Andrew Thurman

In what has been touted as a historic first, attorneys for the Southern District of New York revealed on Tuesday, July 11, the filing of charges against Shakeeb Ahmed. The SDNY alleges that Ahmed embezzled $9 million from a DeFi protocol based on Solana back in July 2022.



A <a href="https://twitter.com/SDNYnews/status/1678780204062490626">tweet</a> from the official SDNY account claimed the charges represented the “first-ever criminal case involving an attack on a smart contract.” Additionally, in a press <a href="https://www.justice.gov/usao-sdny/pr/former-security-engineer-international-technology-company-arrested-defrauding">release</a> IRS-CI Special Agent Tyler Hatcher bragged about the sophistication of the investigation, saying Ahmed’s “skills were no match for IRS Criminal Investigation&#8217;s Cyber Crimes Unit.”



However, blockchain analysis shows that a number of possible missteps from the hacker indicates that the SDNY may have had an easier time apprehending the hacker than their PR tour implies.&nbsp;



On July 2, 2022, a hacker was able to take $9 million in a flash loan exploit on Solana’s Crema Finance, a decentralized exchange. After a period of negotiations, the hacker returned the majority of the funds on July 7. As part of the arrangement — which is not uncommon between teams and hackers — the attacker was allowed to retain ownership of assets valued at $1.6 million as a “bounty.”



While the SDNY did not specify in either the announcement or the criminal complaint which protocol was the target of the exploit, the dates, method of attack, and both the amounts stolen and the amounts eventually returned point to Crema.&nbsp;



Multiple Crema developers did not respond to requests for comment. In an official Telegram channel, a team member said the team was “still investigating” whether or not the project would be able to recover the remaining funds potentially seized by law enforcement from Ahmed, implicitly confirming Crema as the unnamed protocol.&nbsp;



The exploiter later attempted to launder the remaining funds using a variety of privacy-preserving tools, including Tornado Cash and Monero — tools that the SDNY now claim to have rendered ineffective.&nbsp;



<h2 class="wp-block-heading">Advanced analytics</h2>



The announcement of charges was notable in part for the expeditiousness of the investigation. The SDNY missed a one-year turnaround time from the end of negotiations between Crema and the exploiter by just a matter of days, far cry from the three-to-four-year turnaround the SEC took to pursue certain 2017-era ICO scams.



Aside from speed, however, the SDNY’s PR materials notably hung their hat on the analytical expertise of the investigation.&nbsp;



In a video accompanying the announcement of charges, SDNY Attorney Damian Williams boasted about the district’s ability to track Ahmed’s movements across blockchains:



“We also allege that he then laundered the stolen funds through a series of complex transfers on the blockchain where he swapped cryptocurrencies, hopped across different crypto blockchains, and used overseas crypto exchanges.&nbsp; But none of those actions covered the defendant’s tracks or fooled law enforcement, and they certainly didn’t stop my Office or our law enforcement partners from following the money.”



While anyone with access to a block explorer can track movements between addresses and often even between different blockchains with minimal expertise, according to forensics consulting firm Five I’s founder Nick Bax, the Monero tracking would require genuine investigative chops.&nbsp;



Monero, a blockchain built to enable privacy-preserving transactions, allows for “probabilistic” inferences that can theoretically allow investigators to track funds, but in practice, tracing these transactions is often complex.&nbsp;



As an example Bax pointed to Daube v. United States, another case that involved tracing Monero transactions. In that instance, investigators required additional identifying data to bolster their Monero-based work.&nbsp;



“Normally an investigator will need internal data from centralized services such as exchanges to learn more information about who received the Monero being spent on-chain,” Bax said.&nbsp;



<h2 class="wp-block-heading">On-ramps and off-ramps</h2>



Given the complexity of tracking the funds through Monero, it’s much more likely that the SDNY managed to catch Ahmed during on-ramping (converting fiat to crypto) rather than off-ramping (selling Monero for fiat to complete the laundering process).&nbsp;



Indeed, blockchain analysis from Blockworks, as well as multiple analysts at the time of the exploit, indicates that Ahmed may have made key blunders while funding the wallets from which he launched his attack.&nbsp;



First, <a href="https://solanafm.notion.site/solanafm/Crema-Finance-Exploit-Coverage-00e91e80cddc493786c2b0cc8f1d912a">analysis</a> from SolanaFM at the time of the attack found that the attacker interacted with either Huobi exchange <a href="https://solana.fm/tx/2rr8dnW4CFkprCsMgLC7CXhsvwuWtYERRVRPC8G1Tf6LyGRg4PRSTLvDoRNH2RNefUwtWvaGUM43hrhZEjkDwRMA?cluster=mainnet-qn1">addresses</a>, or nested exchange addresses associated with Huobi.&nbsp;



Additionally, just days after the exploit, pseudonymous on-chain analyst ZachXBT called <a href="https://twitter.com/zachxbt/status/1544797170762760192">attention</a> to a pair of suspiciously-timed Tornado Cash transactions, leading to <a href="https://etherscan.io/address/0x6bbc4f266cbddcd5551a9bb5b8b7fd61f9eecca6">addresses</a> linked to the attack.&nbsp;



Tornado Cash, a privacy-preserving protocol colloquially referred to as a “mixer,” is designed to allow users to cover their tracks on an otherwise public and highly traceable ledger. However, the effectiveness of the service relies on users keeping their deposits in the contracts for extended durations. Deposits made directly in and out can be interconnected, particularly when there are multiple deposits of identical amounts involved. In this instance, a user initially funded by the crypto exchange Gemini made deposits into both the 1 ETH set and the 10 ETH set, followed by withdrawals from the same sets a few hours later.



If it is determined that the suspiciously-timed deposits and withdrawals to Tornado were made by Ahmed, or, if the nature of the Huobi account suggests so, it would directly link those blockchain addresses to a trove of easily obtained know-your-customer (KYC) information.



Gemini in particular is regulated under New York state laws, and it could have been legally compelled to hand identifying information to the investigators, according to Kathleen McGee, a partner in the Tech Group at law firm Lowenstein Sandler.&nbsp;



&#8220;If I was the (SDNY), I would have subpoenaed directly to the exchange,&#8221; she told Blockworks in an interview.



In a statement to Blockworks, a Gemini spokesperson wrote: “As a regulated crypto exchange and custodian, Gemini complies with all applicable federal and state laws and regulations. Gemini cooperates with law enforcement and government agencies to curb illicit activity.”



<h2 class="wp-block-heading">Few mistakes</h2>



Ultimately, Ahmed’s seemingly clumsy usage of Tornado Cash, as well as his links to Huobi, could have acted as a smoking gun, giving the SDNY investigators a starting point from which tracking the money would have become significantly easier.



&#8220;I&#8217;m reading between the lines in this press statement, but it sounds like this individual made a few mistakes. It is often the case that hubris takes down even the best of us,&#8221; McGee said.&nbsp;



Indeed, the investigation conducted by the SDNY set a new benchmark in terms of its speed and sophistication. However, crypto-native analysts have been finding ways to track and pressure would-be exploiters for years — methods that law enforcement agencies are only just beginning to deploy.



“There&#8217;s just a lot of different ways to make a mistake and a hacker doesn&#8217;t even need to make many mistakes to get identified,” Bax said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Following the money: How the SDNY caught the Crema hacker

James Cirrone

Binance has reversed its decision in May to delist so-called privacy coins in certain EU nations, according to a company statement provided to Blockworks.&nbsp;



The world’s largest crypto exchange originally planned to restrict access to 12 of these tokens to customers in France, Spain, Italy and Poland. It included dash (<a href="https://blockworks.co/price/dash">DASH</a>), monero (<a href="https://blockworks.co/price/xmr">XMR</a>), zcash (<a href="https://blockworks.co/price/zec">ZEC</a>), and others.&nbsp;



Binance told Blockworks that in light of EU regulatory requirements, it has reevaluated its stance on privacy coins.&nbsp;



“After carefully considering feedback from our community and several projects, we have revised how we classify privacy coins on our platform to comply with EU wide regulatory requirements,” the statement read.



“As a crypto exchange with registrations in different EU jurisdictions, we are obliged to follow EU regulations that require exchanges to be able to monitor transactions for coins listed on our platform.&#8221;



Binance doing total 180s when it comes to its token listings has become somewhat of a pattern.



For example, Binance on June 7 announced it was scrapping dozens of tether (<a href="https://blockworks.co/price/usdt">USDT</a>) trading pairs from its advanced trading platform. Later that same day, <a href="https://blockworks.co/news/binance-culls-usdt-trading-pairs">Binance walked back that decision</a>.&nbsp;



The news of Binance retaining privacy coins comes months after Huobi Global delisted seven of them, also including monero, dash and zcash. Other crypto exchanges have complicated relationships with privacy coins.



In the US, users can buy monero on Kraken but not on Coinbase, which never listed the token because regulators would be “up in arms,” according to CEO Brian Armstrong in 2020. However, Coinbase and Kraken both support Zcash, according to <a href="https://www.coingecko.com/en/coins/zcash#markets">CoinGecko</a>.



Asian nations have been notoriously tough on privacy coins, with Japan and South Korea banning them outright.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Binance backtracks on delisting privacy coins in some EU nations

Shalini Nagarajan

Dubai’s crypto regulator has published its eagerly-anticipated regulations for the local industry — including an effective ban on anonymity-focused digital assets known as privacy coins.



The emirate’s Virtual Assets Regulatory Authority (VARA) released its <a href="https://www.vara.ae/media/Virtual%20Assets%20and%20Related%20Activities%20Regulations%202023.pdf" target="_blank" rel="noreferrer noopener">rulebook</a> on Tuesday. It  includes 10 fundamental principles and goals including licensing requirements, anti-money laundering obligations, stipulations on marketing and promotion and offenses like insider dealing.



VARA describes anonymity-enhanced cryptocurrencies as assets which prevent the tracking of ownership or transactions — an impediment for which crypto service providers currently have no way to effectively mitigate.



Dubai’s new <a href="https://www.vara.ae/media/Virtual%20Assets%20and%20Related%20Activities%20Regulations%202023.pdf" target="_blank" rel="noreferrer noopener">rule</a> means cryptocurrencies such as <a href="https://blockworks.co/news/crypto-mixers-and-privacy-coins-can-they-resist-censorship">Zcash (ZEC) and Monero</a> (XMR) won’t be allowed, nor can local entities create such coins. 



Japan similarly banned privacy coins in 2019 while a string of <a href="https://www.coindesk.com/markets/2019/11/26/another-crypto-exchange-is-dropping-privacy-coin-monero-over-compliance-risk/" target="_blank" rel="noreferrer noopener">exchanges</a> have delisted some offerings over the past few years, including Huobi and BitBay. Coinbase shed ZEC in the UK in 2019 and has so far avoided listing XMR altogether.



Among other rules, entities can’t describe themselves as virtual asset businesses unless they are licensed by the VARA to do so. Large proprietary traders that actively invest $250 million or more in crypto must register with the VARA.



Reasons for license revocation include violation of any directive or if an entity is insolvent. The regulator also sets fees for various services, in the range of 40,000 dirhams ($10,889) to 200,000 ($54,449) dirhams.



Violating rules related to market conduct can lead to fines of up to 20 million dirhams ($5.4 million) for individuals and up to 50 million dirhams ($13.6 million) for a virtual asset service provider, such as exchanges or payment processors.



The VARA’s regulations apply to virtual asset businesses and activities within the emirate of Dubai, including special development zones and free zones, but exclude the Dubai International Financial Centre which has its own regulator.



A recent report showed Dubai has attracted more than <a href="https://blockworks.co/news/dubai-free-zone-now-home-to-more-than-500-crypto-startups">500 crypto companies</a> to its digital asset ecosystem. But crypto-friendliness hasn’t exactly meant that the wealthy Middle Eastern city has been easy on new businesses wanting to set up shop.&nbsp;



Tim Buyn, global government relations officer at OKX’s parent firm, <a href="https://blockworks.co/news/crypto-seeks-freedom-in-the-uae-is-it-a-regulatory-rug-pull">told Blockworks</a> in August that the due diligence process “has easily over 100 data items or documents” that need to be turned in.



The VARA’s ambitions include positioning Dubai as a regional and international hub for virtual assets in a manner that would boost its competitive edge locally and internally. It also hopes that its business-friendly regulatory landscape would attract investments and motivate businesses to set up their operations in Dubai.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Privacy Coins To Be Banned in Dubai

Sebastian Sinclair

<div id="highlights-block_630f28259bd10" class="highlights">
 <ul>
 <li>Nitrokod is currently featured at the top of Google search results for popular apps, including Translate</li>
 <li>The malware maliciously mines monero using users&#8217; computer resources, echoing once-prolific CoinHive</li>
 </ul>
 
</div>



An insidious malware campaign targeting users searching for Google applications has infected thousands of computers globally to mine <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">privacy-focused crypto</a> monero (XMR).



You’ve probably never heard of Nitrokod. Israeli-based cyber intelligence firm Check Point Research (CPR) stumbled upon the malware last month.&nbsp;



In a <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">report on Sunday</a>, the firm said Nitrokod initially masks itself as a free software, having found remarkable success at the top of Google search results for “Google Translate desktop download.”



Also known as cryptojacking, mining malware has been used to infiltrate unsuspecting user’s machines since at least 2017, when they rose to prominence alongside crypto’s popularity.



CPR previously detected well-known cryptojacking malware CoinHive, which also mined XMR, in November of that year. CoinHive was said to be stealing <a href="https://www.checkpoint.com/press/2017/cryptocurrency-mining-presents-new-threat-business-says-check-point/" target="_blank" rel="noreferrer noopener">65% of an end-user’s total CPU resources</a> without their knowledge. Academics <a href="https://thenextweb.com/news/coinhive-mining-monero-profits" target="_blank" rel="noreferrer noopener">calculated</a> the malware was generating $250,000 per month at its peak, with the bulk of it going to less than a dozen individuals.



As for Nitrokod, CPR believes it was deployed by a Turkish-speaking entity sometime in 2019. It operates across seven stages as it moves along its path to avoid detection from typical antivirus programs and system defenses.&nbsp;



“The malware is easily dropped from software found on top Google search results for legitimate applications,” the firm wrote in its report. 



Softpedia and Uptodown were found to be two major sources of fake applications. Blockworks has reached out to Google to learn more about how it filters these kinds of threats.



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="935" height="445" src="https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp" alt="" class="wp-image-29655" srcset="https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=935 935w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=300 300w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=768 768w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=428 428w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=470 470w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=389 389w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=80 80w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=50 50w" sizes="(max-width: 935px) 100vw, 935px" /><figcaption>Image source: <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">Check Point Research</a></figcaption></figure>



After downloading the application, an installer executes a delayed dropper and continuously updates itself on every restart. On the fifth day, the delayed dropper extracts an encrypted file.&nbsp;



The file then initiates Nitrokod’s final stages, which sets about scheduling tasks, clearing logs and adding exceptions to antivirus firewalls once 15 days have ticked by.



Finally, crypto mining malware “powermanager.exe” is surrepticiously dropped onto the infected machine and sets about generating crypto using open source Monero-based CPU miner XMRig (the same one used by CoinHive).



“After the initial software installation, the attackers delayed the infection process for weeks and deleted traces from the original installation,” the firm wrote in its report. “This allowed the campaign to successfully operate under the radar for years.”



Details of how to clean machines infected with Nitrokod can be found at the <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">end of CPR&#8217;s threat report</a>.



Learn More: <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">Can Crypto Mixers and Privacy Coins Resist Censorship?</a> 



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.