Story image

New report uncovers US$1.7b cryptocurrency cybercrime market

31 Jan 2019

We’ve all witnessed the meteoric rise of cryptocurrency (and now its slump), but there has been little insight into what its black market is actually worth.

According to a new report from CipherTrace (2018 Q4 Cryptocurrency Anti-Money Laundering (AML) Report), more than US$1.7 billion in cryptocurrency was stolen and scammed in 2018, a staggering rise in criminal activity despite the aforementioned decline in the market, which further indicates a surge in security risks.

CipherTrace says criminals are being forced to launder all these funds in order to cash out before a wave of overdue regulations become enforced in later this year.

Theft from cryptocurrency exchanges made up the bulk of the criminal activity, accounting for more than $950 million that was stolen by hackers in 2018 – a staggering 3.6 times more than 2017.

On top of these thefts, the research purports investors and exchange users lost at least $725 million in cryptocurrency last year due to ‘exit scams’ like fraudulent ICOs, phony exchange hacks, and Ponzi schemes.

A cryptocurrency exit scam is essentially a confidence game where the promoters of a cryptocurrency ICO or other venture fails to executive — or executives of exchanges say they cannot return users’ assets — and then abscond with the money. CipherTrace goes further to say there is evidence a new breed of cybercriminals are shifting their techniques from hacking to insider jobs.

The report also delves into the impacts that will occur to the market following the coming wave of global regulatory enforcements and emerging money laundering schemes. By 2020 most modern economies — including the US, EU and G20 as well as Gibraltar, Bermuda and Malta — will have deployed strict cryptocurrency AML and Know Your Customer (KYC) regulations.

Currently, cryptocurrency money laundering services are getting around these regulations by obscuring the original source of funds with new and innovative money mixers, unregulated crypto-to-exchanges, and privacy coins.

“Cryptocurrency criminal activity continues to evolve and accelerate. Fortunately, pending global legislation will hamstring many criminals, global gangs, and terrorist groups by greatly reducing their opportunities to launder,” says CipherTrace CEO and Cryptocurrency Working Group co-chair Dave Jevans.

“These tough new laws will drive bad actors to not only innovate but also flock to jurisdictions with weak regulatory oversight, as we have shown in earlier research.”

The company also identified the top 10 trending crypto threats, which are as below:

1. SIM swapping: An identity theft technique that takes over a victim's mobile device to steal credentials and break into wallets or exchange accounts to steal cryptocurrency.

2. Crypto dusting: A new form of blockchain spam that erodes the recipient's reputation by sending cryptocurrency from known money mixers.

3. Sanction evasion: Nation states that use cryptocurrencies to circumvent sanctions and that has been promoted by the Iranian and Venezuelan governments.

4. Next-generation crypto mixers: Money laundering services that promise to exchange tainted tokens for freshly mined crypto, but, in reality, cleanse cryptocurrency through exchanges.

5. Shadow money service businesses (MSBs): Unlicensed MSBs that bank cryptocurrency without the knowledge of host financial institutions, thus exposing banks to unknown risk.

6. Data centre-scale cryptojacking: Takeover attacks that mine for cryptocurrency at a massive scale and that have been discovered in data centres, including AWS.

7. Lightning Network transactions: Enabling anonymous bitcoin transactions by going "off-chain" and now scaling to $2,150,000.

8. Decentralised stable coins: Stabilised tokens that can be designed for use as hard-to-trace private coins.

9. Email extortion and bomb threats: Mass-customised phishing email campaigns by cyber-extortionists using old passwords and spouse names and that demand bitcoin. Bomb threat extortion scams spiked in December.

10. Crypto robbing ransomware: New malware distributed by cyber-extortionists that empties cryptocurrency wallets and steals private keys while holding user data hostage.

Veeam releases v3 of its MS Office backup solution
One of Veeam’s most popular solutions, Backup for Office 365, has been upgraded again with greater speed, security and analytics.
Too many 'critical' vulnerabilities to patch? Tenable opts for a different approach
Tenable is hedging all of its security bets on the power of predictive, as the company announced general available of its Predictive Prioritisation solution within
Industrial control component vulnerabilities up 30%
Positive Technologies says exploitation of these vulnerabilities could disturb operations by disrupting command transfer between components.
McAfee announces Google Cloud Platform support
McAfee MVISION Cloud now integrates with GCP Cloud SCC to help security professionals gain visibility and control over their cloud resources.
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.
Cryptojacking and failure to patch still major threats - Ixia
Compromised enterprise networks from unpatched vulnerabilities and bad security hygiene continued to be fertile ground for hackers in 2018.
Princeton study wants to know if you have a smart home - or a spy home
The IoT research team at Princeton University wants to know how your IoT devices send and receive data not only to each other, but also to any other third parties that may be involved.
Organisations not testing incident response plans – IBM Security
Failure to test can leave organisations less prepared to effectively manage the complex processes and coordination that must take place in the wake of an attack.