Edward Kiledjian

Cryptocurrencies have transformed the financial landscape, creating exciting opportunities for innovation and investment. However, they have also opened the door to a new wave of cybercrime. As a CISO, understanding how these threat actors exploit digital assets is crucial. Let’s delve into the lifecycle of cryptocurrency in the world of cybercrime—from acquisition to cash-out—and identify the key players driving these malicious activities.

Acquisition: Theft and Extortion

Cybercriminals primarily acquire cryptocurrencies through two methods:

1. Direct Theft: Hackers exploit vulnerabilities in cryptocurrency exchanges, wallets, and DeFi platforms. In 2022 alone, cybercriminals stole over $3.8 billion worth of cryptocurrency across 125 system breaches.

2. Ransomware: Many ransomware groups demand payment in cryptocurrencies. The WannaCry ransomware, for example, infamously used Bitcoin as its ransom currency.

Obfuscation: Making Crypto Untraceable

Once acquired, criminals deploy various techniques to obscure the origin of their stolen assets:

1. Crypto Mixers: These services, also known as tumblers, mix potentially identifiable cryptocurrency funds with others, making them harder to trace. ChipMixer, for instance, laundered over $850 million before being shut down in March 2023.

2. Chain Hopping: Criminals convert one cryptocurrency into another, often multiple times, to break the transaction trail and cover their tracks.

3. Scam Tokens: Some cybercriminals invest stolen crypto into new scams or fake tokens, further muddying the transactional waters.

Cashing Out: Converting Crypto to Fiat

The final stage involves converting cryptocurrency into traditional currency:

1. High-Risk Exchanges: Criminals often use exchanges with lax know-your-customer (KYC) and due diligence regulations to cash out. These platforms may operate in jurisdictions with minimal oversight.

2. OTC Brokers: Over-the-counter brokers on exchanges like Binance and Huobi have been identified as key facilitators in the laundering process. In 2019, just 810 accounts on these exchanges received over $819 million in Bitcoin from illicit sources.

3. Fraudulent Identities: Some criminals use stolen or fake identity documents to cash out through regulated exchanges, bypassing KYC procedures.

4. Peer-to-Peer Platforms: These platforms allow direct crypto-to-fiat transactions between users, enabling criminals to potentially avoid centralized exchange scrutiny.

5. Crypto ATMs: While less common, some criminals use Bitcoin ATMs to convert crypto to cash, especially in jurisdictions with looser regulations.

6. Fiat-Backed Stablecoins: Criminals often convert illicit crypto into stablecoins like Tether as an intermediary step before cashing out to fiat, as these tokens are less volatile and widely accepted.

Key Players in Cryptocurrency-Related Cybercrime

Several Advanced Persistent Threat (APT) groups have become notorious for targeting cryptocurrencies:

1. Lazarus Group (North Korea): Known for high-profile heists, including the $625 million Ronin Network hack in 2022.

2. APT38 (North Korea): Specializes in financial cyber operations, including cryptocurrency theft.

3. APT41 (China): Engages in state-sponsored espionage and financially motivated cybercrime, including cryptocurrency theft.

4. Cobalt Group: Eastern European cybercrime group targeting financial institutions and cryptocurrency exchanges.

5. FIN7: Financially motivated threat group that has expanded operations to include cryptocurrency theft.

State Actors in Cryptocurrency-Related Cyber Operations

Several countries have been associated with cryptocurrency-related cyber activities:

1. North Korea: Heavily involved in cryptocurrency theft to evade sanctions and fund state operations.

2. Russia: Some state-sponsored groups have been linked to cryptocurrency-related cybercrime.

3. Iran: Associated with cryptocurrency mining and theft to circumvent international sanctions.

4. China: Some state-sponsored groups have been involved in cryptocurrency-related espionage and theft.

The Scale of the Problem

The scale of crypto-related cybercrime is staggering. Between 2016 and 2022, criminals laundered an estimated $33 billion worth of cryptocurrency. In 2021 alone, illicit activities accounted for $14 billion in cryptocurrency transactions, representing 0.15% of all crypto transactions that year.

Combating Crypto Crime

As cybersecurity professionals, we must stay ahead of these trends. Here are some steps we can take:

1. Blockchain Analysis: Leverage tools like Chainalysis to analyse blockchain transactions and gain insights into criminal activities.

2. Enhanced Due Diligence: Exchanges should implement rigorous KYC processes, especially for OTC desks and nested services.

3. Collaboration: Foster partnerships between law enforcement, regulators, and cryptocurrency platforms to share intelligence and best practices.

4. Education: Train your team on the latest crypto-related threats and mitigation strategies.

As cryptocurrencies continue to evolve, so too will the tactics of cybercriminals. By staying informed and proactive, we can work towards creating a safer digital financial ecosystem.