jakiro
Source: Chainalysis; Compilation: Tao Zhu, Bitchain Vision
Cryptocurrency hacking remains an ongoing threat, with over $1 billion worth of cryptocurrencies stolen in four years of the past decade (2018, 2021, 2022 and 2023).2024 marks the fifth year to reach this disturbing milestone, highlighting the amount of stolen money that can be increased as cryptocurrencies adoption and prices rise.
In 2024, the stolen funds increased by about 21.07% year-on-year to US$2.2 billion, and the number of personal hacking incidents increased from 282 in 2023 to 303 in 2024.
Interestingly, the intensity of cryptocurrency hacking has changed around the first half of this year.In our mid-year crime update, we noticed that the cumulative value of the stolen between January 2024 and July 2024 has reached 1.58 billion yuan, about 84.4% higher than the stolen value in the same period in 2023.As we can see in the chart below, by the end of July, the ecosystem is easily on track, a year that rivals over $3 billion in 2021 and 2022.However,The upward trend of cryptocurrency theft in 2024 slowed significantly after July and remained relatively stable afterward.Later, we will explore the potential geopolitical reasons for this change.
In terms of the amount of stolen by victim platform type, there is also an interesting pattern in 2024.Decentralized Finance (DeFi) platforms are the primary target of cryptocurrency hackers in most quarters from 2021 to 2023.DeFi platforms may be more vulnerable because their developers tend to prioritize rapid growth and bringing products to market rather than implementing security measures, which makes them a primary target for hackers.
Although DeFi still accounted for the largest share of stolen assets in the first quarter of 2024, centralized services were the most targeted in the second and third quarters.Some of the most well-known centralized service hacks include DMM Bitcoin (May 2024; $305 million) and WazirX (July 2024; $234.9 million).
This shift from DeFi to centralized services highlights the growing importance of security mechanisms commonly used by hackers, such as private keys.In 2024, private key leakage accounted for the largest proportion of stolen cryptocurrencies, reaching 43.8%.For centralized services, ensuring the security of private keys is crucial because they control access to user assets.Given that centralized exchanges manage a large amount of user funds, the impact of private key leaks can be devastating; we only need to look at the $305 million DMM Bitcoin hack, one of the largest cryptocurrency vulnerabilities to date, which may beArises due to poor private key management or lack of sufficient security.
After the private key is leaked, malicious actors often launder the stolen funds through decentralized exchanges (DEXs), mining services, or hybrid services, thus confusing transaction trajectory and complicating tracking.By 2024, we can see that the money laundering of private key hackers is very different from those of hackers who exploit other attack vectors.For example, these hackers often turn to bridge and hybrid services after stealing private keys.For other attack vectors, decentralized exchanges are more commonly used in money laundering activities.
North Korean hackers will steal more money from crypto platforms in 2024 than ever before
North Korea-related hackers are notorious for their complex and ruthless means, often leveraging advanced malware, social engineering and cryptocurrency theft to fund state-funded operations and circumvent international sanctions.U.S. and international officials assess that Pyongyang has used stolen cryptocurrencies to fund its weapons of mass destruction and ballistic missile programs, endangering international security.By 2023, North Korea-related hackers will steal about $660.5 million through 20 incidents; by 2024, that number will increase to $1.34 billion in 47 incidents, with the stolen value increasing by 102.88%.These figures accounted for 61% of the total amount of stolen in that year and 20% of the total number of incidents.
Please note that in last year’s report, we published information that North Korea stole $1 billion through 20 hacking attacks.After further investigation, we determined that some of the large hackers previously attributed to North Korea might no longer be relevant, and therefore the amount was reduced to $660.5 million.However, the number of events remains the same as we found other smaller hacks attributed to North Korea.As we obtain new on-chain and off-chain evidence, our goal is to constantly reevaluate our assessment of North Korea-related hacking incidents.
Unfortunately, North Korea’s cryptocurrency attacks seem to be becoming more and more frequent.In the figure below, we examined the average time between success of DPRK attacks based on the exploit scale and found that attacks of all sizes fell year-on-year.It is worth noting thatAttacks worth $5 billion to $100 million and above $100 million occur much more frequently in 2024 than in 2023, indicating that North Korea is doing better and faster in large-scale attacks.This is in stark contrast to the previous two years, where its profits tend to be less than $50 million each time.
When comparing North Korea’s activities with all the other hacking activities we monitor, it is obvious thatNorth Korea has been responsible for most large-scale attacks over the past three years.Interestingly, North Korean hackers are under low amounts, especially the density of hacker attacks worth around $10,000 is also increasing.
Some of these events appear to be related to North Korean IT practitioners, who are increasingly permeating cryptocurrencies and Web3 companies, damaging their network, operations and integrity.These employees often use complex strategies, technologies, and procedures (TTPs), such as false identities, hiring third-party recruitment agencies, and manipulating remote job opportunities to gain access.In a recent case, the U.S. Department of Justice (DOJ) sued 14 North Korean nationals who served as remote IT practitioners in the United States on Wednesday.The company earned over $88 million by stealing proprietary information and ransomware employers.
To mitigate these risks, companies should prioritize thorough hiring due diligence—including background checks and identity verification—while keeping strong private keys secure to protect critical assets, if applicable.
While all these trends suggest North Korea is very active this year, most of its attacks occurred early in the year, with overall hacking activity stagnating in the third and fourth quarters, as shown in the earlier charts.
In late June 2024, Russian President Vladimir Putin and North Korean leader Kim Jong-un will also hold a summit in Pyongyang to sign a joint defense agreement.So far this year, Russia has released previously frozen millions of dollars in North Korean assets under UN Security Council sanctions, marking the ongoing development of the two-country alliance.Meanwhile, North Korea has deployed its troops to Ukraine to provide ballistic missiles to Russia and reportedly seeking advanced space, missile and submarine technology from Moscow.
If we compare the average daily losses of the DPRK vulnerability before and after July 1, 2024, we can see a significant drop in the amount of stolen value.As shown in the figure below, the amount stolen by North Korea then dropped by about 53.73%, while the amount stolen by not North Korea increased by about 5%.therefore,In addition to turning military resources to the Ukrainian conflict, North Korea, which has significantly strengthened its cooperation with Russia in recent years, may also change its cybercrime activities.
The decline in North Korea’s stealing of funds after July 1, 2024 is obvious and the timing is obvious, but it is worth noting that this decline is not necessarily related to Putin’s visit to Pyongyang.Additionally, some events in December may change this pattern at the end of the year, and attackers often launch attacks during holidays.
Case Study: North Korea’s Attack on DMM Bitcoin
A well-known example of North Korea-related hacking in 2024 involved Japanese cryptocurrency exchange DMM Bitcoin, which was hacked, resulting in losses of about 450.2.9 bitcoins, worth $305 million at the time.The attacker targets vulnerabilities in the infrastructure used by the DMM, resulting in unauthorized withdrawals.In this regard, with the support of the group company, DMM fully paid customer deposits by looking for equivalent funds.
We were able to analyze the flow of funds on the chain after the initial attack, and in the first phase we saw the attacker transfer millions of dollars worth of cryptocurrency from DMM Bitcoin to several intermediate addresses before eventually reaching the Bitcoin CoinJoin hybrid server.
After successfully mixing stolen funds using Bitcoin CoinJoin hybrid service, the attacker transferred some of the funds to Huioneguarantee through some bridging services, an online marketplace related to Cambodian conglomerate Huione Group, a key player in the field.Promote cybercrime.
DMM Bitcoin has transferred its assets and client accounts to SBI VC Trade, a subsidiary of Japan Financial Group SBI Group, with the transition scheduled to be completed in March 2025.Fortunately, emerging tools and forecasting technologies are on the rise, and we will explore them in the next section to prepare for such destructive hacking.
Use prediction models to block hackers
Advanced prediction technologies are changing cybersecurity by detecting potential risks and threats in real time, providing proactive ways to protect digital ecosystems.Let’s take a look at the following example involving decentralized liquidity provider UwU Lend.
On June 10, 2024, the attacker obtained about $20 million in funding by manipulating UwU Lend’s price oracle system.The attacker launched a lightning loan attack to change the price of Ethena Staked USDe (sUSDe) on multiple oracles, resulting in incorrect valuations.As a result, an attacker can borrow millions of dollars in seven minutes.Hexagate detected an attack contract and its similar deployments about two days before exploitation.
Although the attack contract was accurately detected in real time two days before the exploit, its connection to the exploited contract was not immediately apparent due to its design reasons.This early detection can be further leveraged to mitigate threats with other tools such as Hexagate’s security oracle.It is worth noting that the first attack that caused $8.2 million in losses occurred minutes before the subsequent attack, which provides another important signal.
Such alerts issued before major chain attacks have the potential to change the security of industry players, allowing them to completely prevent costly hacking rather than respond to them.
In the following diagram, we see the attacker transferring the stolen funds through two intermediate addresses before the funds reach Tornado Cash, the OFAC-approved Ethereum smart contract mixer.
It is worth noting, however, that accessing these prediction models alone does not ensure that hacking is prevented, as protocols may not always have the appropriate tools to take effective action.
Need for stronger encryption security
The increase in stolen cryptocurrencies in 2024 highlights the industry’s need to deal with increasingly complex and changing threat situations.While the scale of cryptocurrency theft has not yet returned to 2021 and 2022 levels, the above-mentioned resurgence highlights the gap in existing security measures and the importance of adapting to new ways of exploitation.To effectively address these challenges, cooperation between the public and private sectors is crucial.Data sharing programs, real-time security solutions, advanced tracking tools and targeted training can enable stakeholders to quickly identify and eliminate malicious actors while building the resilience needed to protect crypto assets.
In addition, as the cryptocurrency regulatory framework continues to evolve, scrutiny of platform security and customer asset protection may be strengthened.Industry best practices must keep up with these changes to ensure prevention and accountability.By building stronger partnerships with law enforcement and providing teams with fast-responsive resources and expertise, the cryptocurrency industry can strengthen its anti-theft capabilities.These efforts are critical not only to protect individual assets, but also to build long-term trust and stability in the digital ecosystem.
