Overview of blockchain protection incidents inside 2019, with global loss exceeding US$6 billion
1. Preface With the speedy development of contemporary it and applications, digital assets, a kind of currency based on computer it, have emerged. Its traceability, anti-counterfeiting, and anti-tampering features have improved transaction protection. In 2019, it has become a hot spot on the market and has developed rapidly.
In the perspective from the development of the world's digital asset marketplace, there are already a lot more than 1,500 digital currencies in the world, however the current digital currency still gets the issue of unclear legal status and insufficient supervision. Because of this, criminals use the anonymity of digital currency to evade guidance, conduct speculation, unlawful fund-raising along with other actions, which seriously threaten the value storage function of digital currency.
In 2019, there are more and more problems experienced within the development of digital currency. The protection of digital currency trading systems is poor, and the data construction and algorithm are usually complex, resulting in low work effectiveness. In particular, numerous irregular operation behaviors have affected the development of digital currency. Hinder.
In 2019, blockchain security issues due to blockchain digital assets are generally on the rise, and security incidents due to various reasons also have increased significantly. Digital currency crimes are diverse, including money laundering, scams, theft, drug trafficking, and mining crimes. Frequent.
2. Active standing of mainstream digital property in 2019. In October 2008, Satoshi Nakamoto published a paper entitled "Bitcoin: A Peer-to-Peer Electronic Cash System", expounding the theoretical framework from the Bitcoin digital cash system based on blockchain technology .
As of January 2009, the first stop containing 50 bitcoins was officially given birth to. Its characteristics such as for example decentralization, open autonomy, anonymity, and non-tamperability possess immediately attracted widespread attention through the society, and its own development momentum is speedy. Its ecosystem provides extended to many fields like the Web of Stuff, cloud computing, huge data, artificial intelligence, and its program scenarios also cover up economic, investment, regulatory along with other institutions, triggering a fresh round of technological innovation and industrial change. In the economic field, blockchain has become a economic technology hotspot in 2019, and the economic technology engine provides promoted the speedy advancement of cryptocurrencies such as for example Bitcoin.
In accordance with statistics in 2019, there are a lot more than 1,800 non-statutory cryptocurrencies in the world, with more than 9,600 trading markets and a market benefit of up to 820 billion U.S. bucks. This displays the rapid advancement of the market.
Based on the relevant data within the chain, we've made statistics. As of Dec 20, 2019, the supply, transaction share, blood flow, and market value of the very best ten popular currencies are the following:
(Information from: BLOCKCHAIR)
3. The summary and analysis of digital resource crimes in 2019 is a double-edged sword, with advantages and disadvantages, and digital property are usually no exception. The features and deficiencies from the technology itself, coupled with the lag and insufficiency of guidance, have accompanied economic risks, security issues have been shown continuously, and economic cases have appeared as scheduled. Digital assets have grown to be an important tool for public-stakeholder economic crimes such as for example cash laundering, terrorist financing, financial scams, and unlawful fundraising, and different digital currency unlawful crimes have grown to be more and more intense.
In 2019, the U.S. accounted for 28% of digital asset crime situations, which was the biggest in the world, Europe accounted for 24%, and Cina accounted for 18%. In accordance with statistics, from January 2019 to mid-December 2019, there were approximately 10,000 digital asset hacking situations around the world, and there were as much as 2,000 digital asset-related criminal situations in my country.
The types of global digital asset criminal offense cases in 2019 include hacking, fraud, unlawful fundraising, cash laundering, and unlawful transactions within the dark web. The full total loss has ended 6 billion U.S. bucks. The amount involved in cybercrime and dark web transactions can be roughly exactly the same, and the project team runs aside The amount associated with this type of case is a lot more than two times that of the first two, among which the lack of the blockchain due to program vulnerabilities surpasses $1 billion.
Not merely have situations of illegal crimes involving digital property in no way stopped, and offender methods have emerged inside 2019. Ransomware and funds run patterns have been renewed. Criminal groups have an array of sources. The number of legal cases and the total amount of legal activities involved are usually increasing.
(1) Hackers strike and steal digital assets
1. Exchange loopholes
In the past year, exchange security incidents have emerged one after another. From January's Cryptopia exchange suffered two hacking assaults, stolen ETH and ERC20 tokens shed a lot more than 16 million U.S. bucks, and then on November 27, South Korea's Upbit exchange had been attacked. Stealing 340,000 ETH, the estimated loss is a lot more than 49 million US bucks.
In 2019, there were a total greater than 28 exchange security incidents, which a lot more than 7 were exchange digital asset theft incidents, and the rest included exchange runaways, exchange information leaks along with other asset loss incidents, with a total lack of a lot more than 1.3 billion US bucks.
* On March 24, 2019, the DragonEx platform wallet had been hacked, resulting in the theft of users and the platform's digital assets. Statistics present the DragonEx exchange lost a total of 6,028,283 USD well worth of digital assets.
* On the early morning of Might 8, 2019, Binance officially issued an statement stating that ¨large-scale protection vulnerabilities〃 were found in the machine. Hackers used complex techniques, including phishing, viruses, along with other strike methods, from stop elevation 575012. 7,000 Bitcoins were stolen from Binance Very hot Wallet. Triggered the exchange to lose 41 million US bucks.
* On November 27, 2019, the South Korean exchange's UpBit protection system had been breached and 34,200 Ether had been stolen. Because of this, the exchange lost a lot more than 50 million US bucks.
Regarding the exchange vulnerability, we recommend:
(1) The exchange must pay sufficient attention to the machine protection system. It should never only have an acceptable protection architecture, but also conduct an overall protection test of the machine. The protection company must conduct self-inspection in time for the protection vulnerabilities reported with the protection company to avoid suffering To exactly the same attack.
(2) The exchange must set up a complete risk control emergency program. Regardless of how mature the technology is, the exchange may find exploitable vulnerabilities by hackers. Therefore, within the exchange system, unexpected occasions cause abnormal dealings and funds When it is stolen, an audio emergency response system and compensation system are particularly essential. For example, risk funds are used to deal with protection incidents, or user funds are insured to hedge the impact of data leakage or currency theft on user funds.
(3) When it is difficult for exchange project events to implement a thorough security system architecture for their personal exchange system, they need to contemplate using third-party security products or cooperating with security companies to jointly develop a safe trading environment and risk control emergency treatment for your exchange mechanism.
2. Smart contract vulnerabilities
The number of DApps continued to improve in 2019. In accordance with statistics, as of the start of December, the total amount of DApps currently running on general public chains such as for example ETH, EOS, and TRON provides exceeded 3,000. There were more than one hundred smart contract vulnerabilities this season, and most from the hacks happened in EOS DApp, up to now, the total lack of DApp hacked surpasses 10 million US bucks.
Over 60 common attacks have occurred within the EOS general public chain this season. January-April is a concentrated outbreak period, accounting for 67% of the annual attack incidents. The primary reason is the carried on popularity of betting applications within the EOS general public chain and the project contract program code. Weak security provides caused hackers to consistently attack exactly the same vulnerability on multiple DApps. The main methods are transaction blocking, rollback transaction attacks, false EOS assaults, and random quantity cracking.
There were almost 20 typical attacks within the TRON public chain this season, mainly in April, May, and July. Small-scale assaults were the primary ones, and the tactics were rollback transactions.
No serious DApp attacks possess occurred within the ETH public string this season. One is because the amount of gambling quiz contracts within the ETH general public string is small and the popularity is not enough, and another is because the ETH sensible contract project party has done a better job in protection as a whole.
* At 00:17 AM on April 11, 2019, hackers at the beginning of TCX1Cay created a large number of counterfeit BTTx coins and transferred a total of 40 million BTTx tokens to multiple addresses between 00:25 and 01:00 each day. Wash the false BTTx into real BTT and strike the BTTBank game contract you start with TXHFhq, producing a total lack of 180 million BTT.
* From 18:49 to 22:24 on July 23, 2019, hackers launched continuous attacks within the TRON quiz game TronChip, earning a total of 61,867 TRX. The explanation for this attack had been that the game contract was cracked by a random number.
* On Sept 14, 2019, the DICE game inside EOS DApp EOSPlay suffered a fresh type of random quantity strike, and the loss amounted to thousands of EOS. The attacker (account: muma**mm) used a new type of random quantity strike method to strike the project team using the flaws of the economic model in EOS during the strike.
To address the problem of smart contract vulnerabilities, we recommend:
(1) Game contract developers should pay attention to the rigor of game logic and program code security.
(2) Open up the contract code at the earliest opportunity, so that more professionals and techie teams can participate, analyze and sort out accidents that easily occur, enhance the security and functional accuracy of contract writing, and stop issues before they occur.
(3) The project party can do a good job in smart contract security audits and strengthen risk control strategies. If necessary, they can get in touch with a third-party professional audit team to conduct an entire code protection audit before going online.
3. Wallet vulnerability
In the past year, wallet security issues haven't stopped. Similar to exchanges, entry obstacles are reduced and security can be poor. In the absence of guidance, it is possible for wallets to run away with huge amounts of money.
The wallet itself also offers many security risks and is susceptible to hacker attacks, including the existence of wallet APP forgery vulnerabilities, weak transaction passwords not detected, core code not reinforced, system operating environment not detected, screenshots and screen recording records of operations along with other hidden risks. From the beginning of June the pocket GateHub broke out that a lot more than 23 million XRP had been stolen, there were a lot more than 7 pocket security incidents over summer and winter, with loss of over 100 million yuan.
* GateHub is a pocket and gateway for secure storage/control of XRP. Starting from the first sufferer stolen 10,000 XRP, by June 2019, a lot more than 23 million XRP continues to be stolen from a lot more than 80-90 users . Among them, a lot more than 13 million XRP have been laundered through exchanges or cash laundering services.
* On October 11, the cryptocurrency pocket ZenGo CEO Ouriel Ohayon tweeted that Safuwallet, the net cryptocurrency wallet, had been stolen by hackers by injecting malicious program code.
* From August to Sept, the Bitcoin pocket Electrum had been attacked by hackers twice. In accordance with statistics from numerous events, the phishing assaults forged Electrum enhance notifications have stolen at the very least 1,450 BTC, valued at $11.6 million.
For the wallet vulnerability problem, we recommend:
(1) On the main one hand, digital currency wallet providers should fortify the protection audit of these wallets, and on the other hand, they should conduct some audits including website name system protection testing, host instance protection testing, server-side program protection testing, etc., while monitoring private Security of secrets, mnemonics, transaction procedure, and data storage.
(2) For users who often use online wallets, collection different passwords in different systems and enable secondary authentication. Secondly, it is recommended that individual investors with large resource holdings use cool wallets with warm wallets. The warm and cool wallets are usually allocated according to specific usage needs, and the warm and cool wallets are divided to isolate risks.
4. Public string vulnerabilities
In 2019, there were a lot more than 8 general public chain attacks, which more than half were 51% attacks. Weighed against 2018, the frequency of attacks had been reduced and the losses were small.
* On January 5, Ethereum Common (ETC) suffered multiple 51% assaults, and 80,000 ETC had been used for double spending.
* On August 9, hackers launched a "dirt strike" on Litecoin, affecting 294,582 addresses.
At present, except for BTC, ETH along with other huge enough public chains that are extremely difficult to suffer from 51% attacks, all non-large general public chains plus some small public string currencies ought to be careful from the threat of 51% attacks.
When dealing with 51% assaults, it is necessary to help keep the computing power dispersed as much as possible. Over-concentrated computing power is the direct cause of 51% assaults. Based on the consensus of Satoshi Nakamoto, 51% assaults theoretically exist forever, and set an ideal wind. Control early warning system, the exchange adopts a good protection mechanism, in the event of a 51% strike, it can raise the number of block confirmations, suspend debris and withdrawals, and freeze suspicious accounts to avoid loss in time.
5. Improper use by users
In 2019, the overall security awareness of users has increased, and there are still individual users who have lost assets due to improper operation from the wallet private key and access to phishing websites.
(2) Using digital assets to conduct illegal transactions within the dark web
In 2019, the dark web is still an illegal location for cybercrime. It uses the anonymity of digital currency to conduct dealings and evade guidance. Bitcoin well worth 1.035 billion US bucks has been used for illegal activities over summer and winter. Bitcoin is exchanged within the dark web. The biggest category can be pharmaceuticals, Bitcoin is also probably the most "popular" digital currency, accompanied by Litecoin.
The dark web is filled with illegal activities such as for example arms, drugs, pornography, and fraud, which were threatening the security of society, enterprises and the country. The illegal goods in love with the dark web are diverse, primarily involving data, information, illegal software, hands, drugs, etc. Criminals usually choose digital currencies as their trading currencies, such as for example:
1. User data leaked and in love with the dark web
2. Forged and offered credit card Identification cards
3. Visa sales
4. Anonymous bank account and charge card account sales
5. Sales of harmful programs
6. Trafficking of hands and drugs with fake Identification cards
7. Drug dealing
(3) Using digital property to launder money
Since digital currency is a hidden line beyond your existing currency program, it forms a system of its. Its special properties make digital currency transactions extremely simple, and transfers could be produced through the web. If illegal operations are hard to trace, thus giving Criminal activities use new fund move channels to cover up stolen money.
Compared with additional financial tools, digital currency is more convenient for the money launderers. They no longer need to discover someone to use dirty money to buy gold, buy physical objects and then sell them to switch money. In the money laundering situations investigated and taken care of in 2019, a lot more than 5 billion U.S. bucks have been carried out through cryptocurrency, which Bitcoin is the first choice for the money laundering by criminals. The more typical cash laundering situations are the following:
In addition, virtual digital currency gambling can also achieve money laundering. Because gambling websites need not look for real-name authentication, it really is difficult for police agencies to learn who's depositing digital currency into the balances of gambling websites. There are now 100-200 gambling websites around the world that can use digital currency to pay for gambling. Criminals open balances on these websites, then transfer money to the account, conduct some small gambling, and some do not even conduct gambling operations, and then withdraw cash to a fresh address for the intended purpose of money laundering.
Digital currency has become an important tool for criminals around the world to launder money. For police agencies, it really is becoming increasingly hard to detect cash laundering also to trace the foundation and destination of funds.
(4) Cybercrime
Cybercrimes include scams, extortion, and the destruction of related blockchain service application companies. Criminals use Bitcoin's anonymity, more frequently choose Bitcoin like a ransom, and use ransomware or additional illegal means to perform blackmail Extortion actions.
In 2019, cyber-extortion attacks caused US$500 to at least one 1.5 billion in losses globally, a rise of 20% compared to last year. The criminal actions of blackmailing digital currencies have carried on, even
The more typical cases are the following:
It isn't difficult to note that this season is still a year in which all kinds of scams and crimes are rampant. All sorts of online frauds nevertheless account for a large percentage of cybercrime actions. Whenever we manage prosperity on the net financial platform, we have been faced with huge temptations. , Don't think in so-called ¨within information〃.
(5) Fund plate, MLM plate, Ponzi scheme and the project party try to escape
Criminals may use digital currency like a transaction tool for illegal fund-raising or fund-raising fraud, under the guise of investing in digital currency, building Bitcoin's underlying technology applications, and using digital currency to "move bricks" arbitrage. Operation modes such as for example scams conduct unlawful fund-raising or fund-raising scams. After the "possibility" arrives or problems occur, the gang only will run away.
In 2019, among the many cases of funds, MLM, wallets, and exchanges operating away, probably the most eye-catching event was the Plustoken wallet operating away on June 29. Numerous users reported the Plustoken wallet had been no longer able to withdraw money. The Plustoken pocket project The party can be suspected of operating away, and the amount involved may exceed 20 billion yuan. As of the start of Dec, the blockchain projects that went off this season involved a lot more than 25 billion yuan in money.
(6) Malicious mining
Power consumption is the main cost of mining, and it is also the main element to determining mining income. As the difficulty of mining boosts, the income from regular mining has become lower and lower, and many people have started illegal mining. concept.
Mining Trojans get rewards through the digital currency program by completing a large number of calculations. Mining Trojans and worms will consume a large amount of CPU and GPU sources in the computer during the calculation process, causing the computer to become abnormally slow, although it will not poison the computer. It will trigger direct losses, nonetheless it will hinder the procedure of the normal system, and the rate of transmission and the large amount of infection will bring great impact and reduction to government agencies and corporate solutions.
We recommend users to avoid using weak passwords and passwords, 1 password is not reused; close unneeded ports, upgrade program firmware; update essential patches in time, uninstall software from unknown resources; improve security consciousness, do not click on and browse some high-risk webpages, be cautious Open up some unknown docs, emails, hyperlinks, etc.
(7) Info leakage
In 2019, a total greater than 5 common information leakage incidents were documented. Although blockchain technology can get rid of the handle of big data information by centralized institutions to a certain extent, the tranny of personal privacy data could be made certain through encryption methods. Numerous exchanges and wallets nevertheless operate in a centralized manner, and it is inevitable that users' personal data will be kept. Once attacked, hackers may get yourself a large amount of user data and sell the data through dark web and other methods to obtain huge revenue.
4. The harm of criminal actions of digital assets Because of the reduced threshold of legal activities of digital assets, it is extremely simple to use digital assets to move funds. Digital resource crimes have become part of traditional crimes. Many traditional criminal organizations purchased digital currencies that aren't limited to Bitcoin. To aid their company, this trend will continue in 2020.
In accordance with relevant information, some offender organizations are attracting digital asset experts to provide them with suggestions about combining digital currency with scams, cash laundering, and unlawful gambling activities. You can find even some legal groups that are taking over exchanges and Bitcoin mining to clean funds. origins of.
The harm of digital asset crime cases will be huge.
Cases often pass on widely. Once a case happens, it can quickly spread to nations around the world. The impact is extremely poor. It not only causes heavy loss to global consumers, but also drastically problems and disrupts economic marketplaces, and criminals use digital currencies to do so. The money laundering, unlawful fund-raising, terrorist financing and other actions described in the article can also endanger public stability, disrupt public order, and also have a bad impact on world peacefulness and stability.
Particularly, criminals who use digital currency to commit crimes will suffer varying examples of losses for both formal enterprises and ordinary users within the digital currency industry.
For companies:
For enterprises, because of the large amount of funds occupied by systems such as digital currency exchanges, pocket providers, and general public chains, they involve an array of users, and relevant trading institutions have insufficient experience inside network security and security of trader assets. The primary target of hacker assaults.
Hackers use their very own vulnerabilities to strike the platform through various strike methods. The digital currency stolen is generally a huge amount. For most systems, it could be said to be drastically traumatized. Some exchanges have been hacked and their property are almost After being stolen, it'll be unable to operate normally and eventually go bankrupt, which might also affect the balance from the financial market.
For ordinary users:
For ordinary users, the attack software used by criminals could also invade ordinary users' computers and cell phones. Not only digital currency will be lost, but legal currency and personal information may also be stolen.
Criminals use digital currency to conduct dark web transactions, making it easier to circulate harmful chemicals such as drugs, private safety may also be threatened, and private privacy information is also at risk of being sold within the dark web at any time. Because of the lack of restrictions on cryptocurrency dealings, if you do not understand the industry and have insufficient knowledge reserves, it is easy to end up being manipulated and used by speculators, deceived by criminals, and belong to scams such as for example illegal financing, unlawful fund-raising, and extortion.
Hundreds of MLM cash have appeared in the world in 2019. Later, the victims of the MLM cash suffered heavy loss. There were numerous who lost their fortunes right away, and the family happiness of several victims was also adversely affected. Information have proved such harm And loss are intolerable for ordinary investors.
Generally speaking, the illegal criminal behavior of digital currency has incredibly bad influence in the industry:
1. The current private digital currency or quasi-digital currency is rolling out into an "unpredictable force" within the social economic climate.
Some criminals use digital currency like a cover to carry out unlawful fundraising and fraud actions, create "MLM cash", and maliciously speculate the price tag on digital currency. It has resulted in the development of a large number of digital currencies and the rapid increase in the level and cost of a huge number of private digital currencies, destroying the market stability.
2. Digital currency has be a part of the economic business. The skyrocketing cost of digital currency will also press up the amount involved, that may increase the reduction. And because digital currency is issued through the web, once illegal legal cases occur, they can be quickly delivered to countries around the world. Spreading will cause trouble for the world, and can undoubtedly have a negative impact on the economic business and disrupt the normal economic order.
3. Some serious unlawful crimes could also trigger marketplace panic, raise the seller's marketplace, trigger the price tag on digital currency to drop, and squeeze the market bubble.
4. Digital currency can be widely used to take care of fake passports, provide pornographic services, move illegal assets, trade drugs and underground hands and other dealings, that may disrupt social purchase, threaten the steady development of community, and also impact the formal procedure of the industry The development of the digital currency industry is without a doubt extremely bad for the entire digital currency business, the financial business, and the complete society.
5. Digital asset criminal offense emergency program and summary With the continuous advancement of blockchain, protection incidents will also emerge in endlessly. Behind what we can't see, the world of blockchain is continually staged some shocking security unpleasant and defensive battles. How to efficiently ensure the security of the complete blockchain ecosystem under the present new era of blockchain is definitely the path that the industry and professionals should believe and work tough. We call for and recommend:
(1) Focus on blockchain protection issues
In the 18th collective study session from the Political Bureau from the Central Committee, General Secretary Xi specifically emphasized the necessity to "advertise the orderly development of blockchain security." The more attention paid to the protection of blockchain at the national level, it will certainly inspire the public Worried about the protection issues from the blockchain.
(2) To build my country's "independently revolutionary blockchain security technology and guarantee program"
To be able to more implement the key instructions from the Politics Bureau from the Main Committee, the security company would be the backbone from the blockchain security industry, and it is necessary to build my country's "independent innovation, independent and controllable" blockchain security technology and guarantee system to enhance the blockchain Self-safety capabilities to avoid large losses from being attacked.
(3) Security risks faced by the current blockchain industry
The current blockchain industry nevertheless faces a large number of security risks, such as for example social security issues such as for example money laundering, extortion, and dark web transactions due to companies themselves neglecting to create security lines and security vulnerabilities in digital assets. Strengthening security supervision and establishing a solid security line of protection are important tasks for the current blockchain development.
(4) The entire industry needs good guidance
If blockchain technology is to better function our real economy, it can be used "correct". It's important to make good usage of blockchain technology, flexibly use blockchain technology, and not blindly mistreatment it. This involves blockchain practitioners to develop a positive business mindset from themselves and jointly advertise the healthy advancement of the blockchain business.
(5) The function of blockchain security companies
When confronted with current asset thefts due to security vulnerabilities within the blockchain system, along with the usage of digital assets to commit crimes, pyramid schemes, operating away along with other illegal activities, blockchain security companies have to go all out and take responsibility. Make more contributions to the healthy development of the industry, on the main one hand, support related companies in safety protection work, enhance safety protection capabilities, and reduce security losses; on the other hand, continue steadily to vigorously support government regulatory agencies in investigations and proof collection to efficiently strengthen safety guidance , Most of the good energy for your development of the industry, take the business lead in establishing orderly business norms, and advertise the construction of safety requirements.