Rug Life: Using Blockchain Analytics to Detect Illicit Activity, Track Stolen Funds, and Stay Safe

foreign [Music] my name is Heidi I'm a part of the special investigations team at coinbase and I am super excited and also very honored to be able to present to you guys at Devcon rug life using blockchain analytics not only to detect illicit activity but also to track stolen funds and hopefully stay safe and I really like the previous presentation actually right before mine because it was all about sort of detection right but this is about once your funds kind of get stolen what do you actually do so quick tldr I know we all don't have time to be sitting around a panel all day so if you've got places to go tldr is be paranoid be paranoid that is literally the end of this presentation the rest of this presentation is going to be full-on paranoia mode you're going to want to lock down everything throw out your computer and just give up on this but if you want to stick around for the rest of it let's go for it so first and foremost we need to find what illicit actually is right there are a lot of people who say oh scammers are illicit dark markets are bad beths are also Bad true Traders you know who do Market manipulations they're also bad oh fact entities more recently also bad like we've got a whole like swath of different Terrible Bad actors out there but today we're only going to be concentrating on one which is theft I personally believe that thefts are like the worst thing that can happen with this ecosystem right first and foremost you see millions and millions of dollars like just last night we saw 100 million dollars being drained out of mango Finance right that's horrible for the entire ecosystem doesn't matter what chain it happened on right not only that but it also drives more regulator scrutiny do we really necessarily want that we want to be able to develop right we want to be able to build without having to even consider things like that so this is why we need to start thinking about things like how do we prevent this kind of stuff now I don't want to spend that long on this I think we need to talk about different theft typologies out there now I largely bucket into three different sort of categories first and foremost you have the dev team initiated thefts right AKA we all know these rugs right what does a rug actually look like first and foremost you've got some token dumping you've got unlimiting or even limiting usually of functions as well as cashing out of any and all proceeds possible now sometimes with rugs what will also happen is websites will 404 and obviously social media accounts will go totally dark now the biggest bucket though are third-party thefts right and those I actually put into two different categories first and foremost you've got hacks right third parties hack into places all the time right for example let's think of these different Sexes that have been hacked in the past couple of months right and also you've got another thing called Market manipulation as we all know like with mid what happened with mango last night now what exactly do we Define as a hack well a hack is very similar actually to a rug right the only different friends I would say In This Very generalized sort of rule of thumb is that with a hack you usually don't have the website of the team the social I don't know it is not working um this video of the team also going down um so you don't have that actually happen with a hack now um but what you do see is obviously the cashing out and of proceeds extremely extremely rapidly and obviously The Dumping of funds now in terms of Market manipulation what usually happens there is a is usually a flash loan will be taken out nine times out of ten and what will happen is there's a certain pool is manipulated right where one token's price is arbitrarily pushed up for example what happened last night with mango right price automatically gets pushed up then suddenly a dumping of that mango right and then in exchange for tokens that you know actually have value and finally there's another bucket of thefts right and I'm not going to go too much into these but these are sort of more third-party service attacks so think of for example when you you're in a Discord right you're managing a Discord you probably have a whole bunch of different Discord Bots out there right they're doing a whole bunch of different things but sometimes those Discord Bots get exploited meaning that you know people who are investing in your projects sometimes fall for those exploit and then unfortunately you get their funds siphoned off of them and then they blame you which isn't really fair but it definitely happens now I actually want to go into detection methods like how do we actually detect this kind of stuff how do we find this stuff right and so there are a lot of ways to do detection Forda just did an amazing presentation on how they go about doing detection but for as a protocol what you want to do is you want to actually just set up alerting for large flows of funds that's actually something that the Florida does another thing you can do as well is use various different platforms that have listed on here to actually start you know alerting you for when sort of any sort of strange activity happens finally another thing you might consider doing is following a whole bunch of Auditors online because chances are on Twitter the Auditors will alert you probably before you know you know even your most Avid Twitter followers alert you of something strange happening now unfortunately this is all fine and great but once a transaction is broadcast to the blockchain you're screwed right you're done for so this is great we can detect this all day every day but we need to actually prevent this stuff right and so what we need to actually do is we need to start detecting this sort of weird kind of activity before any money starts to move right and so if you're a Dev there are a couple things you can do first off you want to constantly audit right your debits and credits and I know this sounds super effing oh I just got one out again um I know it sounds super boring but for example Nomad they would have been able to detect some strange stuff happening going all the way back to July and they could have probably prevented what then ended up happening at the beginning of August now another thing you might want to do too is Monitor who's transacting with your contract what are they actually doing with their funds right and finally another thing too is you want to be monitoring your site's back end but also your site's front end for example seller Bridge that's actually how they were exploited more recently right is their front end was attacked now this is all great but if you're an investor right this means nothing to you like you're not going to be debiting and crediting a particular like protocols smart contracts that's not your job right so what should you be doing well one thing you can do is make sure you know what contracts you're actually interacting with right so when you're on metamask and you are trying to do a transaction before you click that button make sure that the contract is indeed the contract you want to be transacting with finally um or next rather revoke cash so for example when you interact with a contract right you before you interact with that thing to send your tokens anywhere you have to allow those tokens to be moved right now when you allow those tokens to be moved with that contract you're granting that contract license to move them you want to revoke those every once in a while because chances are those contracts you interacted with back in 2021 or even 2020 they might not even exist anymore right you don't want to have anything to do with them right so revoke those I would say just clean them out probably every once a month or so probably and last but certainly not least is you want to monitor the social medias of your projects right and as well as all of the wallets that you hold I know this is exhausting and annoying but it's also one way to also stay a little bit more safe now I want to get to the most fun part of this presentation which is actually tracking the funds so let's say your Project's wrecked right like suddenly all the funds have been siphoned off or let's say you're an investor and you invest actually in a project and oh damn their money is all gone what happens like can I even do anything right so I'm not going to be boring you guys with many more bullet points on slides don't worry this is the last one but um first and foremost you want to learn how to read etherscan right there's no point in like pretending to track funds if you can't re-eat their skin right and I know etherscan is painful to read as arvestgan is is snow Trace all the other ones are but it's super super important to learn how to read a block Explorer another thing too is once you learn how to read a block Explorer you're going to be much more Savvy with blockchain analytics tools like Dune and bloxy and whatnot and they're going to be able to help you track on those funds further now there are a whole bunch of other tools out there that I haven't listed on this slide but yeah these at least at the very least are free and open source um now another thing you can also do as well is leverage Twitter investigators but I say that with a massive caveat so there are a lot of really amazing Twitter investigators out there right and I think we probably all know their names right but there are also some overzealous researchers as well and I saw this in fact actually last night with a mango exploit there were several people who called out several different addresses but were indeed not related to the mango Finance exploit um so yeah it's kind of frustrating at times for people like me when I'm going through this and I get pings from all sorts of people about things so yeah leverage them but do it cautiously the biggest point on here though that I want to make is if you do have a project that gets hacked right or if you're part of a project that gets hacked what you want to do is immediately reach out to law enforcement so ic3 is with the FBI and you can file a complaint with them um and they're they're quite good at tracking down funds um this is regardless of whether or not you're us-based because chances are you probably have an investor somewhere in there in your project who might be us-based so I would go ahead and file it with them as well as obviously whoever your local law enforcement is now the next biggest point on here is if you are a Dev and your guys's project gets hacked you want to communicate communicate communicate because the worst thing is you're silent right and then all of your investors are sitting there like what the hell is going on oh my God oh my God oh my God and then immediately the flood starts and immediately people are like oh my God the project got rugged and then all the rumors the rumor mill begins right so you want to communicate as much as possible as much as you possibly can and I know you're going to probably hire lawyers and whatnot but try to communicate as best you possibly can now I want to get you guys prepared for uh my favorite thing which is story time because I want to actually give you guys a good case study and unfortunately this is not going to be a nice story time this is going to be a nightmare story time we're going to be talking about the Ronin theft that happened earlier this year I'm sure we all know about it but about 600 million dollars was stolen from the Ronin bridge and what effectively happened was these guys stole all this um eth um and as well as usdc from the Ronin bridge I think it was like 173 000 and they had all this eth right what did they do with it first and foremost what they did with it is they started cashing it out at various different Sexes now this was also around the same day where the Ronin Bridge came out and they finally announced that they had been exploited and what do you think the attackers did they had to immediately stop because the Sexes then caught on like oh dear God we're being used to cash out of these terrible proceeds we gotta stop this and of course the attackers then also pause too right and then two weeks later they start mixing funds through tornado cash right and all of this ethos flows through tornado cash now one thing I have to mention is this was a ton of eth right I just mentioned it's 173 000 each this is a ton of money I had never seen this much money flow through tornado cash so the sheer volume was already unprecedented but the other thing that was also crazy too was these guys were rinsing and repeating the exact same methodology over and over and over again right so what they would do is they would mix the money through tornado cash and then they would they would then swap it using the same decks over and over again to Ren BTC which is a Bitcoin proxy right and then after that what they would do is they would burn that brand BTC in exchange for Bitcoin and this happened Time After Time After Time day after day and I mean we're all human right these attackers are human right and so we like a good pattern and it's one thing that you'll notice in this presentation is that patterns get repeated all the time and that's the part of doing and analytics and tracing funds right is you start to notice these typologies over time now what happened with this Bitcoin this Bitcoin was then sent on to chipmixer and you guys might know chipmixer chip mixer is a Bitcoin mixing service now when I look at chip mixer I think to myself oh my God that's so 2019 no one uses chip mixer anymore like there are so many better Services out there right and of course again why am I saying that so 2019 right well what I'm essentially saying by that is there's no liquidity in there right you want a deep liquidity pool when you actually care about privacy right because you don't want to be found out you don't want people like me to go looking for you right and of course these guys had a ton of money that was flowing through chip mixer right so what effectively happened was is unfortunately we could trace through it and a lot of it went to an APAC based sex but not all of it so not all of the funds actually were mixed this way this was only their pattern in May and by the way we're going to skip all of the patterns that happened in June and July and we're gonna go straight to the pattern that started in late August and is continuing to today so some of that Bitcoin that they had what they started actually doing in this is late August beginning of September they started splitting it out into these weird increments of rounded five six seven and eight BTC right they split out all these funds what do they do with it send directly to Ren mint some Ren VTC great right this is a very very very easy pattern to detect on chain right and from there what they did was they used the decks they swapped it into ustt and then they got a little confused Midway they wanted some eth go back into usdt and they ended up cashing it out at otc's in butcher Sexes and they continue doing this pattern right through September it was the I mean it was very very obvious right even if you were to just look at Ren BTC based mints you'd be able to find this stuff what they also did is they got lazy in between and just cashed out directly from tether now one thing that you'll notice is that I have usdt and eth written on here right and for those of you that are Savvy you're like hey wait a second Heidi what about gas fees did you did you get anything out of gas fees Yes the gas fees actually originated from those Sexes right here right so it's a very roundabout pattern that we end up seeing so what also ended up happening as well is they had this large sum of Bitcoin and they got super super lazy and they started just cashing it out directly to Sexes and then they decided to get unlazy because unfortunately some people found them and they decided to go back to the ren BTC route and then do the same thing over and over again right now what am I trying to take away with this case study that was a lot right this was overwhelming now what I'm trying to help you with this is blockchain analytics ain't easy it's quite complicated and trying to recoup stolen funds is no joke right it's not only extremely costly it's very very very time consuming right I've been tracking these guys literally or Yeah March right and not only that but the amount of funds that you know the whole like crypto Community has been able to recoup has been so limited right so you don't want this to happen now luckily we do have the transparency of the blockchain right now which allows us obviously to trace funds right the fact that it's permanent it's immutable right and it's fully transparent awesome right but it doesn't change the fact that tracing this money is a lot more work down the line than actually trying to prevent the bad activity now let's go into actually what we can do about this right I hope I scared you guys enough um now we've got the crazy slide that I actually want to take a pause on and I want you guys to actually take a picture of because I'm not going to be talking about it because I want us to actually talk through case study examples so on this slide we've got lots of different recommendations in terms of General stuff blockchain stuff social media email stuff and doing your basic due diligence I.E d-y-o-r cool we all got our photos awesome okay worst case um I can share the slides with you after the fact now I want to share a couple examples um with you guys and I want to share an example of being impulsive and not checking the contracts that you're interacting with before you interact with them now back in April um board API clubs Instagram was hacked I'm sure you guys remember this right their Instagram was hacked suddenly there was like this announcement of like oh we're giving away this land all you have to do is if you hold an ape this meant this Lan token and of course people fell for this right they didn't actually look at the correct that they were interacted with and what happened well sure enough you can imagine what happened all of their most prized nfts were ripped from them right and one thing that was very noticeable when looking at this initial contract is that there was this set approval for all function that kept on being called by these addresses that had been fished over and over and over again rapidly and when you see this on chain run run from that contract right because what that effectively that contract products being run by some sort of phishing a person who's doing phishing now these nfts were immediately sold for Ethan a whole bunch of different marketplaces right and then after that the eath was cashed out a bunch of sexes immediately right really good then also it was sent to the Ukrainian Armed Forces that's interesting maybe that tells us about where the threat actor might be we'll see in just a second and then we also see that they're sending money to a karting shop so they're clearly buying fake IDs right probably using those fake ID to sign up for those Sexes interesting right now remember how I talked about those gas fees those are something you want to look at when you're initially interacting with a contract right so you can see where did they initial get will you get their funds from and if you take a look at that East right the original like that paid those topped up that address to initially get those gas fees you'll actually find that that address indeed also did a whole bunch of different fishing and made a ton of money right great what else can we find out about this address one thing that I found that was really interesting with this particular dress it also cashed out a whole bunch of sexes as well was that it also sent money to this very interesting social nft marketing page right so essentially what you could do is you could pay this money to Market your nft project on various different social media websites interesting I don't think that's Ukrainian right there right and my perspective actually is is these probably is guys probably actually just donated to the UK in armed forces in order to pay probably throw people like me off of their tracks right and so this is one very very easy way to do it because as we all know that address for the Ukrainian Armed Forces is tagged on etherscan right so it's very very obvious so this is an example of being impulsive and this is what you don't want to do so take those two minutes literally two minutes right and look at that address before you interact with it right look at what those other addresses that are sending funds are actually doing right or they actually like are they actually getting something for it are they actually minting any land are they getting nothing out of it right now I also want to talk about an example of social engineering this has nothing to do with blockchain analytics yet but it will right so here's a great example from Poly play and they were amazingly transparent about their exploit that happened last year this is actually on what from one of their tweets um as you can see here uh the finance team reached out to Poly play in order to pretty much list their token right and as you can see is this looks pretty you know legit in terms of a you know LinkedIn page he's got like 400 some odd followers this seems like a pretty legit email or whatever it is but there are a couple funky things with it right first off they're asking they're saying hey you know please donate to the binance charity Foundation that's a little weird right like and they're asking donation in Bitcoin too I don't know that's a little sus right um so it's one thing that you want to kind of look at right when you're looking at um people who reach out to you is verify indeed their identities right for example if you look up Teddy Lynn right now on LinkedIn I'm sure this isn't the only Teddy Lin of Finance you're gonna find right and so it's one thing that you're going to want to do you're going to want to verify with these teams before you know you start interacting with them right because the worst thing is is you get down the line they send you over documents to agree to you download that document and that document includes a whole bunch of malicious code and your whole project gets screwed over right and what's interesting about this particular social engineering incident is that Poly play ended up getting hacked right because of all of this and what happened well if you looked on chain you'll actually find that the Poly play hack is related to the bzx hack that happened back in November and also a link to the mgnr.iohack as well and if you look backs up what you'll end up finding is all of them fell for very similar social engineering tactics so this is a common one used by many nation states actually one in particular and you guys can guess who that might be now one thing we talked about before is what's the difference between a hack and a rug right but I actually want to about what is the difference between an actual Dev team cash out and a rug because a lot of times Dev teams I mean a lot of times Dev teams need to cash out of their funds right they make money they need to be able to move their money around and do things that maybe not not isn't crypto right how do they actually do that and I want to give you guys an example of how legit team looks like when they're Cashing Out versus an illegit team because I think the the comparison is quite Stark so in this example what we have here is we have 10 ktf which is a very large nft project they get proceeds right from their nft sales and you can see that on chain and all of those are then sent to the 10K TF deployer address that deployer address then sends on to their gnosis multisig fine that seems fair right another thing that we also see too is renga deployer they also send funds onto our gnosis multisig so if you weren't following projects which I wasn't I had no idea these projects were intertwined actually until I was looking at their gnosis multi-sig and actually found oh wow they're clearly a part of the same ecosystem right and if you take a look at their gnosis multisig and by the way this is a great practice right you want to see a project using a multi-zig and keeping their funds locked up there they sometimes will actually Cash Out directly to FTX right but they do this over time right their website is still active their social media is still active these guys are still clearly involved with the community right so nothing weird is going on here this is the kind of activity you want to be seeing when you're analyzing on chain seeing where devs are cashing out at now what do you not want to see this is exactly what you don't want to see so I'm sure you guys heard about the squid Game Rug pull last year but essentially the squid team token launched right on the BSC Network and um what effectively happened was you couldn't trade this squid token so you could only trade it uh you could only buy it with BNB because it was on the pan it was on pancake swap but you couldn't sell it so effectively what happened was the price was driven up to like twenty five hundred dollars right and suddenly one day the website 404s all social medias are gone all social medias are deleted right and suddenly then the squid token is swapped for B and B and fully dumped right suddenly the squid token now is valueless now one thing the devs did right here though is they decided to unlimit that contract so this suddenly you could actually sell your squid but of course it was worthless so who cared at that point in time right and so anyways you had this B and B right these guys then decided to rapidly send that BNB through tornado right and again this was a very high volume going through tornado at that point in time so it was kind of traceable now there's one thing to note about privacy protocols privacy Protocols are incredibly important I'm not trying to be a proponent here in this presentation to say oh you know we can demix everything you know or whatever but what I am trying to say about privacy Protocols are that unfortunately illicit actors while they do use them it is quite easily traceable to see where they're moving funds to because usually they move a ton of money at once and why do they do that because they're paranoid they don't trust anyone with that money but themselves so the sooner they can get that money out the better right privacy Protocols are incredibly important and I think we're going to still continue seeing in the them in the space in fact I've been super excited to see all the ZK Stark discussion here right um but effectively all these funds then went through tornado cash and again these guys rinsed and repeated the exact same transaction patterns because once they got that B and B out what they immediately did and this is all in one single transaction every single time was they would swap that B and B uh for die right and this is still on BSC and they would bridge that die through any swap then into each base die or on other stable coins right and this was a very very very particular pattern so it was super super obvious now once they had this die in this eath-based die what they end up doing with it well this each base die they ended up swapping for ease and then they sent it through tornado one more time on ethereum right and they could not be more paranoid right but of course they're moving this money through super super fast again super obvious now one thing I've noticed actually about uh these attackers more recently is and especially in the squid game situation right as you guys remember this particular rub was super super known right this was all over mainstream media right so this guy was Super Hyper paranoid right so what he decided was this oh I'm just gonna sit on this money for a while but he just didn't want to sit on that eat no no no no he wanted to earn some yield so he decided to swap that money in a usdt and lend it to the usdte's pool and then he also lented out the compound and from there he sat pretty for a while and then slowly started cashing out to uh two different APAC based Sexes right and this is actually a pattern of activity that I've continued seeing quite often unfortunately now what it's an unfortunate but also fortunate right because once they're sitting in these pools we can still see that that's the beauty of the blockchain right and so because of that is once they exit out right it's kind of great because we can also potentially recoup all the interests that they've earned so it's one thing to also think about now I want to leave you guys with a couple predictions because I only have a couple minutes left is and by the way I wrote this slide deck a week ago this was before the BNB Bridge attack this was also before mango Finance but unfortunately this is now reality we expect we see hacks and scams continue even in the bear market right D5 protocols particularly those with high tvl right will continue to be perceived unfortunately as honey pots right and threat actors as I was talking about before they're mainly going to continue sitting on funds right that's actually what we're seeing with the BNB Bridge attacker right now he's just sitting on the funds we see that actually with quite a few different attackers at the moment right and to possibly earn yield right for example if you take a look at mango Finance guy what do you think he's investing in right now I'm not going to say you guys look it up anyways some quick break predictions right first and foremost be paranoid right hopefully this has been a lesson in paranoia here and you want to protect yourself before something happens right you don't want stuff to be broadcast to the chain right that is the like that is the ultimate like thing that you do not want to have happen because once it's broadcast to chain it's done right money is gone right and of course you want to do your own research that should be obvious right do not rely on other randos to do research for you and just believe them because they're anons on Twitter uh that you know what they're saying is correct you want to verify and last but certainly not least definitely learn how to read a block Explorer block explorers are extremely powerful and all of this research I actually mostly did using Dune analytics and just etherscan as well as be a c scan a couple others and don't forget to set up monitoring and uh that's all thanks guys [Applause] [Music]