The $10B Problem - web3 Security Against Coordinated Adversaries | Devcon Bogotá

foreign [Music] thank you everyone for joining this talk I'm Julia Hardy I'm here with Adam Hart and we're here from chain analysis to talk to you about the 10 billion dollar problem so we're looking at coordinated adversaries that are working within ethereum and the web 3 space first you might be wondering who is chain analysis why do we care about this issue she analysis is a blockchain analytics company so what we do is we take the raw blockchain data as well as inputs that we have from research and from services and we enhance that data so we cluster so we put different addresses that we know are controlled by the same entity together we also provide attribution and we put all of that together into our different products that we have and the one that we use as investigators mainly is reactor which is our blockchain visualization tool and so what we're doing in our day-to-day is we're looking at um what have been different exploits that have happened we're mapping out that activity on chain and when we're looking back at the past year it can feel like there's been an exploit every week if not every day in some cases some of these have been the larger Bridge our flights that have been discussed today um there's even the BNB Chain Bridge just last week there are things like the discords and the twitters that have been compromised and they end up having phishing links posted on them there are things like the Oracle exports that come out and what we do is we Trace what has happened with those funds and we look for patterns of activity and ultimately we're asking the question to ourselves do we think that these are all separate events that have occurred in the past year or do we see any coordinated attacks happening do we see that there are the same adversaries that are working and having multiple exploits in the space and as you might imagine from our title we do see some coordination here so first we're going to talk about the nation-state adversary and about North Korea and in the past you've probably heard that North Korea has been attributed to the Ronin bridgehawk but you might not know the extent of their activity and she announces has identified 42 different dprk hacks since 2016. and this is a total of 2.7 billion dollars worth of stolen funds so this is a pretty crazy number pretty large um part of the defy exploits that have occurred and when we look at what kind of exploits they are conducting we see that they're really following the money so originally there was most of the money concentrated in Bitcoin and then as ethereum has taken off as there's been D5 summer and yield farming and nft trading we see that dprk has shifted and they're focusing a lot more on stealing ether and erc20 tokens so this is a map of the flow of funds for the Ronin Bridge hack and this is really a high level view but you can imagine if you're zooming in each of these dots here is a separate address or a separate group of addresses and the lines between them are flow funds so you can see just how well coordinated this adversary is they are able to move funds 24 7 across blockchains through mixers and just are very well resourced and well understanding of how to launder in this space so we can also use those patterns that we see from Ronin from other hacks to be able to identify how dprk works so from there we can look at past hacks that have happened and say well do we think this was actually dprk are they following these same laundering strategies but we just didn't know before and we can also look forward and if a future exploit occurs we can take a look and say do we see these same patterns happening there do we think that this is another DPR connectivity and then hopefully ultimately help to prevent the flow funds to cash out points great um and so Julia just walked us through a very brief overview of some of the the North Korean activity and there's definitely been talks in this room earlier today about exactly how some of those uh you know those attacks are actually executed but uh what we really wanted to dive into in this session are some of the coordinated adversaries that maybe receive a little bit less media attention but are equally if not more damaging to the ecosystem so dprk definitely a major threat one that deserves all of the attention that it gets um it's just that on chain we we certainly see other activity as well so and Julia which one goes forward there we go um perfect so you know a common problem that we come across as Julia mentioned earlier uh is the you know sheer volume of hacks exploits other other event scams that occur um and the question that that we're always trying to ask is are these different entities that are all just copying each other or is this one coordinated adversary um because if it's a coordinated entity then they're probably more sophisticated more organized probably doing more damage um and the the attack vectors can vary so it can be something like compromised web 2 infrastructure we we just had a really great talk uh in this room about how how those sorts of exploits occur um but one of our questions is you know is this the same entity that's maybe uh going after DNS registrations or is it different entities and the same goes for any sort of compromise of say a Discord server or a popular Twitter profile a trusted method of communication that again you know tricks users uh into doing something that they they probably shouldn't be doing on the blockchain and uh the way we sort of approach this problem of you know identifying coordinated entities in the first place is a combination of traditional cyber security analysis so looking at things like what infrastructure is used in the attack you know what systems are compromised what's the specific attack Vector but then uh as as was just shown in the case of looking at North Korean activity uh but what we can also apply to sort of these other coordinated actors is looking at what occurs on the blockchain so this is where the the transparency of you know something like ethereum is really really useful to us as security analysts trying to sort of understand these Bad actors uh because we can look at things like how is the victim actually losing funds and that might be something really sophisticated like a re-entrancy you know uh exploit in in a popular smart contract or it can be something as simple as fishing for token approvals you know the the simple attacks sometimes are the most damaging uh but you know the the precise sort of payload can be very illustrative and help us understand these groups and then also we can track the funds after the attack occurs now unfortunately this is reactive this is after victims are losing money but again it can help us understand our our adversaries the the Bad actors on the blockchain better and start to map out the the true sort of scale of the challenge that we're up against here so to delve into that a little bit uh we actually wanted to spend a little time here walking through a case study of how how we approach this problem uh and also hopefully drive home the point that you know North Korea is definitely not the only coordinated adversary out there uh so the particular example here is something that we refer to as a uh you know tether usdt approval mining scam so to the folks in this room those words might not really make sense together right you know you don't mind anything with tether uh you know what's going on here uh but the essentially the the attack here is not targeting folks who are attending Devcon this is a targeting you know newer crypto users primarily targeting mobile crypto users folks who are maybe uh getting into the ecosystem for the first time the next billion users um but instead of you know engaging with a a normal you know dap or you know something interesting uh instead the users are maybe social engineered into going to a website maybe they have some tether in their wallet uh and they hear from a trusted friend that they met on the internet uh that there's this really great opportunity to make some money and they don't even have to send their tether anywhere because you know they you know red flags go up if you send your token somewhere but they just go onto this site they you know buy a little uh voucher to participate in this node mining um and from there they can start earning some pretty great rewards and everyone knows you know you can make some money off off of crypto that's that's always nice um however as was very well reported by the metamask security team it turns out that naturally this was not the the true application what was really happening here is when the users were going on to this uh website what they were seeing was you know some screen that said hey you're earning great rewards um all you have to do is buy a little voucher to claim those rewards but when they bought that voucher what they really did was approve another address to move the tether sitting in their wallet and again this is a really common attack Factor certainly not a new one it's been around forever but it still tricks a lot of users users don't understand what this approval is that they're signing and naturally once the bad actor gets the user the victim to approve their address to move their funds they can now clean out all the tether that's sitting in that address and what we can see thanks to the great work of metamask is metamask as a very popular wallet provider they've received lots of tickets from users who had been scammed and they noticed a trend on the off-change side they noticed a a similarity in how these users were being tricked they noticed similarities in some some of the domains being used to to you know trick these users and from that they published a awesome Doom dashboard showing 60 addresses that were scamming users IE 60 addresses that were being granted approvals from victims and those 60 addresses had managed to scam somewhere in the range of 83 million dollars over the course of a year now that's that's already in the range of some of the major Bridge hacks however we can go beyond this right because metamask as a wallet provider they're the first point of contact they're they're getting the reports from users but uh what we do as a blockchain analytics company is we try and build out patterns um so here with 60 addresses we can look in a variety of directions um so the reported scam addresses are shown here and one of the first things that we might do in investigation is say okay how were these different addresses funded how did they get the ether that they needed to execute transactions on the blockchain again this is one of many avenues that we pursue um but you know from there we might be able to identify related addresses and from there maybe we can start identifying some patterns maybe we noticed there are some addresses that appear to be testing these phishing scripts right they're they're testing the approval function they're funded from the same entities clearly related to what's going on here and uh with that pattern recognition by looking you know at the funding by looking at these these uh you know testing patterns and others we can start to identify additional addresses that are receiving approvals from victims that are following this exact same pattern of getting that approval from the victim and then transferring the tether out everything looks alike um and so now you know we're starting to expand our our understanding of the adversary here where things really get interesting though is when adversaries are are coordinated and organized as is the case here um this is a persistent scam that that's uh you know lasted over a year there is some point of con you know consolidation some pattern we can identify and we identified a consolidation Point here funds were being gathered in a very specific Manner and from that consolidation point we can really start to understand the true scale of this scam and it turns out uh that when we really mapped out this scam and certainly the mapping is not complete here uh we were able to go from the 60 addresses that metamask reported from from their victims um to 91 additional addresses that we identified doing the exact same thing where we are very confident that they're all controlled by the same entity so these 91 addresses plus the original 60 addresses they take victim funds and they spread them out to all sorts of addresses they spread them out to 879 other addresses um so already we're again seeing a very clear laundering pattern as Julia we'll get into in just a moment but you know we we can start to map out where those funds go and additionally we can identify how many victims are actually being hurt by this scam so metamask in their original Doom dashboard which again you know they they did a fantastic job publicizing this um and you know we wouldn't be able to get started without their work but here we were able to identify more than 11 000 additional victims and this is where these sorts of persistent scams although less technically sophisticated than something like an exploit really damaged the community because now we've got over 20 000 likely victims and these likely victims are probably first-time users and they're going to go tell all their friends that you know their only experience in crypto is getting scammed uh so you know this is a real problem and certainly you know the scale is pretty shocking as well but to truly understand the scale of of these sorts of scams we also not only have to map out the infrastructure being used to scam victims but also where the funds go after the attack and for that I'll pass it back over to Julia yeah so looking back at where do the funds go once they have been stolen and gone to those recipient addresses we see a really clear pattern of activity and what we're going to show here is just one example but you can just imagine it across hundreds of addresses so first we see that the funds are received from the different victims and then spread across a few different addresses they might be doing that to provide liquidity within the other addresses that they have within this network they might be doing that to obfuscate the flow funds we can't really be certain but what we do see is after that initial spreading out we see a consolidation point and this is just one address or one line here from one address but imagine that there are tens of different addresses hundreds of different addresses that are all consolidating to this one address right here and consolidating all those different victim funds then we see the funds move to New addresses and preparation to start to interact with exchanges and once we get to the exchanges at the bottom the numbers are pretty staggering we see 10 million going to a single deposit address at an exchange on one line there 31 million add another and when we tally up all of those different values that we see from this flow funds we end up finding 143 million dollars worth of additional stolen value so in combination with what metamask initially provided we have a 227 million dollar scam this is by this point in the top five B5 exploits category and this is just from all the different victims all the different users that in aggregate are ending up being just as big of a of an activity now this is the known value when we look at that entire network and look at what funds are actually going to exchanges we see 1.2 billion dollars so we can't know without further investigation that all of those funds are coming from this one tether scam but it shows what the upper bounds of this scam value could really be the other thing is that we do see that on-chain coordination we see that the same recipient addresses are being used across different transfer from scammer addresses so we can we see the consolidation points we know that there is definitely some coordinated activity here and that there is one actor behind at least the majority of this exploit and we can take this a step further so we can do probabilistic analytics on other addresses and say do we see other addresses that are showing the same pattern of activity as the ones that we've manually identified and with that we see another 375 potential addresses so this is just one example of us working with metamask to find the scam and find its full levels but really we want this to be a starting point and we really want all of us as a community within the security space to try to work a lot more closely together and we can raise the cost for Bad actors by trying to use some of these different points um this is something that is not just unique to us we know that those that are working in the ransomware space have done a good job with trying to work a lot more collaboratively and we think we can do a lot of the same things here so trying to have more data sharing between the victims and the incident response firms trying to use blockchain analytics more and focus on that combination of off-chain and on chain together trying to have more public private collaboration and trying to identify Trends and share that research with each other so we're all kind of working right now a little bit more in our own silos but maybe we can start a conversation about how we can start to communicate more and try to use all these assets that we have to our advantage to prevent the next year having quite as many exploits as this year so with that we thank you very much we would really like to talk with each and every one of you after this if you have any ideas about how we can collaborate or where we should take this from this point here definitely feel free to follow us and reach out to us I think we have a couple minutes if anyone has any questions offhand oh yeah so the question was um in the traditional cyber security space uh we we talk about you know apt's advanced persistent threats whereas we use the term coordinated adversaries um we didn't want to confuse the the cyber security side of things because maybe some of these coordinated adversaries aren't you know really at an advanced super tech sophisticated threat but mostly it's just terminology of choice yeah so in the case that we saw here we um we were presented something that was not supposedly uh looking like it came from the Lazarus group or the dprk but why why does this not look like it comes from from the DPR care of the Lazarus group I mean exactly for the reasons that we were talking about so using that off chain and on-chain pattern and from what we have historically known how um Lazarus tends to provide spear phishing or use certain methods off-chain how they tend to launder on chain it just isn't following that pattern foreign thank you for the talk today uh briefly you mentioned that you used uh checking how wallets were funded as a means to investigate what were the other tactics that I heard you say we use other tactics what are the other tactics that you use yeah I'll take that one so my my day job is actually to to run training courses on that unfortunately it's going to take like eight hours to to really get to delve into that one um but you know there there's a lot of different directions to look in generally we we look both forward and backwards to see you know where the funds are going where they came from and then you know a lot of times with a persistent group like this there's some sort of testing effort as well mapping out the testing effort can be often very illustrative um but you know we can definitely chat more on the side foreign I think we can do one more probably so so the question was uh with respect to to you know uh ZK Roll-Ups and and other DK chains um you know how does that potentially interfere with blockchain analytics uh it it definitely depends I'll I'll give you the the non-answer there um different chains come with with different considerations there uh but you know as as our co-founder stated you know these groups especially Lazarus are moving something like 600 million dollars in a shot like that's that's kind of tougher to hide so if you're operating on that volume it's it's hard to hide that amount well thank you everyone and definitely feel free to find us later