This Week in Crypto Fraud - May 6 2022 (#3)
This week in Crypto Fraud focuses on each weeks developments in crypto asset crime, fraud and investigations.
This week we cover attacks on Rari Capital, further DOJ indictments relating to Capital Coin and an increase in the SECs focus on crypto and cyber.
We can’t cover everything so just the most interesting or noteworthy highlights, with some general reporting. This week we also published a detailed review of the Axie Infinity hack.
$77m lost in hack on Rari Capital
(Coindesk - https://www.coindesk.com/business/2022/04/30/defi-lender-rari-capitalfei-loses-80m-in-hack/)
DeFi hacks seem to be all the rage at the moment, with Rari Capital losing $77m in an attack this week. Rari Capital merged with the Fei Protocol recently.
The attack was apparently due to a re-entrancy vulnerability. A write up from @Hacxyk has some deeper technical detail.
The Fei Protocol and Rari Capital offered a $10m bounty to the attacker. Offering a no-questions-asked bounty to return funds now seems to be the standard playbook for these kinds of attack.
There are reports that the funds have been moved to mixing service Tornado Cash but this is currently unconfirmed.
Notes for investigators
Investigators should verify payments from mixing services and take appropriate risk management steps.
Cyber security review of Smart Contracts an important step to removing these vulnerabilities, and should be conducted on a regular basis.
Bounties offer a mechanism to track threat actors, and it is unlikely that an attacker will accept unless they can be certain it won’t be used against them.
SEC Nearly Doubles Size of Enforcement’s Crypto Assets and Cyber Unit
(SEC - https://www.sec.gov/news/press-release/2022-78)
The US Securities and Exchange Commission has added 20 new roles to take the team to 50. The team will be renamed the Crypto Assets and Cyber Unit (formerly known as the Cyber Unit).
The. unit will now add issues around crypto to it’s remit, including
Crypto asset offerings;
Crypto asset exchanges;
Crypto asset lending and staking products;
Decentralized finance ("DeFi") platforms;
Non-fungible tokens ("NFTs"); and
Stablecoins.
In addition the unit will continue to focus on cybersecurity issues. The press release goes on to set out this dual remit.
"Crypto markets have exploded in recent years, with retail investors bearing the brunt of abuses in this space. Meanwhile, cyber-related threats continue to pose existential risks to our financial markets and participants.”
This is a broad approach, and it is difficult to see how a team of even 50 can stay on top of enforcement action across both Cyber and Crypto issues.
Notes for investigators
The US authorities are well funded, and are on the surface taking crypto related issues seriously. Only time will tell how this develops.
CEO of Mining Capital Coin Indicted in $62 Million Cryptocurrency Fraud Scheme
(US DOJ - https://www.justice.gov/opa/pr/ceo-mining-capital-coin-indicted-62-million-cryptocurrency-fraud-scheme)
Luiz Capuci Jr did not did not use investors’ funds to mine new cryptocurrency, as promised, but instead diverted the funds to cryptocurrency wallets under his control.
The DOJ announcement is the latest in a run of indictments targeting frauds related to the cryptocurrency industry.
“This case should serve as a warning to any individuals who look to illegally capitalize on the perceived ambiguity of the emerging crypto market to take advantage of innocent investors”
Notes for investigators
Many of the recent indictments for crypto frauds are more related to the wider market than the specifics of cryptocurrencies. The promise of large returns and a general low level of knowledge relating to the market leads to major opportunities for fraudsters.
We recommend that investigators conduct detailed due-diligence on the people and entities behind crypto businesses, as well as looking at the underlying crypto technology itself.