North Korean Hackers and DeFi Vulnerabilities Lead to Record Year for Crypto Heists in 2022

Introduction

In 2022, a combination of North Korean state-backed hackers and vulnerabilities in decentralized finance (DeFi) protocols contributed to a record-breaking year for cryptocurrency heists, as reported by Chainalysis.

Key Findings

The blockchain analysis company revealed that a total of $3.8 billion was stolen from cryptocurrency firms last year, with 82% of the thefts attributed to weaknesses in DeFi protocols. This marked an increase from the previous year’s 73%.

North Korean hackers were responsible for stealing $1.7 billion, with a significant portion ($1.1 billion) originating from attacks on DeFi platforms. The attack on Ronin Network in March alone resulted in a loss of $618 million for the firm.

DeFi Protocol Vulnerabilities

Chainalysis noted that cross-chain bridge protocols, such as those targeted in the Ronin Network attack, accounted for 64% of DeFi protocol breaches. These protocols allow users to transfer their cryptocurrency between different blockchains by locking assets in a smart contract on one chain and minting equivalent assets on another.

According to Chainalysis, these bridges serve as lucrative targets for hackers due to the centralized nature of the smart contract repositories. Any vulnerabilities in the code or weak spots can be exploited by malicious actors over time.

Security Recommendations

To mitigate the risk of DeFi protocol attacks, Chainalysis recommended that developers conduct thorough code audits with third-party providers and prioritize security over rapid growth. By focusing on security measures, developers can create a more resilient ecosystem for decentralized finance.

Money Laundering Tactics

North Korean hackers have been observed sending stolen cryptocurrency to “mixers,” which blend digital currencies from multiple users to conceal their origins. These mixers, considered de facto money laundering tools, have drawn regulatory scrutiny.

When a popular mixer used by North Korea, Tornado Cash, was sanctioned by the US in August 2022, threat actors swiftly transitioned to another platform, Sinbad, to continue their illicit activities.

Conclusion

The combination of North Korean hacking operations and vulnerabilities in DeFi protocols led to a surge in cryptocurrency thefts in 2022. By addressing these security challenges and implementing robust measures, the crypto community can better safeguard against future attacks.