Defi bugs to steal cryptocurrency

The U.S. Federal Bureau of Investigation (FBI) is warning investors that cybercriminals are increasingly exploiting security vulnerabilities in Decentralized Finance (DeFi) platforms to steal cryptocurrency. Hackers managed to steal $1.3bn in crypto in just the first three months of this year. Some 97% of these funds were stolen from DeFi platforms, up from 72% in 2021 and 30% in 2020, it claimed.

The FBI has observed cyber criminals exploiting vulnerabilities in the smart contracts governing DeFi platforms to steal investors' cryptocurrency," the federal law enforcement agency said. Many of the raids on cryptocurrency in recent years have been tied back to state-sponsored actors, most notably North Korean operatives.

Attackers have used various methods to hack and steal cryptocurrency from DeFi platforms, including initiating flash loans that trigger exploits in the platforms' smart contracts and exploiting signature verification flaws in their token bridge to withdraw all investments.

The agency has also observed cybercriminals manipulating crypto price pairs by exploiting chains of vulnerabilities, including the DeFi platforms' use of a single price oracle and then conducting leveraged trades to bypass slippage checks. Oracles are third-party services that allow smart contracts within blockchains to receive external data from outside of their ecosystem.

In fact, it is claimed that Pyongyang stole $400m in crypto assets in 2021 alone. The FBI also linked the $618m heist at Ronin Network in March – the biggest theft of cryptocurrency in history – to North Korean actors.

The Feds also warned investors to avoid DeFi investment pools with limited joining timeframes and rapid deployment of smart contracts, as well as those that use open-source code. Back in July, the US State Department increased its reward for information on North Korean state-backed hackers to $10m. Pyongyang has also been blamed for the theft of $281m from Singapore-headquartered cryptocurrency exchange KuCoin in 2020.

As per the source, in 2019, a UN report claimed that the Kim Jong-un regime had stolen $2bn from banks and crypto-exchanges to fund its weapons of mass destruction programs.

S Mohini Ratna, Editor, VARINDIA