Shalini Nagarajan

Crypto exchange Upbit has started using more cold wallets after dealing with more hacking attempts since 2020.



Hackers reportedly attempted to breach crypto exchange Upbit about 160,000 times in the first half of 2023 alone.



This data, which reveals more than double the number of infringement attempts in the first half of 2021, was shared by Dunamu — the operator of Upbit — with South Korean lawmaker Rep. Park Seong-jung, a member of the National Assembly&#8217;s Information and Communications Technology (ICT) committee, Yonhap News <a href="https://www.yna.co.kr/view/AKR20231007053200002?section=search">reported</a> on Monday.



Dunamu reported a substantial rise in hacking attempts on the exchange, surging from about 8,400 in the second half of 2020 to 159,061 in the first half this year. 



Upbit — among the top 20 crypto exchanges by spot trading volume — is believed to have incurred losses of 58 billion won (equivalent to $42.8 million) due to a hacking incident in 2019.&nbsp;



Following this event, Upbit implemented preventive measures, such as distributing its operating hot wallets, effectively averting any subsequent cyber breaches, according to Yonhap.



In an effort to enhance security further, Dunamu announced its intent to increase Upbit’s cold wallet proportion to over 70% and adopt new procedures for operating hot wallets, designed to make them safer.



Hot wallets are generally considered more vulnerable to hacking and online threats because they are connected to the internet, whereas cold wallets are shield private keys from the risks associated with the online environment.



Rep. Park noted that the increasing frequency of hacking incidents targeting virtual asset exchanges, both domestically and internationally, is a growing concern.



He added that he feels the Ministry of Science and ICT has a vague role in overseeing these exchanges, and emphasized the importance of the Ministry taking proactive steps to address the issue.&nbsp;



Specifically, he called for the Ministry to carry out simulated security tests and assess the information security landscape to better prepare for cyberattacks, particularly in the context of frequent hacking attempts on virtual exchanges.



The cryptocurrency industry is still relatively young and lacks comprehensive regulation in many jurisdictions. This lack of oversight can attract bad actors who believe they can operate with relative impunity.



Immunefi recently <a href="https://assets.ctfassets.net/t3wqy70tc3bv/281FPX3g6liwuWgm1AGYiR/e05f679fc8890c7fdf34f43a5528c86b/Immunefi_Crypto_Losses_in_Q3_2023_Report.pdf">reported</a> that the crypto industry lost $1.4 billion to hacks and fraud so far this year, with $685.5 million lost in the third quarter alone.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

exchanges

Upbit updates cold wallet policy in bid to thwart hackers

<div id="highlights-block_6332c5ec82bae" class="highlights">
 <ul>
 <li>An external hacker wouldn’t have the knowledge required for contract execution, Edwards alleged</li>
 <li>Wintermute must clarify how the attacker had the necessary signature required, he said</li>
 </ul>
 
</div>



The $160 million hack of market maker Wintermute might have been an inside job, according to one blockchain analyst.



The liquidity provider, among the largest dedicated to crypto market making, was allegedly hacked due to a recently discovered “<a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">vanity address” vulnerability</a> in its DeFi (decentralized finance) operations. CEO Evgeny Gaevoy, who said the firm remained solvent, asked the hacker to get in touch and offered a 10% bounty if the funds were returned.



But a new theory by James Edwards, who goes by the name Librehash on Medium, claims the hack could be pinned down to Wintermute’s own team.



In a <a href="https://medium.com/@librehash_13479/analysis-of-the-wintermute-hack-an-inside-job-736422c08ef1" target="_blank" rel="noreferrer noopener">blog</a> posted on Monday, Edwards said the prevailing theory maintains that an externally owned address (EOA) behind the “compromised” Wintermute wallet was itself compromised because of a vulnerability in a vanity address generator tool. 



But he disputed that theory after analyzing the smart contract and its interactions, concluding that the knowledge required to go through with the hack rules out the possibility that the hacker was random or external.&nbsp;



Edwards noted that the smart contract at issue has “no uploaded, verified code,” which makes it difficult for external parties to confirm the external hacker theory and raises the issue of transparency.&nbsp;



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“The relevant transactions initiated by the EOA make it clear that the hacker was likely an internal member of the Wintermute team,” he wrote.</blockquote>



Further, on conducting an Etherscan analysis, he said the compromised smart contract received two deposits from Kraken and Binance’s hot wallets. “It&#8217;s safe to assume that such a transfer must have been initiated from team-controlled exchange accounts,” he said.



Less than a minute after the compromised Wintermute smart contract received over 13 million in Tether (the total amount of that token), the funds were sent from the wallet manually to a contract supposedly controlled by the hacker.



“We know the team was aware the smart contract had been compromised at this point. So why initiate these two withdrawals directly to the compromised smart contract smack in the middle of the hack?” he said on <a href="https://twitter.com/librehash/status/1574496083614613513" target="_blank" rel="noreferrer noopener">Twitter</a>.



Edwards believes the Wintermute team should provide an explanation of how the attacker would have the necessary signature for contract execution and know which functions to call, since there&#8217;s no contract source code published. He suggested only someone with intimate knowledge would have the capacity to do so.&nbsp;



Edwards is not a professional cybersecurity analyst and his blog on the Wintermute hack appears to be his debut Medium post. But he’s previously put out Twitter threads analyzing possible money laundering on various crypto projects.&nbsp;&nbsp;



The large scale theft was another blemish on the record of the industry as it would hurt the confidence of TradFi (traditional finance) institutions looking to enter the space, according to Marcus Sotiriou, analyst at GlobalBlock. “As Wintermute was one of the biggest liquidity providers in the industry, they may be forced to remove liquidity in order to mitigate further risk from their loss,” he said.



Wintermute didn’t return Blockworks’ request for comment by press time.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

data analytics

Was the $160M Wintermute Hack an Inside Job?

Ben Strack

<div id="highlights-block_620d155093d0d" class="highlights">
 <ul>
 <li>Illicit transaction volume increased 79% year over year while total crypto volume rose by 567%, according to Chainalysis</li>
 <li>Cybercriminals have laundered roughly $33 billion worth of crypto since 2017</li>
 </ul>
 
</div>



Illicit crypto transactions reached an all-time high $14 billion last year, but criminal activity’s share of cryptocurrency transaction volume has never been lower, according to a Chainalysis report published Wednesday.



Although the value of illicit transactions surged in 2021 from $7.8 billion the year before, these nefarious transactions accounted for 0.15% of crypto volume last year, down from 0.62% in 2020, the report said.



<div class="wp-block-image"><figure class="alignleft size-large"><img loading="lazy" decoding="async" width="1024" height="558" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg" alt="" class="wp-image-17495" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=1536 1536w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/02/Chainalysis-chart-1024x558.jpg?w=1642 1642w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Source: Chainalysis Report</figcaption></figure></div>



Total transaction volume across cryptocurrencies tracked by Chainalysis grew to $15.8 trillion in 2021, up 567% from 2020.



“Given that roaring adoption, it’s no surprise that more cybercriminals are using cryptocurrency,” the report states. “But the fact that the increase in illicit transaction volume was just 79% — nearly an order of magnitude lower than overall adoption — might be the biggest surprise of all.”



Crypto-based crime spiked in 2019 as transactions involving illicit addresses represented nearly 3.4% of crypto transaction volume, the Chainalysis report notes. The <a href="https://en.wikipedia.org/wiki/PlusToken" target="_blank" rel="noreferrer noopener">PlusToken</a> Ponzi scheme occurred that year, reportedly defrauding investors out of more than $2 billion worth of crypto.



Decentralized finance (DeFi) protocols played a much greater role in laundering illicit funds in 2021, the report adds. Laundering through DeFi protocols increased by 1,964% from the prior year, reaching $900 million.



Cybercriminals have laundered roughly $33 billion worth of crypto since 2017, with most of that moving to centralized exchanges over time.



The amount of crypto that criminals are holding is hard to know, according to Chainalysis, as law enforcement has seized illicitly obtained assets.



The IRS Criminal Investigation team <a href="https://www.irs.gov/pub/irs-pdf/p3583.pdf" target="_blank" rel="noreferrer noopener">announced in November</a> that it had seized $3.5 billion worth of cryptocurrency in 2021. The Department of Justice also <a href="https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside" target="_blank" rel="noreferrer noopener">recovered $2.3 million</a> from the ransomware group responsible for the attack on Colonial Pipeline.



More recently, the DOJ <a href="https://cms.blockworks.co/couple-arrested-as-government-recovers-3-6b-in-stolen-bitcoin/" target="_blank" rel="noreferrer noopener">announced last week</a> that it had recovered the majority of the cryptocurrency stolen during the 2016 Bitfinex hack, valued at roughly $3.6 billion.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

hacking

Newsletter

Blockworks Research