Bessie Liu

The first week of 2024 already has DeFi users on edge after three security incidents in five days.



Over the new year, South Korean cross-chain bridging project Orbit Chain lost <a href="https://blockworks.co/news/80-million-lost-orbit-bridge">$80 million</a> in assets to hackers who’d raided the protocol’s multi-signature wallet.



The team says it’s now working with domestic and international law enforcement to determine the next steps and ways to execute a viable recovery plan.



On Monday — two days after the Orbit attack — cross-chain money market Radiant Capital lost an estimated $4.5 million in a flash loan attack.&nbsp;



A bad actor had manipulated the liquidity index of a freshly created native USDC market on Arbitrum to rapidly siphon crypto from the protocol, leading to pauses in lending and borrowing activities through Radiant.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Today&#39;s hack on <a href="https://twitter.com/RDNTCapital?ref_src=twsrc%5Etfw">@RDNTCapital</a> results in the loss of 1.9k eth (~$4.5m). The root cause is not new: It basically exploits a time window when a new market is activated in a lending market (forked from the popular Compound/Aave). The exploitation also relies on a known rounding… <a href="https://t.co/XogWUVO3po">https://t.co/XogWUVO3po</a> <a href="https://t.co/x5X9ql8AGA">pic.twitter.com/x5X9ql8AGA</a>&mdash; PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1742334242120466580?ref_src=twsrc%5Etfw">January 2, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The attack left Radiant Capital with bad debt and the team says it has since taken steps to re-capitalize. The hope is that users could regain access to their deposits. 



Next up was liquidity management platform Gamma Strategies, where an estimated $3.4 million was lost on Thursday. The attacker manipulated Gamma’s accounting mechanisms to mint an excess of liquidity provider tokens, which allowed them to illegitimately withdraw more than 1,300 ETH.&nbsp;



Gamma has since shut off deposits on public-facing vaults to prevent further attacks.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The main issue is with the settings we placed on (2) the price change threshold. It was placed too high allowing for up 50-200% price change on certain LST and stablecoin vaults. This allowed the attacker to manipulate the price up to the price change threshold and mint a…&mdash; Gamma (@GammaStrategies) <a href="https://twitter.com/GammaStrategies/status/1742882843607416860?ref_src=twsrc%5Etfw">January 4, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Continued exploits across DeFi have left some concerned about the future of the space. 



“DeFi really needs to wake up,” Paul Frambot, CEO of software research and development company Morpho Labs <a href="https://twitter.com/PaulFrambot/status/1742822921507049645?s=20">posted</a> on X. “It has been seven years, yet every week, new large-scale hacks, incidents freezing platforms, economic attacks.&#8221;



&#8220;We are missing orders of magnitude. We need to change the current paradigm.&#8221;



This sentiment is shared by Phillip Shoemaker, executive director of Identity.com, a non-profit organization providing decentralized identity verification.&nbsp;



“Security audits are critical for this industry, including for smart contracts and data storage. But I don’t think there’s nearly enough security audits happening in the digital asset space as a whole,” Shoemaker told Blockworks.



He noted that the blockchain space needs to be doing “much, much more in this regard.”



“I think these hacks and various breaches are pushing a lot of people away from engaging with the industry – people just don’t know what’s secure and what’s not. This is something that we as an industry really need to address more thoroughly,” Shoemaker said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

DeFi hackers ring in New Year with 3 attacks in 5 days

Sebastian Sinclair

One week since Curve Finance&#8217;s $70 million exploit and almost three-quarters of the stolen funds have been returned. But the crypto community remains on high alert.&nbsp;



In response, Sam (@samczsun), research partner and head of security at Paradigm, has announced a collaborative initiative with white hat hackers, auditors and security leaders.



Together they aim to solve disclosure in cybersecurity, particularly as a means for those seeking to quickly avert potentially hundreds of millions of dollars in DeFi hacks and exploits.



&#8220;The hardest part of responsible disclosure is finding the right person to talk to,&#8221; Sam <a href="https://twitter.com/samczsun/status/1688613385565528064?s=20" target="_blank" rel="noreferrer noopener">tweeted</a> Tuesday, sharing insights into the effort. 



The solution: SEAL 911, a Telegram bot that provides a streamlined contact platform with vetted <a href="https://gist.github.com/samczsun/366b853a54391a97ab13cd2e3ca2d7c9" target="_blank" rel="noreferrer noopener">security professionals</a>.  The hope is that the channel will rapidly gain widespread attention and support, not only from the broader community but also from security experts and organizations. 



Members include representatives from Wallet Guard, Origin Protocol, ChainSecurity, MetaMask, and more, all committing to lend their expertise during emergencies.&nbsp;



The initiative aligns with recent hacks that have rocked the DeFi sector. Curve Finance&#8217;s exploit, caused by a reentrancy lock malfunction, resulted in CRV&#8217;s price dropping from $0.73 to $0.49 in 48 hours.&nbsp;



Euler Finance&#8217;s $200 million loss in March, <a href="https://blockworks.co/news/euler-exploiter-returns-money">and subsequent recovery</a>, has contributed to more than <a href="https://twitter.com/BeosinAlert/status/1674618821766971392?s=20" target="_blank" rel="noreferrer noopener">$800 million</a> in industry losses this year, a stark <a href="https://twitter.com/BeosinAlert/status/1674618824640040961?s=20" target="_blank" rel="noreferrer noopener">improvement</a> over 2022.



Between January 2022 and November 2022, hackers stole $4.3 billion worth of crypto, marking a 37% increase compared to the same period in 2021, Blockworks <a href="https://blockworks.co/news/crypto-hacks-2022">previously reported</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

DeFi gets a ‘SEAL’ team as white hat hackers, auditors join forces

Andrew Thurman

In what has been touted as a historic first, attorneys for the Southern District of New York revealed on Tuesday, July 11, the filing of charges against Shakeeb Ahmed. The SDNY alleges that Ahmed embezzled $9 million from a DeFi protocol based on Solana back in July 2022.



A <a href="https://twitter.com/SDNYnews/status/1678780204062490626">tweet</a> from the official SDNY account claimed the charges represented the “first-ever criminal case involving an attack on a smart contract.” Additionally, in a press <a href="https://www.justice.gov/usao-sdny/pr/former-security-engineer-international-technology-company-arrested-defrauding">release</a> IRS-CI Special Agent Tyler Hatcher bragged about the sophistication of the investigation, saying Ahmed’s “skills were no match for IRS Criminal Investigation&#8217;s Cyber Crimes Unit.”



However, blockchain analysis shows that a number of possible missteps from the hacker indicates that the SDNY may have had an easier time apprehending the hacker than their PR tour implies.&nbsp;



On July 2, 2022, a hacker was able to take $9 million in a flash loan exploit on Solana’s Crema Finance, a decentralized exchange. After a period of negotiations, the hacker returned the majority of the funds on July 7. As part of the arrangement — which is not uncommon between teams and hackers — the attacker was allowed to retain ownership of assets valued at $1.6 million as a “bounty.”



While the SDNY did not specify in either the announcement or the criminal complaint which protocol was the target of the exploit, the dates, method of attack, and both the amounts stolen and the amounts eventually returned point to Crema.&nbsp;



Multiple Crema developers did not respond to requests for comment. In an official Telegram channel, a team member said the team was “still investigating” whether or not the project would be able to recover the remaining funds potentially seized by law enforcement from Ahmed, implicitly confirming Crema as the unnamed protocol.&nbsp;



The exploiter later attempted to launder the remaining funds using a variety of privacy-preserving tools, including Tornado Cash and Monero — tools that the SDNY now claim to have rendered ineffective.&nbsp;



<h2 class="wp-block-heading">Advanced analytics</h2>



The announcement of charges was notable in part for the expeditiousness of the investigation. The SDNY missed a one-year turnaround time from the end of negotiations between Crema and the exploiter by just a matter of days, far cry from the three-to-four-year turnaround the SEC took to pursue certain 2017-era ICO scams.



Aside from speed, however, the SDNY’s PR materials notably hung their hat on the analytical expertise of the investigation.&nbsp;



In a video accompanying the announcement of charges, SDNY Attorney Damian Williams boasted about the district’s ability to track Ahmed’s movements across blockchains:



“We also allege that he then laundered the stolen funds through a series of complex transfers on the blockchain where he swapped cryptocurrencies, hopped across different crypto blockchains, and used overseas crypto exchanges.&nbsp; But none of those actions covered the defendant’s tracks or fooled law enforcement, and they certainly didn’t stop my Office or our law enforcement partners from following the money.”



While anyone with access to a block explorer can track movements between addresses and often even between different blockchains with minimal expertise, according to forensics consulting firm Five I’s founder Nick Bax, the Monero tracking would require genuine investigative chops.&nbsp;



Monero, a blockchain built to enable privacy-preserving transactions, allows for “probabilistic” inferences that can theoretically allow investigators to track funds, but in practice, tracing these transactions is often complex.&nbsp;



As an example Bax pointed to Daube v. United States, another case that involved tracing Monero transactions. In that instance, investigators required additional identifying data to bolster their Monero-based work.&nbsp;



“Normally an investigator will need internal data from centralized services such as exchanges to learn more information about who received the Monero being spent on-chain,” Bax said.&nbsp;



<h2 class="wp-block-heading">On-ramps and off-ramps</h2>



Given the complexity of tracking the funds through Monero, it’s much more likely that the SDNY managed to catch Ahmed during on-ramping (converting fiat to crypto) rather than off-ramping (selling Monero for fiat to complete the laundering process).&nbsp;



Indeed, blockchain analysis from Blockworks, as well as multiple analysts at the time of the exploit, indicates that Ahmed may have made key blunders while funding the wallets from which he launched his attack.&nbsp;



First, <a href="https://solanafm.notion.site/solanafm/Crema-Finance-Exploit-Coverage-00e91e80cddc493786c2b0cc8f1d912a">analysis</a> from SolanaFM at the time of the attack found that the attacker interacted with either Huobi exchange <a href="https://solana.fm/tx/2rr8dnW4CFkprCsMgLC7CXhsvwuWtYERRVRPC8G1Tf6LyGRg4PRSTLvDoRNH2RNefUwtWvaGUM43hrhZEjkDwRMA?cluster=mainnet-qn1">addresses</a>, or nested exchange addresses associated with Huobi.&nbsp;



Additionally, just days after the exploit, pseudonymous on-chain analyst ZachXBT called <a href="https://twitter.com/zachxbt/status/1544797170762760192">attention</a> to a pair of suspiciously-timed Tornado Cash transactions, leading to <a href="https://etherscan.io/address/0x6bbc4f266cbddcd5551a9bb5b8b7fd61f9eecca6">addresses</a> linked to the attack.&nbsp;



Tornado Cash, a privacy-preserving protocol colloquially referred to as a “mixer,” is designed to allow users to cover their tracks on an otherwise public and highly traceable ledger. However, the effectiveness of the service relies on users keeping their deposits in the contracts for extended durations. Deposits made directly in and out can be interconnected, particularly when there are multiple deposits of identical amounts involved. In this instance, a user initially funded by the crypto exchange Gemini made deposits into both the 1 ETH set and the 10 ETH set, followed by withdrawals from the same sets a few hours later.



If it is determined that the suspiciously-timed deposits and withdrawals to Tornado were made by Ahmed, or, if the nature of the Huobi account suggests so, it would directly link those blockchain addresses to a trove of easily obtained know-your-customer (KYC) information.



Gemini in particular is regulated under New York state laws, and it could have been legally compelled to hand identifying information to the investigators, according to Kathleen McGee, a partner in the Tech Group at law firm Lowenstein Sandler.&nbsp;



&#8220;If I was the (SDNY), I would have subpoenaed directly to the exchange,&#8221; she told Blockworks in an interview.



In a statement to Blockworks, a Gemini spokesperson wrote: “As a regulated crypto exchange and custodian, Gemini complies with all applicable federal and state laws and regulations. Gemini cooperates with law enforcement and government agencies to curb illicit activity.”



<h2 class="wp-block-heading">Few mistakes</h2>



Ultimately, Ahmed’s seemingly clumsy usage of Tornado Cash, as well as his links to Huobi, could have acted as a smoking gun, giving the SDNY investigators a starting point from which tracking the money would have become significantly easier.



&#8220;I&#8217;m reading between the lines in this press statement, but it sounds like this individual made a few mistakes. It is often the case that hubris takes down even the best of us,&#8221; McGee said.&nbsp;



Indeed, the investigation conducted by the SDNY set a new benchmark in terms of its speed and sophistication. However, crypto-native analysts have been finding ways to track and pressure would-be exploiters for years — methods that law enforcement agencies are only just beginning to deploy.



“There&#8217;s just a lot of different ways to make a mistake and a hacker doesn&#8217;t even need to make many mistakes to get identified,” Bax said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Following the money: How the SDNY caught the Crema hacker

Katherine Ross

The Southern District of New York unveiled an indictment against an individual who stole $9 million from an unnamed decentralized cryptocurrency exchange.&nbsp;



Following the theft, Shakeeb Ahmed proceeded to Google Search terms presumably in the hopes of evading the authorities.&nbsp;



“As alleged, Mr. Ahmed used his skills as a computer security engineer to steal millions of dollars. He then allegedly tried to hide the stolen funds, but his skills were no match for IRS Criminal Investigation&#8217;s Cyber Crimes Unit,” <a href="https://www.justice.gov/usao-sdny/pr/former-security-engineer-international-technology-company-arrested-defrauding">said</a> Tyler Hatcher, an agent at the IRS-CI.



Ahmed then proceeded to contact the crypto exchange to offer most of the money back in return for pocketing $1.5 million. He also proceeded to inform the exchange of its “technical vulnerabilities.”



And then, as one does, Ahmed took to Google to search terms related to the crime he had committed. He looked up “defi hack” and visited news articles connected to his attack.&nbsp;



According to the <a href="https://www.justice.gov/media/1304886/dl?inline">indictment</a>, Ahmed had used a VPN to conceal his internet protocol address during the attack. Afterward, he attempted to search for information to ensure that the VPN would not lead back to him.



The hack, which happened in July 2022, led to a number of different search inquiries from Ahmed as he waited to see if he had gotten away with his crime.



In August, Ahmed searched “defi hacks FBI” as well as “wire fraud” and “how to prove malicious intent.”



In a twist of irony, Ahmed is charged with wire fraud by the prosecutors. He is also charged with money laundering.&nbsp;



Ahmed was also interested in “how to stop federal government from seizing assets” and then researched how he could either buy citizenship — presumably to another country — or cross borders with the $1.5 million he still had from the attack.&nbsp;



The timeline of the attack was given in the indictment — which states that Ahmed contacted the exchange “almost immediately after the attack” on July 3, and then continued to negotiate with the exchange on July 6, lines up with the <a href="https://blockworks.co/news/solana-based-liquidity-protocol-cremafinance-hacked-for-8-7m">hack of liquidity protocol CremaFinance</a> last July.&nbsp;



CremaFinance did not immediately respond to a request for comment from Blockworks asking if the indictment was related to the $9 million hack last July.

‘Can I cross border with crypto?’: Hacker turned to Google after $9M DeFi raid

Shalini Nagarajan

An unidentified hacker executed a hostile takeover of sanctioned cryptocurrency mixer Tornado Cash over the weekend. They successfully gained control over the protocol&#8217;s governance by submitting a malicious governance proposal, enabling them to assume full authority.



Samczsun, a security researcher at crypto-focused venture firm Paradigm, said in a tweet on Sunday that the attacker granted themselves 1.2 million votes through a malicious proposal.&nbsp;



They gained complete control over Tornado Cash&#8217;s governance by generating more fake votes than legitimate votes, surpassing the threshold of 700,000.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">On 2023/05/20 at 07:25:11 UTC, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1,200,000 votes. As this is more than the ~700,000 legitimate votes, they now have full control.<a href="https://t.co/nY87XmrYgT">https://t.co/nY87XmrYgT</a> <a href="https://t.co/h9qjc3xRqz">pic.twitter.com/h9qjc3xRqz</a>&mdash; @samczsun.com (@samczsun) <a href="https://twitter.com/samczsun/status/1660012956632104960?ref_src=twsrc%5Etfw">May 20, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Tornado Cash is a decentralized privacy tool on the Ethereum blockchain that works by mixing funds pooled from multiple parties in uniform amounts, so it&#8217;s harder for anyone to trace specific deposits and withdrawals.



The protocol was built with a governance token called <a href="https://blockworks.co/price/torn" target="_blank" rel="noreferrer noopener">TORN</a>, allowing token holders to participate in decision-making. The protocol is <a href="https://blog.chainalysis.com/reports/tornado-cash-sanctions-challenges/#:~:text=Decentralized%3A%20Tornado%20Cash%27s%20codebase%20is,decentralized%20autonomous%20organization%20(DAO)." target="_blank" rel="noreferrer noopener">managed</a>, at least partially, by a decentralized autonomous organization (DAO) comprised of these token holders.



By gaining control over Tornado Cash&#8217;s governance, the attacker has the power to withdraw all the locked votes and drain all the tokens in the governance contract.&nbsp;



“Now that they have all the votes, they can do whatever they want. In this case, they simply withdrew 10,000 votes as TORN and sold it all,” samczsun said about the hack.



The protocol itself is immutable, so ETH deposited by users into the mixer is not at risk.



Tornado Cash <a href="https://blockworks.co/news/us-treasury-bans-citizens-from-using-mixing-service-tornado-cash">faced sanctions</a> from the US Treasury in August 2022 due to allegations of laundering about $7 billion in crypto since its establishment in 2019. Among the laundered funds is a significant amount of $445 million that authorities say was hacked by the North Korean hacker group Lazarus.



Following news of the exploit, Binance <a href="https://twitter.com/binance/status/1660127515459895296" target="_blank" rel="noreferrer noopener">announced</a> a temporary suspension of TORN deposits until further notice.



Blockworks has reached out to Tornado Cash for comment.



<h2 class="wp-block-heading">TORN recovers as proposal to reverse attack gains support</h2>



Technically, the code that was executed was not what token holders had voted for, but the contract contained an updatable dependency, and the attacker was able to <a href="https://twitter.com/0xngmi/status/1660043447913381888?s=20" target="_blank" rel="noreferrer noopener">replace</a> part of it after the vote — effectively a bait and switch.



TORN plunged over 36% after the attack, according to Blockworks Research data.&nbsp;



But the token recovered over 8% on Monday after the person who anonymously gained control of the protocol&#8217;s governance suggested a plan to undo the harmful code.



According to the <a href="https://etherscan.io/address/0x1FAd009aD35689B5a9B91486148F2F32AFE31e23#code" target="_blank" rel="noreferrer noopener">new proposal</a>, the attacker&#8217;s ownership of tokens would be reduced to zero. 



Based on current indications, it appears likely that the proposal will be approved once voting concludes on May 26. As of press time, there were over 517,000 votes in favor of the proposal.



In the Tornado Cash community forum, one user, using the pseudonym Tornadosaurus-Hex expressed belief that there is a &#8220;good chance&#8221; the attacker will follow through with the proposal.&nbsp;



The user emphasized the significance of the proposal, even though the community may not have a say in its implementation.



Meanwhile, 0xdeadf4ce, another community member, said on Twitter that the new proposal could revert the damage done to the protocol’s governance.



“Either they&#8217;re giga trolling or it will end up being an expensive but not disastrous lesson in Governance security,” they added.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">TornadoCash attacker deployed new proposal that, if executed, would seemingly revert the damage done to the Governance functionality. Either they&#39;re giga trolling or it will end up being an expensive but not disastrous lesson in Governance security.<a href="https://t.co/QMWYFsi8kP">https://t.co/QMWYFsi8kP</a>&mdash; 0xdeadf4ce (@0xdface) <a href="https://twitter.com/0xdface/status/1660395508521738240?ref_src=twsrc%5Etfw">May 21, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



They speculated that the new proposal might be an effort to increase the price of TORN, which plunged after the governance takeover.



<h2 class="wp-block-heading">Funds at risk on Gnosis Chain</h2>



The true target may also be a smaller implementation of Tornado called Nova, deployed on Gnosis Chain. Unlike the primary Ethereum pool, Nova is fully upgradeable by governance, meaning the ether in the pool are fully at risk of loss.



There is a 7-day timelock on upgrading the protocol’s contract, meaning any users with ETH in the pool, have a window of time to rescue their funds.



<a href="https://twitter.com/samczsun/status/1660042906500214784?s=20">https://twitter.com/samczsun/status/1660042906500214784?s=20</a>



Currently, there are roughly 500 ether, worth about $900,000 in <a href="https://gnosisscan.io/address/0xd692fd2d0b2fbd2e52cfa5b5b9424bc981c30696" target="_blank" rel="noreferrer noopener">the contract</a>.



Macauley Peterson contributed reporting.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Hijacker’s Remorse in Tornado Cash Governance Tussle?

North Korean hacker group Lazarus made attempts to move funds worth $63 million that were stolen from last year’s <a href="https://blockworks.co/news/defi-cross-chain-horizon-bridge-hacked-for-100m">Harmony bridge hack</a>, but the crypto exchanges used for the process claim its transfers have been blocked.



Blockchain sleuth ZachXBT <a href="https://twitter.com/zachxbt/status/1614771861266792449" target="_blank" rel="noreferrer noopener">shared</a> on Twitter that the group moved some 41,000 ETH over the weekend using Ethereum-based Railgun, a smart contract that keeps user identities private, to exchanges Binance, OKX and Huobi. The transactions were carried out between Jan. 13 and 14.



ZachXBT also shared over 350 addresses associated with the hacker group.&nbsp;



Binance CEO Changpeng Zhao <a href="https://twitter.com/cz_binance/status/1614887319177428992" target="_blank" rel="noreferrer noopener">tweeted</a> that the exchange has previously detected the hacker’s fund movement, and that it coordinated with Huobi in freezing the accounts. They also together managed to recover 124 bitcoin ($2.6 million), according to Zhao, implying that some of the stolen ether was swapped for bitcoin.



Huobi too was able to detect and prevent the hacker from attempting to launder funds, <a href="https://twitter.com/justinsuntron/status/1614901672102465538" target="_blank" rel="noreferrer noopener">according to</a> Justin Sun. About Capital, Sun’s investment firm, <a href="https://blockworks.co/news/huobi-founder-sells-100-stake-to-justin-sun-fund-report">acquired Huobi in October</a>.&nbsp;



Harmony’s Horizon bridge was one of the biggest hacks of last year. It allows users to move their cryptoassets via cross-chain transfers between Ethereum, Binance Smart Chain and Harmony blockchains. The bridge was exploited in June 2022 for $100 million, with <a href="https://blockworks.co/news/funds-from-100m-horizon-bridge-exploit-sent-to-tornado-cash-mixing-service">the proceeds initially moved</a> via now-OFAC-sanctioned <a href="https://blockworks.co/tag/tornado-cash">Tornado Cash</a>.&nbsp;



Blockchain analytics firm Elliptic <a href="https://hub.elliptic.co/analysis/over-1-billion-stolen-from-bridges-so-far-in-2022-as-harmony-s-horizon-bridge-becomes-latest-victim-in-100-million-hack/" target="_blank" rel="noreferrer noopener">said</a> that different types of cryptoassets were stolen including ETH, BNB, USDT, USDC and Dai. After the theft, the hacker used different types of decentralized exchanges to swap the tokens for ETH, which is a “common technique utilized by DeFi hackers,” the firm added.&nbsp;



The<a href="https://blockworks.co/news/crypto-hacks-2022"> total amount of funds lost to hacks in 2022</a> amounted to $4.3 billion of cryptocurrency, representing a 37% jump from 2021. Smart contract vulnerabilities that lead to malicious exploits remain among the most pressing threats that need to be solved in 2023.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

North Korea’s Lazarus Hackers Try to Exfiltrate Harmony Funds

David Canellis

Members of a notorious hacker crew with links to North Korea have been posing as venture capitalists in a bid to phish — and steal from — crypto startups.



A subunit of North Korean cyberwarfare agency Bureau 121, called BlueNoroff, has now deployed more than 70 domains during its phishing campaign overall, with a recent focus on Japan’s financial sector.



“[BlueNoroff] created numerous fake domains that look like venture capital and bank domains. Most of the domains imitate Japanese venture capital companies, indicating that the group has an extensive interest in Japanese financial entities,” cybersecurity firm Kaspersky <a href="https://securelist.com/bluenoroff-methods-bypass-motw/108383/" target="_blank" rel="noreferrer noopener">said</a>.



The hackers have imitated venture capital firms such as Beyond Next Ventures and Angel Bridge, as well as banking giants Bank of America and Mizuho Financial Group.&nbsp;



BlueNoroff has also adopted new malware strains that rely on different file types to bypass Windows system flags, employing .iso and .vhd extensions instead of Word documents.&nbsp;



The malware, usually delivered via email, is hidden inside those files, which release a malicious PDF or PowerPoint presentation once opened. Additional malware is then downloaded directly to the target machine, installing backdoors and executing commands to steal sensitive data and high system privileges.



The US Army in 2020 <a href="https://irp.fas.org/doddir/army/atp7-100-2.pdf" target="_blank" rel="noreferrer noopener">estimated</a> that BlueNoroff is made up of roughly 1,700 individuals operating around the world. Authorities say it aims to pull off &#8220;financial cybercrime by concentrating on long-term assessment and exploiting enemy network vulnerabilities.”&nbsp;



“This group exploits the systems for financial gain for the regime or to take control of the system.”



Kaspersky&#8217;s researchers have tracked BlueNoroff’s crypto efforts since 2018 — two years after the group attempted to steal $1 billion from the central bank of Bangladesh, though making off with just $63 million.



In January, Kaspersky <a href="https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" target="_blank" rel="noreferrer noopener">detailed</a> instances of the hackers pretending to be Barry Silbert’s crypto hedge fund Digital Currency Group in phishing attempts, among numerous other digital asset firms including Emurgo, a Cardano-focused software firm, and Ant Capital.


<div class="wp-block-image">
<figure class="aligncenter"><img decoding="async" src="https://lh3.googleusercontent.com/jDezfOOaH-yISqFg_0tNRTZTeRix3-s3bcd_WY54ZjGTeMs3BMBh0anopyxYuHGmRTLjVPIUkYjmubXYIpZAvs6pIdEVFJNKQ2OxiehXN53mfAn8MUpvpGyrndcmiDD2JCXOLSkVjm3D67N8omHcTM-rXinDNAhkUXCVSi0-2Y44tDWsxPLJJni1NgkPYw" alt=""/><figcaption class="wp-element-caption">Fake BlueNoroff phishing document cites purported investments in crypto exchange bitFlyer</figcaption></figure></div>


Fellow Bureau 121 subunit <a href="https://blockworks.co/tag/lazarus" target="_blank" rel="noreferrer noopener">Lazarus Group</a> is believed to be responsible for <a href="https://blockworks.co/news/crypto-hacks-2022" target="_blank" rel="noreferrer noopener">major hacks on crypto startups</a>, including the $500 million Axie Infinite and $100 million Harmony incidents this year.



BlueNoroff itself has been responsible for crypto thefts worth millions of dollars from crypto startups, Kaspersky has said.



The reports <a href="https://blockworks.co/news/japan-based-crypto-businesses-warned-of-possible-cyberattack-threat" target="_blank" rel="noreferrer noopener">align with others from October</a>, in which Japanese authorities disclosed a spate of Lazarus-linked phishing and social engineering attacks on local crypto funds, some of which amounted to lost capital.



“As we can see from our latest finding, this notorious actor has introduced slight modifications to deliver their malware. This also suggests that attacks by this group are unlikely to decrease in the near future,” researchers said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Crypto Startups Beware: That VC Email Might Be North Korean Hackers

Nefarious actors have been increasingly turning to Telegram, according to Microsoft — as well as one of the tech gian’s own products — in attempts to infiltrate crypto companies.



The tech giant categorized the pervasiveness of such hacks, typically driven by malware, as a barrier to widespread adoption of cryptocurrencies. More concerning, still, in Microsoft’s estimation: Hackers are becoming quite adept at their brands of trickery.



“We are also seeing more complex attacks wherein the threat actor shows great knowledge and preparation, taking steps to gain their target’s trust before deploying payloads,” Microsoft wrote in a <a href="https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/" target="_blank" rel="noreferrer noopener">blog </a>Tuesday.



Microsoft detailed its own investigation of a would-be bad actor, “DEV-0139,” which the company said infiltrated Telegram chats between an unidentified crypto exchanges and their “VIP” clients, as well as the company’s other counterparties. The company said the hacker, or hacking collective, employed Excel files in bids to acquire valuable and private information.&nbsp;



While pretending to represent a separate crypto company — with apparently passable knowledge of the operations and communications of both firms — Microsoft said they invited the target to a different chat, where DEV-0139 attempted solicited feedback on the fee structure used by the crypto exchanges.



Upon gaining the trust of the target, the malicious actor sent an Excel file called “OKX Binance &amp; Huobi VIP fee comparison.xls” in an alleged bid to project credibility.



Opening the Excel file itself triggered a series of mishaps. A set of automatic actions contained in the file were used to obtain the user’s data, executed in invisible mode. This malicious “backdoor” allowed the bad actor to remotely access the infected system.&nbsp;



Microsoft also found another older file using the same technique, suggesting the incident wasn’t isolated — and that the actor may be executing similar campaigns with other targets.&nbsp;



It isn’t unusual for crypto scammers to use bots on Telegram to hoodwink users and lead them to malicious links. A 2021 report by digital threat detection firm <a href="https://q6cyber.com/blog/otp_bots_are_a_growing_threat/" target="_blank" rel="noreferrer noopener">Q6 Cyber</a> found that bot services, which can be purchased for around $300, can also be used to target investors.



2022 has already gone down as a year full of <a href="https://blockworks.co/news/the-nine-largest-crypto-hacks-in-2022" target="_blank" rel="noreferrer noopener">high-profile thefts</a> in the sector, including $600 million from FTX, $182 million from Beanstalk and $325 million from Wormhole. Interest in self-custody of assets has accordingly increased dramatically — boosted even more by user concerns of keeping crypto assets on centralized exchanges in light of FTX’s <a href="https://blockworks.co/news/1-binance-ftx-deal-is-off-unless-ftx-us-is-part-of-the-package-source" target="_blank" rel="noreferrer noopener">implosion</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Microsoft IDs Excel, Telegram Threat Targeting Crypto Startups

<div id="highlights-block_631600497a278" class="highlights">
 <ul>
 <li>KyberSwap has offered a 15% bounty to its hackers if the stolen funds are returned</li>
 <li>Binance previously helped recover funds stolen from Curve Finance and Axie Infinity</li>
 </ul>
 
</div>



Binance may have helped crack last week’s $265,000 hack on decentralized exchange (DEX) platform KyberSwap.



Binance CEO Changpeng Zhao <a href="https://twitter.com/cz_binance/status/1565976776710430721" target="_blank" rel="noreferrer noopener">said</a> on Saturday that his exchange’s security team identified two suspects behind the attack, and that their identities have been forwarded to the KyberSwap team.&nbsp;



On Sept. 1, KyberSwap issued an <a href="https://blog.kyber.network/notice-of-exploit-of-kyberswap-frontend-963aa8febd6a" target="_blank" rel="noreferrer noopener">alert</a> to notify users that a hacker exploited a frontend vulnerability which led to the draining of two whale wallets on Ethereum and Polygon.&nbsp;



The team discovered malicious code in its Google Tag Manager (GTM) which led to fraudulent transaction approvals, which allowed a hacker to transfer user funds to their account. The GTM was then disabled, according to a blog.



“The script had been discreetly injected and specifically targeting whale wallets with large amounts,” KyberSwap said.



The DeFi platform, which doubles as both a DEX and a liquidity protocol, offered a 15% bounty (around $40,000) to the hacker if they returned the funds and spoke with the team. Compromised addresses would be fully compensated, the network said.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><a href="https://twitter.com/hashtag/Binance?src=hash&amp;ref_src=twsrc%5Etfw">#Binance</a> security team has identified two suspects for yesterday&#39;s KyberSwap hack. We have provided the intel to the Kyber team, and are coordinating with LE (law enforcement). Stay <a href="https://twitter.com/hashtag/SAFU?src=hash&amp;ref_src=twsrc%5Etfw">#SAFU</a>. <a href="https://t.co/tbQBGaGTNG">https://t.co/tbQBGaGTNG</a>&mdash; CZ 🔶 Binance (@cz_binance) <a href="https://twitter.com/cz_binance/status/1565976776710430721?ref_src=twsrc%5Etfw">September 3, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Around the same time as the KyberSwap incident, privacy-focused startup ShadowFi also <a href="https://medium.com/@ShadowFi/shadowfi-the-exploit-44733d1f8cb0" target="_blank" rel="noreferrer noopener">suffered</a> a cyberattack leading to around $301,000 in losses. PeckShield <a href="https://twitter.com/ShadowFi_/status/1565919551186935808" target="_blank" rel="noreferrer noopener">identified</a> the hacker as NeorderDAO, a little-known crypto collective whose website is now offline.



Binance has often shown commitment to helping out crypto projects. Last month, the exchange managed to <a href="https://cms.blockworks.co/binance-recovers-majority-funds-stolen-in-curve-finance-hack/" target="_blank" rel="noreferrer noopener">recover</a> a majority of the funds hackers stole from DeFi protocol Curve Finance. It also <a href="https://twitter.com/cz_binance/status/1517385438469791749" target="_blank" rel="noreferrer noopener">helped</a> Axie Infinity recover nearly $6 million allegedly stolen by North Korean hacking unit Lazarus Group in April.&nbsp;



DeFi hacks have been exploding in the past two years, hitting over <a href="https://cms.blockworks.co/defi-exploits-top-1-8b-ytd-though-security-getting-better-immunefi-says/" target="_blank" rel="noreferrer noopener">$1.2 billion</a> in the first quarter of this year alone, according to Immunefi. The Federal Bureau of Investigation recently <a href="https://cms.blockworks.co/fbi-issues-warning-over-defi-exploits-open-source-development/" target="_blank" rel="noreferrer noopener">warned</a> against such exploits, saying cyber criminals are on the lookout to abuse the complexity of cross-chain functionality.&nbsp;



Kyber’s KNC token has fallen 5% since the hack to $1.65, data from <a href="https://www.tradingview.com/chart/?symbol=FTX%3AKNCUSD" target="_blank" rel="noreferrer noopener">TradingView</a> shows.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Binance Identifies Suspects Who Stole From KyberSwap Whales

Ben Strack

<div id="highlights-block_6244bc1609abe" class="highlights">
 <ul>
 <li>Blockchain transparency makes it hard to pull off large-scale cryptocurrency theft, according to blockchain data firm Chainalysis</li>
 <li>Axie Infinity co-founder Aleksander Leonard Larson tweeted Wednesday that several new validators would be added to the Ronin network</li>
 </ul>
 
</div>



For the hacker who recently <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">exploited the Ronin Network</a> for roughly $625 million, cashing out the funds will likely be a challenge. 



The Ethereum-linked sidechain used for blockchain game Axie Infinity was attacked last week, when the person or group responsible made off with 173,600 ether and 25.5 million USDC.



The exploiter used hacked private keys to forge withdrawals on March 23, according to <a href="https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w" target="_blank" rel="noreferrer noopener">a Tuesday statement</a>. The breach was discovered nearly a week later when a user was unable to withdraw 5,000 ETH.



The hackers have tried to sell about 6,500 stolen ETH, transferring the tokens to three different exchanges, according to William Quigley, co-founder of stablecoin Tether and non-fungible token (NFT) blockchain platform WAX. All of the stolen USDC has been transferred out to various wallets and DeFi protocols, Etherscan data shows.



Most of the funds remain in the <a href="https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96" target="_blank" rel="noreferrer noopener">hacker’s wallet</a>, according to the network. Aleksander Leonard Larson, co-founder and chief operating officer of Axie Infinity, tweeted Wednesday that Axie is committed to ensuring all of the drained funds are recovered or reimbursed.



“Been an intense 36 hours,” <a href="https://twitter.com/Psycheout86/status/1509134627319033863" target="_blank" rel="noreferrer noopener">Larson tweeted</a>. “Our internal network is currently going through a deep forensics review to ensure there is no lingering threat.”



Selling the remaining 176,000 or so ETH will be difficult, Quigley told Blockworks, adding that the address has been blacklisted to exchanges.



“Sky Mavis has also retained Chainalysis to ensure that any of the stolen ETH moved from this Ethereum address will be tracked,” he said. “It doesn&#8217;t seem like the hacker will have much luck cashing out.”



Kim Grauer, Chainalysis’ director of research, said the <a href="https://cms.blockworks.co/hackers-steal-over-600m-biggest-in-defi-history/" target="_blank" rel="noreferrer noopener">Poly Network hack in August</a> and subsequent <a href="https://cms.blockworks.co/poly-network-hacker-returns-600-million-offered-500000-bug-bounty/" target="_blank" rel="noreferrer noopener">return of funds</a> illustrated the rising difficulty of pulling off a large-scale cryptocurrency theft.



While criminally obtained fiat currency can be moved through “shady bank accounts” — and authorities rely on subpoenas and the cooperation of financial institutions to trace its path — Grauer said anyone can view transactions executed on public blockchains.



“With the inherent transparency of blockchains and the eyes of an entire industry on them, it&#8217;s difficult for any cryptocurrency hacker to escape with a large cache of stolen funds,” Grauer said. “In most cases, the best they could hope for would be to evade capture as the funds sit frozen in a blacklisted private wallet.”



<h3 class="wp-block-heading">How did it happen and what’s next?</h3>



Illicit crypto transactions <a href="https://cms.blockworks.co/chainalysis-report-illicit-addresses-received-14b-in-2021/" target="_blank" rel="noreferrer noopener">reached $14 billion</a> last year, according to a February Chainalysis report. Though that marks an all-time high, illicit activity in terms of total crypto transaction volume has never been lower, as the market capitalization of digital assets grew in 2021.



The latest hack was an outlier, Quigley said, in that it occurred in part because a single entity, Sky Mavis, controlled four of the Ronin’s chain’s nine validator nodes. The hacker gained control of a fifth node — good for a majority — run by Axie DAO.



Larson called the hack “a social engineering attack combined with a human error” in a Wednesday tweet, adding that Ronin plans to add additional validators to boost decentralization.&nbsp;



The fact that several days passed before the public became aware is rare and “surprising,” Quigley said.



“Most people did not appear to know that Axie Infinity ran its own layer-2 blockchain on top of Ethereum,” he said. “People playing Axie Infinity or providing liquidity to Ronin&#8217;s decentralized exchange, Katana, might have been more circumspect about depositing hundreds of millions of dollars on the Ronin Bridge if they knew Axie Infinity managed the passwords to five of the nine Ronin validator nodes.”



Layer-2 chains are inherently more vulnerable because the attack vectors double when you operate atop another chain, Quigley said. Exploits can be operational — when the parties running a system don’t have robust security practices — or code-related.



“Large complex systems, like fully featured layer-2 based blockchain games with hooks into other third-party platforms, is a vastly more challenging system to audit,” he said, noting the operational nature of the Ronin hack.



As more value flows through cross-chain bridges, they’re becoming increasingly attractive targets for hackers, according to Grauer. Though the Ronin case involved hacked private keys, many DeFi (decentralized finance) hacks are attributed to code vulnerabilities.&nbsp;



“While not foolproof, a valuable first step towards addressing issues like this could be for extremely rigorous code audits to become the gold standard, both for those building protocols and for the investors evaluating them,” Grauer said. “Over time, the strongest, safest smart contracts can serve as templates for developers to build from.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.