What the Block Explorer Misses: Using Laundering Intel to Contain Exploits

Transcript

[music] [music] Okay, can you hear me? >> Okay. >> Uh, thank you everyone for joining. Um, I'm Julia. I'm one of the co-founders of Zero Shadow. I run our investigations team and I'm here to talk to you about some of the different moneyaundering insights that we've been able to look at and how that could actually be really useful for containing an exploit that you might experience within your protocol.

So when uh a big hack happens or or even some of the smaller ones, I think you see a lot of posts on Twitter where people are talking about the root cause analysis. Maybe they're posting the very first address where funds were deposited into, but that's really the end of the story. Um, for for some of the other exploits, you'll see uh that people follow the initial movement of funds. So, I remember seeing for by bit or or kelp that people were tracing the funds through thorchain going to Bitcoin. That's maybe the first few weeks of the exploit and then again that's the end of the story. Zero shadow is unique because we are looking at the full tracing of the fund. So from the very first

movement, the very first address used all the way through across all the different chains and mixers to the very last address where we think that the funds were cashed out. And so this gives us a really big data set and a really big understanding of how these different thread actors are operating. So the um comment that I hear a lot when I talk about freezing and recovery within the security space is why should we even focus on laundering by then? It's way too late. And I think a lot of the preventative measures that people talk about are really important and that does save a lot in terms of the dollar values that can be saved. But I really do also think that the freezing and

recovery should be part of the equation. And the reason is because the amount of exploits that we see is such a high volume that it's not necessarily a matter of when will a protocol be exploited but or if they will be exploited but when they will be exploited. And so people need to be prepared for that incident. And knowing who your adversaries are can be really helpful for actually knowing what you're going to do next. So, when you think about something like what your response is going to be, a lot of the questions that I hear are, "How do I get my funds, my stolen addresses out to different services that might be able to freeze or how do I even start to recover funds?"

And and we're a actually able to answer some of those questions through looking at all this experience across all these different hacks that we've worked on. If we look at the hacks from the past year so far, we had originally calculated $1.8 billion worth of stolen funds and then bybit has hap or Binance has happened last week and we're up to$8 billion. Um, but when we look at the attack vectors, we do see this recurring trend year after year and that is that a lot of these hacks are happening because of operational securitybased exploits. So not necessarily a smart contract with the vulnerability, but the people who are behind that have the key access, the

API access, etc. And some of these attacks are actually becoming a little bit more common because of the proliferation of AI, thinking about some of the supply chain risk and just the the greater exposure that services have. So Zero Shadow launched a thread intel platform in March of this year. Uh the reason that we created this is that we wanted to better get the stolen funds addresses that we can identify out to the services that might be able to do something about it. And with this product, we're able to get an address out to a bridge or an exchange within 10 seconds. And we're tracking a lot of different types of um activity. You can see that listed on the left hand side.

So, it's not just the hacks that we're hired to do, but we're also looking at repeat thread actors. So, uh you can see a lot of different North Korea groups. Um also people like the comm which we'll talk about. And we're also looking at repeat laundering strategies. So, something like tornado cash and wasabi and and we're gathering all of this data and we're using that to run analytics right now and show you some cool insights that we can get across all this all these different addresses. So what does the data show us? We can start by looking at uh the North Korea subgroup trader trader. So this is the group that performs all the largest hacks. They're the most sophisticated group. This is by bit. This is kelp most

recently. This is the group that f the FBI announced is associated with Binance. And when we look at where how do the funds first move? So when they're first stolen, where's what's the next activity that we do that we see? We see that these funds are immediately swapped and consolidated so that anything that could be freezable is no longer held within the stolen a actor's wallets and then they immediately are moving the funds out of these these wallets to new fresh laundering addresses. So, if you look at the stats here, some of these funds move in as little as two minutes out of the wallets, but on average, we're looking at more like 30 minutes.

It could be a little longer on the Bitcoin side. So, that's a very small window of time. If if a if a protocol is only focusing on making sure that the first stolen funds address gets sent out to different services, it's already going to be empty uh by the time that a lot of them could receive it. What's interesting is that after this period, we see that the funds can be held in what we call staging wallets. So, these are a set of addresses that are each holding 10,000 ETH or 10,000 Bitcoin, and the funds aren't moving for a few days. Why is this happening? This is because North Korea doesn't launder their own funds within the trader trader group. actually hand over the keys to the funds over to Chinese money

launderers to continue doing the more rapid fire laundering that is familiar to uh to those of us that do a lot of this research. Um so this time has become a lot smaller. Um it used to be more like six months that we would see in between the first theft and the downstream laundering. Last year we were looking at more like six days and now more like three days and even less. And so they're getting a lot more efficient in how they do that handover to the launderers and start doing that really downstream laundering. But we still find that this is an important uh staging point to note because this is the time where a service can really think about do I have law enforcement engaged? Do I

have security experts engaged to help me? Do I know what my plan of action is if I want to recover any of these funds? And when we look at the downstream laundering, the the the longer tail when they're moving across many different chains, the movements are really really quick. We're looking at more like five minutes per wallet. Um the the little uh blip there for by bit uh for Bitcoin, that's um an anomaly from some of the longer tail um postmixer activity, but generally we're looking at much more like five minutes. And so this is really rapid movement of funds, 13,000 wallets for a single hack where you really have

to keep real time to continue to be able to disrupt those funds. And that's something we were able to do. So this is a screenshot out of the kelp exploit and we saw that the launderers were using Thor Chain. Uh, Thor Chain Bridge is a pop a popular bridge for um their them being very public about not really wanting to ever try to intercept funds. And they were trying to move out of the Wasabi mixer to go from Bitcoin to EVM to continue the laundering. But theers decided that they actually wanted to get across a faster bridge. 13 was taking too much time. And so they went to bridges that were ingesting the

stolen funds addresses that we were uh sending out. And through that, we were actually able to freeze $700,000 worth of the stolen funds. This graph um on the right hand side, this shows how many different times that one of our stolen funds addresses was being hit uh by one of the bridges. So, um, what that means is that they the launderer tried to use the bridge, it was rejected because it was a blacklisted address, and then they might have tried again and again. And the the left most left-hand one, that's the much larger one, is because that bridge didn't have any kind of time lock. They just immediately rejected the funds. And so we do see that for any services that are actually holding the funds for a

period of time or locking the funds for a period of time before the release, the the launderers are much more likely to move on and and actually help that that bridge to stay compliant should they choose to. So switching gears a little bit, um this is a different North Korea group, Apple Juice. Um this is this on the screen is the drift exploit. So um the the off-chain typology for how these exploits happen are not always the same. It can be very different uh tailored to a specific uh victim that they want to target. But the common denominator is the malware. The malware that is deployed has a really specific signature to it. And when we see that we know that

this is uh the apple juice subgroup that's operating when we look at the movement of funds for apple juice. So when they initially steal the funds, when are they emptying those wallets? It can be a tiny bit slower than the trader trader group, but we're only talking about 1 hour of time rather than 30 minutes. So same principles really apply that uh for for containing this exploit, time is really of the essence, making sure that services know about these addresses and and downstream if they're going to do anything.

Uh for Applejuice, we see that after some of the initial laundering that funds will actually sit in externally owned accounts for a longer period of time. So um I've anonymized these two cases, but for one case we've seen 10 to 11 months where funds were just sitting in wallets. They weren't moving. Another case where it was four to seven months. And we think that they're doing this because they're re-evaluating their laundering strategy. So we'll see that after something like tornado cash the next movement of funds is changing from when that period started from an older case to afterwards and I think that's to to seek better yield to be able to try to evade tracers like like zero shadow

that are going to do something about it but it gives us this long window where we really can research and understand what activity we should expect and then we see really good disruption results. Um, also looking at the timing of these transfers for Apple juice, uh, 86 to 91% of the funds are moving between 9:00 a.m. to 6:00 p.m. Korea time. So unlike with the trader trader movements, that's 247 that's going out to professional wanderers. This is North Koreans moving their own funds and so they're they're going to sleep, they're taking their shift the next day and it's much more of a manual process. So that again gives a lot more opportunity for human

intervention um against less automated activity. So now to look at uh non-state actors, the first group that we looked at was the comm. So the comm is kind of a loosely defined group. This is teenagers and uh young adults that often came from the gaming community that have decided that they actually want to uh try to steal cryptocurrency as as a a way to to pass the time and and also make a profit. They're most commonly known uh within this space for the fake exchange phone call. So, someone from Coinbase or Kraken who calls you up and says,

"You're having a security incident. You need to move your money. Uh, we have a way to do that for you. Just follow these instructions." And actually, that means that the funds are being completely drained. But that's not the only type of exploits that we see that the comm is behind. They're also behind a lot of the drainer as a service uh types of exploits that you might have seen in the in Twitter posts or something to that effect. And more recently, we've also seen a series of more smart contractbased exploits where we can see that it's the same subgroup within the comm that is behind these.

So when we look at the laundering patterns associated with that movement of funds, we see that um unlike some of the nation state act activity that is really rapid fire, it's going all different directions with with these funds, one of the first destinations is to try to send the funds to a bridge. So, it's much less sophisticated. The goal is to maybe opuscate for a few different hops, go crosschain, and then try to cash out and and that's that's it. And so, if you're a victim of one of these thefts, then that's important knowledge to know. I need to make sure that the addresses get out to the bridges. The bridges are going to be a really good interception point.

Also, another non-state actor. Uh we've seen a lot of wrench attacks this year, of course, and more recently in the news, there's been a a bunch that were based in the United Kingdom. And we took a deeper look into the laundering that we were seeing across a few of those reported thefts. Um we saw that the movement from address to address was a lot slower. It was more like four to five hours in between each address rather than something like five minutes we talked about with with the trader trader activity. And so this is again much less sophisticated much more opportunity for disruption. We also see that there's heavy coingling across victims. That means that the same address is being used across multiple

thefts. And so if one address is presented to a service to make sure that they block it, they might actually be able to repeat see that address come up again and block across multiple victims. And we did have a recent uh success with trying to disrupt this activity. So we always say if you are ever a victim of a wrench attack, you should comply. You should um give the money in your life is most important. But afterwards, you can report that kind of uh incident to something like CL 911, a service that's really good for for rapid enablement.

And in this case, a victim had reported that they lost $800,000 worth of funds. They reported to CEL 911. Cal 911 is part of our threat intel network. the addresses were were distributed out to different services and within 30 minutes 90% of those funds were frozen at a service and can go back to recovered back to the victim. So, um I hope that this was really good insight across a bunch of different threat actors and and understanding how this laundering takes place. The common denominator that we can see across all these different activities and exploits

is that data can be really important for containing that the the speed in which you can act from the moment of a loss to enabling enacting different security providers getting address information out. doing real time tracing because every minute can be really important can have a big impact in actually containing that exploit and trying to make sure that funds remain within within your wallets rather than the threat actors. Uh so thank you so much for for joining me for this presentation. Um I've put up some of our uh Twitter handles. Um, I'm not as active, I will admit, as the Zero Shadow account, but uh, still feel free to give us a follow and let us know if

you have any questions. [applause] >> Wow, thank you, Julie. That is that is really good advice there to contact Seal 911 as soon as you can because it is in some cases possible to get your funds back. Really love to see the work you guys are doing there. Now, on to any questions. Opening it up to the audience. If you have a question, I'm going to throw this big box at you. I'm going to start at the front to make my life easy. >> Oh, okay. >> The mic's in the box. >> Oh, okay. Interesting. Um, yeah. Thank you. This is very helpful. Um, is there anything that we could do, I guess, on the account on the chain side or on the like token contract side, something like that to limit these

things to help? Um, yeah, I'm not saying like making the chain, you know, not permissionless, but uh something that we could do to help like some optional rate limit in or I've seen so many things thrown out there, but like here's what what your thoughts are. >> Um, I love this question. It's a great one. Um, I would say yes, there's definitely things that you can do. So um for services that have some kind of custody element to them, even a lot of a lot of protocols that are decentralized on paper might have things that they can actually be doing when you when you look at actually the admin controls and there are things you can do that you can actually like take custody of these funds. Some of it is just understanding

what the the stolen funds addresses are to be able to ingest, but some of that is also um having having the ability to to do something like pausing or or adding some kind of blacklist functionality within the contracts. Um for services that are more decentralized or or choose not to do something on the custody side, you can still do um disruption. So we see something like a proof of innocence where if an address is lacklisted, it's just rejected out of the the protocol. Um something like rate limiting or or some kind of time lock on those funds can be a lot more disruptive than just the autorejection and that can actually really steer things away. Um

also a lot of it is just coordination. So, um, I think for for services that want to try to disrupt this activity, being available, having a a point of contact at something like Seal 911 or Zero Child to be able to ingest this intelligence is really important and then you can really quickly act on that information. >> Excellent. Next question all the way up the back. >> Thanks. Um this is something I've been very curious about like uh for uh investigators uh like your team and with others. Um is there like a high level description you can give on how you guys um categorize like this is trader trader versus uh the calm versus like what are

the kind of like signals that you use to like fingerprint uh which group is which? >> Yeah, great question. Um so everyone leaves a bit of a fingerprint behind for the activity that we do. So firstly we look at the attack vector itself. So even before the funds are are leaving someone's wallet um what happened? How did we get there? Like was there a phone call? Was there audio that didn't work in your in your Zoom call? Was there some kind of developer who had a conversation two months ago? So all these details can be really important and they factor in. When we look at the onchain, we originally look at what is the gas funding and what are the initial

movements of those funds. So there are certain services that actors prefer for their swaps or for their bridges. Um even the speed of the laundering can be really important towards that fingerprint. And then lastly, we do look for any kind of IP information that we can get. So that's when you hear in all these security conversations that people should have their EDR systems partially that's important because also you you have logs. So if you have had some kind of exploit and we can say can you see what kind of IPs are are coming up and that shouldn't be there then we can do some attributions and even if it's a VPN the certain actors like certain VPNs and so that can still be important.

>> Love it. Next question coming up up the front. So uh like for uh uh like cases which are happened like two or three years 3 years back like of hacking or anything like that if uh now if they have to report uh or you know get the uh you know recovery of the funds can they do that or those funds are uh you know lost is there any way to recover those funds which are like happened two or three years back? Yeah. Um, there are nuances to it. So, I'll say if you're just thinking about direct tracing of the funds from your theft out, it's unlikely to have a recovery that way because the

rate that we see funds are cashed out is much faster than two or three years. But the way that we see that people get recovery is that if there's an actor who is acting across multiple exploits and this is more I think on a non-nation state level that we see if there are there is an actor that is is going time and again we'll actually see that law enforcement will try to collect all the different victims no matter how long ago they were part of that um together and use all of that information together to have a much larger case. And then when they go to actually try to recover funds, they're not just looking at can funds be frozen on an exchange. They're looking at what assets does this actor

have. And so a lot more of the focus is on thread actor attribution and going from that way. >> Beautiful. That's all the time we have now for questions. Thank you very much, Julie. It's it's clear you know a lot about this topic and it's really good the work you're doing to hopefully stop these funds from actually making into the attackers's hands. >> [music]