jakiro
Source: Chainalysis; Compilation: Tao Zhu, Bitchain Vision
summary
-
year to date,The total amount of illegal activity on-chain declined by nearly 20%, indicating that legal activity is growing faster than illegal activity.
-
Although there has been a decrease in illegal transactions compared with the same period last year, two types of illegal activities—Stolen funds and ransomware – but it’s increasing.Specifically, stolen inflows nearly doubled, from $857 million to $1.58 billion, while ransomware inflows rose by about 2%, from $449.1 million to $459.8 million.
Stolen funds
The average amount of cryptocurrencies stolen in each robbery increased by nearly 80%.
Partly due to the rise in Bitcoin (BTC) prices, Bitcoin accounts for 40% of the total transaction volume of these robberies.Cryptoburglars also seem to return to their roots, targeting centralized exchanges more frequently than prioritizing the DeFi protocol, a less popular tool for trading BTC.
Senior cybercriminals, including IT workers associated with North Korea, are increasingly using off-chain methods such as social engineering to steal funds by infiltrating encryption-related services.
Ransomware
-
2024 will be the year with the highest payments for ransomware, largely due to the fact that these ransomware launch fewer high-profile attacks but receive a large ransom (called “big prey hunting” in the industry).In 2024, the largest ransomware payment ever appeared, with about $75 million being paid to the Dark Angels ransomware organization.
-
The average ransom payments to ransomware have soared from less than $200,000 in early 2023 to $1.5 million in mid-June 2024, suggesting theseRansomware prioritizes large enterprises and critical infrastructure providers, who may be more likely to pay high ransoms because they are well-funded and systemically important.
-
The ransomware ecosystem has experienced some divisions due to recent interference from law enforcement on the largest players such as ALPHV/BlackCat and LockBit.After these disruptions, some branches have turned to less effective viruses or launched their own viruses.
In 2024, the cryptocurrency ecosystem has made many positive developments.Cryptocurrencies continue to gain mainstream recognition in many ways after the U.S. approved the spot Bitcoin and Ethereum Exchange Trading Funds (ETFs) and the U.S. Financial Accounting Standards Board (FASB).But like any new technology, whether it’s good or bad, the number of people adopting cryptocurrencies will increase.While illegal activity so far this year (YTD) has declined compared to previous years, cryptocurrency inflows from specific cybercrime-related entities show some worrying trends.
As shown in the figure below, so far this year,Inflows to legal services are the highest since 2021 (the peak of the last bull market).This encouraging sign shows thatCryptocurrencies will continue to be adopted worldwide.Funds flowing into high-risk services (mainly composed of mixers and exchanges that do not collect KYC information) are trending higher than the same period last year.Meanwhile, total illegal activity has fallen by 19.6% so far this year, from $20.9 billion to $16.7 billion, indicating that on-chain legal activity is growing faster than illegal activity.As always, we must remind you that these illegal numbers are lower limit estimates based on the amount of illegal address inflows we found today.These totals will almost certainly be higher over time as we categorize more illegal addresses and incorporate their historical activity into our data.
Another important update this year is that we have begun to incorporate suspicious illegal activity into the overall estimates of certain types of crime based on Chainalysis Signals data.Previously, our estimates included only the total number associated with the address where Chainalysis had supported documents to prove it belonged to an illegal entity.Signals utilizes on-chain data and heuristics to identify suspicious categories of a particular unknown address or address cluster, with confidence ranging from possible to almost certain.The introduction of Signals not only increased our estimates of certain categories of illegal activity over time, but also allowed us to improve estimates in previous years, as there was more time to collect input and understand the on-chain patterns of suspicious activity.As bad actors continue to develop their strategies, so will our detection and disruption methods develop.
Although illegal transactions generally declined compared to the same period last year, two notable illegal activities—stolen funds and ransomware—have been increasing.The stolen funds in cryptocurrency theft increased year-on-year, nearly doubled from $857 million to $1.58 billion by the end of July.In the mid-year update last year, the total ransomware inflows was $449.1 million as of June 2023.This year, ransomware inflows have exceeded $459.8 million over the same period, suggesting we may see another record year for ransomware.
Attackers return to target centralized exchanges, stolen funds surge
Compared to 2022, the value of stolen cryptocurrencies fell by 50% in 2023, and hacking has resurfaced this year.Comparing the amount of stolen and the year-on-year number of hacking incidents is very telling.As shown in the figure below,As of the end of July, the cumulative value of the stolen this year has reached US$1.58 billion, about 84.4% higher than the value of the stolen in the same period last year.Interestingly, the number of hacking incidents in 2024 was only slightly higher than in 2023, up just 2.76% year-on-year.Based on the value of assets at the time of the stolen, the average stolen value per incident increased by 79.46%, from $5.9 million per incident from January to July 2023 to $10.6 million per incident to date in 2024.
Changes in the value of stolen are largely attributed to rising asset prices.For example, the price of Bitcoin rose from the average price of $26,141 in the first seven months of 2023 to the average price of $60,091 in July this year, an increase of 130%.
The price of Bitcoin is particularly important here.One hacking metric tracked by Chainalysis is the volume of transactions associated with the flow of stolen funds after a hack.This can be used as an alternative indicator of stolen assets, as many times a hacked service does not publicly report details of stolen assets.Last year, 30% of this transaction volume was related to Bitcoin.This year, BTC transaction volume associated with stolen funds activities accounted for 40% of these traffic.This pattern seems to be driven by changes in the types of hacked entities, with centralized services hacked in 2024 to acquire high funds.This is especially true for centralized exchanges such as DMM, which lost $305 million.It is reported that about 4500 BTCs were stolen in DMM hacking, accounting for about 19% of the value of hacked attacks in 2024.
Cryptocurrency thieves seem to be back to their former operations, targeting centralized exchanges again after focusing on decentralized exchanges (usually not trading Bitcoins) four years ago.
While attacks against DeFi services, especially cross-chain bridges, peaked in 2022, we speculate that attackers have turned their attention to newer, more vulnerable organizations after centralized exchanges added security investments.Now,Attackers, including North Korea-related attackers, are leveraging increasingly sophisticated social engineering strategies, including applying for IT jobs, to steal cryptocurrencies by infiltrating their most important historical targets in centralized exchanges.one.The United Nations recently reported that Western tech industry companies have hired more than 4,000 North Koreans.
2024 is expected to be the highest ransomware revenue year to date
In 2023, ransomware set a ransom record of more than $1 billion.The huge ransoms came from striking destructive attacks such as the Cl0p attack on the Zero Day of MoveIT vulnerability and the ALPHV/BlackCat ransomware group’s attack on the Caesars Hotel property, which resulted in the company paying a $15 million ransom.[1] Despite significant actions by law enforcement against ransomware deployer malware and organizational infrastructure, these payments still occur.At this time last year, we reported that as of the end of June 2023, the cumulative ransomware payments were approximately $449.1 million.During the same period this year, we recorded a total ransom of $459.8 million, and 2024 is expected to be the worst year on record.
Andrew Davis, general counsel for Kiva Consulting, said ransomware activity remained relatively stable despite the damage caused by LockBit and ALPHV/BlackCat.“Whether it is the former branch of these well-known threat actors’ actions or the newly emerging ransomware organizations, a large number of new ransomware organizations have joined the competition, demonstrating new methods and technologies for implementing attacks, such as expanding their initial means of access andlateral movement method.”
As shown in the figure below, ransomware attacks have also become significantly more serious.A significant change is the surge in the highest ransom payments we observed in a year.So far, 2024 saw the largest single payment ever, about $75 million, paid for a ransomware organization called Dark Angels.This jump in the highest payment amount also represents a 96% year-on-year increase in the highest payment amount in 2023, and a 335% increase from the highest payment amount in 2022.
If the rapid growth of the maximum payment amount is not bad enough, it is even more frustrating that this trend in annual outliers actually reflects the growth trend of median payments.This trend is especially common in the most destructive ransomware incidents.To achieve this, we divided all virus strains into the following categories according to the on-chain activity level:
-
Virus of extreme severity: Maximum payment received in a given year exceeds $1 million
-
High severity virus: The maximum payment received in a given year ranges from $100,000 to $1 million
-
Mild severity virus: The maximum payment received in a given year ranges from $10,000 to $100,000
-
Low to moderate severity virus: The maximum payment received in a given year ranges from $1,000 to $10,000
-
Low severity virus: Maximum payment received in a given year is less than $1,000
Using this classification system, we can track abnormal growth of median payment amounts of varying severity over time.This upward trend is particularly evident among the virus strains of “extremely high severity”.The median payment amount has increased from $198,939 in the first week of 2023 to $1.5 million in mid-June 2024.This means that during this period, the most severe virus strain type paidRansom usually increases by 7.9 times,It has increased nearly 1200 times since the beginning of 2021.This pattern may indicate thatThese strains of the virus are starting to target larger enterprises and critical infrastructure providers, and because of their strong financial resources and systemic importance, they may be more likely to pay huge ransoms.
However, as shown in the chart below, the most severe ransomware strain still performs below the 2023-to-date total of 50.8%.This may be attributed to law enforcement interference from the largest participants, ALPHV/BlackCat and LockBit, which led to a stuttering of ransomware operations.After these disruptions, the ecosystem becomes more dispersed, with related parties migrating to less efficient ransomware strains or launching their own.As a result, year-to-date activity for the higher severity ransomware strains increased by 104.8%
Another trend in ransomware is that attacks are becoming more frequent, according to eCrime.ch’s data breach website statistics,The number of attacks so far this year has increased by at least 10%.It is worth noting that although the total ransom amount this year is expected to hit a record high, the ransom amount has also hit a record high, and the attack situation is getting worse, there is still good news.Among all these disadvantages, victims still pay ransoms at a low frequency.The number of posts on ransomware breaches websites as a measure of ransomware incidents has increased 10% year-on-year, and we expect this to happen if more victims are threatened.However, the total number of ransomware payment incidents measured by chain fell 27.29% year-on-year.Combining these two trends shows thatWhile the number of attacks may have increased so far this year, the payment rate has declined year-on-year.This is a positive signal for the ecosystem that victims may be more prepared and do not need to pay ransom.
“About 65% of the issues that Kivu assisted victims in dealing with have been resolved without paying ransoms. Affected organizations continue to maintain a positive recovery trend without paying ransoms to attackers,” Davis said.
Although illegal activity in the crypto ecosystem continues to be on the downward trend,Two types of crypto crimes seem to be against the trend: funds stolen and ransomware.It is worth noting that these two types of crime are often committed by actors with certain common characteristics.They are often organized groups that utilize complex network infrastructure.In cases of funds theft,North Korea-related hacker groups are behind some of the biggest robberies.These actors are known to use well-planned social engineering strategies to break into crypto businesses, steal crypto assets, and use professional money laundering techniques to try to cash out before funds are seized.
The key to combating cybercrime is to undermine its supply chain, including attackers, affiliates, partners, infrastructure service providers, money launderers and cash out points.Since crypto robbery and ransomware operations are almost entirely on the blockchain, law enforcement with the right solutions can track funds to better understand and disrupt the operations of these actors.”I think crackdowns and enforcement actions such as Operation Cronos, Operation Duck Hunting and Operation End of the End are crucial to curbing these activities and to show that the crime will have consequences,” said Corsin Camichel, a researcher at eCrime.ch.”
