack-report" target="_blank" rel="noreferrer noopener">$571 million</a>.



The Treasury Department last week <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">sanctioned the hacking collective</a> and the Ethereum address allegedly behind the theft.



As part of its efforts to combat blockchain-related crime, the FBI established a new unit last month led by Eun Young Choi, a former senior counsel to the deputy attorney general.



The group, along with APT38, operates at the behest of the Democratic People&#8217;s Republic of Korea (DPRK) under dictator Kim Jong Un. The isolated northern nation on the Korean Peninsula is strangled by economic sanctions and threatened by military encirclement from Western allies over its continued use of nuclear arms.



Cryptocurrency is viewed by some experts as a means to circumvent capital controls and economic sanctions, as well as to hide the wealth of North Korea&#8217;s political elite. It has also been speculated it is one of several mechanisms that fund Kim&#8217;s heavily sanctioned regime.



&#8220;The FBI&#8230;will continue to expose and combat the DPRK’s use of illicit activities – including cybercrime and cryptocurrency theft,&#8221; the statement said.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

North Korean Hackers Responsible for Last Month’s Ronin Theft, FBI Confirms

Casey Wagner

<div id="highlights-block_620ec093bb1f7" class="highlights">
 <ul>
 <li>Federal investigators now have a dedicated division to probe blockchain-based crimes</li>
 <li>The unit&#8217;s formation comes as the Biden administration is expected to issue an executive order on cryptocurrencies as soon as next week</li>
 </ul>
 
</div>



The FBI is ramping up its enforcement efforts when it comes to cryptocurrency crimes.



The Justice Department on Thursday touted a new unit focused on digital asset seizure and blockchain-based lawbreaking. Eun Young Choi, former senior counsel to the Deputy Attorney General, will serve as director of the National Cryptocurrency Enforcement Team (NCET).



“The department has been at the forefront of investigating and prosecuting crimes involving digital currencies since their inception,” Choi said in a <a href="https://www.justice.gov/opa/pr/justice-department-announces-first-director-national-cryptocurrency-enforcement-team" target="_blank" rel="noreferrer noopener">statement</a>. “The NCET will play a pivotal role in ensuring that as the technology surrounding digital assets grows and evolves, the department in turn accelerates and expands its efforts to combat their illicit abuse by criminals of all kinds.”&nbsp;



The NCET will identify and pursue cases involving the criminal use of digital assets, especially when it comes to crypto exchanges and infrastructure companies.&nbsp;&nbsp;



Its formation could bring overdue oversight to the space, according to industry participants.



“As a custodian, we need very powerful cybersecurity,” said Henson Orser, president of cryptocurrency custodian Komainu. “In 2022, we now see more traditional financial institutions looking to come into the space, but they can&#8217;t do that through self-custody, and so they&#8217;re very much welcoming and using regulated instances.”



Additional regulatory scrutiny is only going to be welcomed by traditional financial players dabbling in digital assets, Orser said.



The new unit comes weeks after the Justice Department notched its <a href="https://cms.blockworks.co/couple-arrested-as-government-recovers-3-6b-in-stolen-bitcoin/" target="_blank" rel="noreferrer noopener">largest seizure</a> of financial assets ever, clawing back more than $3.6 billion in bitcoin stolen during a 2016 hack of the exchange Bitfinex.



Though assets and transactions in crypto are traceable on the blockchain, identifying who owns a wallet is more challenging, according to Orser. Investigators were able to pin down the alleged couple in question as they shifted funds around to use them, he added.



“At some point, those publicly viewable wallets have to figure out a way to intersect with NCET-legitimate exchanges and payment mechanisms,” he said. “The more that regulators embrace making sure that the legitimate exchanges and payment apps and platforms have oversight, then the more likely it is they&#8217;re going to catch people at that point of friction.”



NCET is already calling on crypto companies to help root out bad actors.



&#8220;We are issuing a clear warning to criminals who use cryptocurrency to fuel their schemes,&#8221; Deputy Attorney General Lisa Monaco said at the Munich Cyber Security Conference. &#8220;We also call on all companies dealing with cryptocurrency — we need you to root out cryptocurrency abuses. To those who do not, we will hold you accountable where we can.&#8221;



With regulators increasingly on the lookout, crypto professionals may need to be more mindful about their dealings with policymakers and law enforcement.



Andrew Morfill, chief information security officer at Komainu, said the industry’s narrative “needs to mature, especially from a regulatory perspective.”



“Telling people that you&#8217;re the new kid in town and you’re going to revolutionize the industry is probably not the best way to go about influencing and cajoling the regulator that is cautious and has key stakeholders [in] traditional finance,” Morfill said.



The Biden administration, meanwhile, is reportedly planning to issue an executive order on cryptocurrencies as soon as next week in an effort that could add clarity to fragmented past policy.&nbsp;



“I do have a concern about the patchwork quilt of initiatives surrounding this space, with no formal ‘tip of the spear,’” said Michael Fasanello, director of training and regulatory affairs at Blockchain Intelligence Group. “I am cautiously optimistic that the executive branch will issue a mandate providing clarity and guidance for a more uniform approach to oversight of the digital assets ecosystem.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

FBI Doubles Down on Crypto Crimes With New Unit

<div id="highlights-block_fb72f42b604bc4d27d18c3d6af768663" class="highlights">
 <ul>
 <li>The FBI issued a warning to cryptocurrency holders and exchanges about active security threats</li>
 <li>The FBI alert comes shortly after Senator Elizabeth Warren called for increased SEC crypto regulations</li>
 </ul>
 
</div>



The Federal Bureau of Investigation (FBI) issued a warning to cryptocurrency exchanges and digital asset owners about active security threats that may result in loss of assets.&nbsp;



“Cybercriminals are targeting cryptocurrency users, exchanges, and third-party payment platforms in the virtual asset industry, resulting in large amounts of financial loss to victims,” the report read.&nbsp;



The FBI released the alert via the Traffic Light Protocol, a system for distributing sensitive information to selected groups and individuals, on Thursday. The alert was classified as green, which means that alerted parties may share the information with other relevant groups, but the report cannot be distributed through public channels.&nbsp;



Hackers may use techniques including SIM swapping, tech support fraud, and account stealing, the FBI said. SIM swapping is when a hacker uses a victim’s phone number to go around two-factor authentication security and access an account. It is a process that the FBI has warned about in the <a href="https://www.fbi.gov/contact-us/field-offices/sanfrancisco/news/press-releases/fbi-san-francisco-warns-the-public-of-the-dangers-of-sim-swapping">past</a>.&nbsp;



Officials recommended that individuals and groups with crypto holdings keep an eye out for phishing emails and monitor accounts closely. Crypto experts largely agree that hackers pose a significant threat to the industry.&nbsp;



“Once a crypto account is hacked, attackers often use the unique structure, trading and economics of crypto markets to withdraw the funds and make other gains,” said Chen Arad, COO of risk monitoring firm Solidus Labs. “For example, often if hackers can&#8217;t immediately withdraw the funds, they may try to get them out of the account by trading valuable cryptos for less valuable altcoins in another account the hacker owns. Hacked accounts can also be used for market manipulation like wash trading or spoofing.”&nbsp;&nbsp;



As retail and institutional interest in digital assets continues to grow, industry members expect federal organizations to become more involved in regulating the space.&nbsp;



&#8220;The industry-wide warning from the FBI does not come as much of a surprise. As the cryptocurrency market grows and there is more money on the line, the threat from attackers online becomes more prevalent,” said Marcus Sotiriou, sales trader GlobalBlock. “I believe the FBI&#8217;s involvement in the industry will be a net positive, as it will hopefully result in a more secure digital economy and protect more cryptocurrency owners.&#8221;



The FBI alert comes shortly after Senator Elizabeth Warren released a <a href="https://www.warren.senate.gov/imo/media/doc/Draft%20SEC%20Crypto%20Exchange%20Letter%2007.7.2021%20clean.pdf">letter</a> to Securities and Exchange Commission Chairman Gary Gensler about the importance of cryptocurrency market regulation.&nbsp;



“I write to request information regarding the Security and Exchange Commission’s (SEC’s) authority to properly regulate cryptocurrency exchanges and to determine if Congress needs to act to ensure that the SEC has the proper authority to close existing gaps in regulation that leave investors and consumers vulnerable to dangers in this highly opaque and volatile market,” Warren wrote.&nbsp;



Warren claimed that unregulated exchanges leave investors vulnerable to market manipulation and fraud, particularly with decentralized platforms, citing <a href="https://www.cftc.gov/PressRoom/SpeechesTestimony/opaberkovitz7">recent comments</a> made by Commodity Futures Trading Commission (CFTC) Commissioner Dan M. Berkovitz.&nbsp;



“Berkovitz stated: ‘In a pure ‘peer-to-peer’ DeFi system… [t]here is no intermediary to monitor markets for fraud and manipulation, prevent money laundering, safeguard deposited funds, ensure counterparty performance, or make customers whole when processes fail,’” Warren wrote.&nbsp; As investors and industry leaders <a href="https://cms.blockworks.co/sec-postpones-decision-on-valkyrie-bitcoin-etf-to-august/">continue to wait</a> for SEC guidance on crypto, Congress recently heard from crypto industry experts during the <a href="https://cms.blockworks.co/washington-is-divided-on-crypto-hearing-reveals/">“America on FIRE” hearing</a> last month. It was made clear that lawmakers have vastly different thoughts when it comes to determining how to address cryptocurrency regulation.