How much stolen cryptocurrency is in circulation? A lot. Just last month, hackers breached Bithumb and Coinrail, two South Korea–based cryptocurrency exchanges, and stole over $70 million worth of various crypto tokens.
Bithumb and Coinrail are not alone in their ordeal. Since the founding of the first cryptocurrency exchange in 2010, hackers have walked away with billions of dollars’ worth of cryptocurrencies and digital tokens stolen from exchanges, and they continue to eye the cryptocurrency landscape as an attractive arena to make money. In 2014, a huge $460 million breach at Mt Gox caused the collapse of the then-largest bitcoin exchange and a sudden drop of the price of cryptocurrencies.
Aside from directly stealing from exchanges, cybercriminals are also using other methods to illegally earn cryptocurrencies. This includes cryptojacking scripts, software that secretly uses computer resources to mine cryptocurrencies, and ransomware, malware that locks out users from their files and only restores their access after they pay attackers a certain amount of cryptocurrency.
The appeal of cryptocurrency to cybercriminals is largely due to the lack of legal and technical safeguards to protect individuals, exchanges and organizations against money laundering and fraud. The lack of security damages the entire industry, and every new heist results in a steep drop in trust and value of cryptocurrencies.
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!
But as cryptocurrencies slowly develop from a geek niche to a financial landscape sprawling over hundreds of billions of dollars and thousands of currencies, solutions are emerging to make the market more reliable and resilient against malicious activities.
What happens to the dirty money?
To be able to spend their stolen stash, hackers have to convert their cryptocurrencies to fiat at cryptocurrency exchanges. In the past two years, with the explosion of ICOs and crypto-tokens, hackers have turned their attention to smaller tokens. Many of the last year’s hacks were staged against these smaller tokens.
In July 2017, hackers stole $7.53 million from CoinDash’s ICO and directed the CDT tokens to their own wallet address. In January, another attack robbed Coincheck, a Japan-based exchange, of $400 million worth of NEM tokens.
Cryptocurrencies are based on blockchain, a transparent distributed ledger where every transaction is stored in a transparent and immutable way. Most cryptocurrencies are traceable, which means anyone can trace where money goes by following the addresses it is transferred to after it is stolen.
Hackers usually take their stolen tokens to the decentralized exchanges (DEX). Decentralized exchanges are less regulated than their centralized peers such as Coinbase and Binance. Because DEXs generally don’t have proper know-your-customer (KYC) safeguards, hackers have an easier time laundering their stolen tokens, and they provide hackers with the anonymity they require to launder their tokens.
Since token-to-token trading is possible on DEX, hackers convert their loot to other tokens or to mainstream cryptocurrencies such as Bitcoin and Ethereum. In doing so, hackers can make it difficult to trace stolen cryptocurrencies and cash them out using centralized exchanges. Hackers use DEXs to convert their loot to other tokens or to mainstream cryptocurrencies such as bitcoin and Ethereum. This enables them to obscure their traces and then take the stolen cryptocurrencies to centralized exchanges where they can cash them out.
A decentralized approach to fighting fraud and money laundering
Aside from supporting digital money, blockchain also has applications in cybersecurity. Several organizations are using the technology to fight censorship and cyber attacks such as distributed denial of service and data tampering.
However, blockchain can also help fight the exact same kind of fraudulent activity that decentralized exchanges are suffering from. This is the focus of the Sentinel Protocol, a blockchain-based threat intelligence platform created by Uppsala Foundation, a Singapore-based cybersecurity firm. Patrick Kim, the founder of Uppsala Foundation, himself was a victim of cryptocurrency theft and lost 7,218 Ether in 2016 due to a vulnerability in an Ethereum wallet. Kim created Sentinel Protocol so that others didn’t have to go through the same painful experience.
At the heart of Sentinel Protocol is a decentralized threat reputation database (TRDB), which contains blockchain addresses associated with theft, fraud and ransomware, IP addresses, malware signatures, file hashes and other relevant information. Sentinel Protocol relies on a crowdsourced community of cybersecurity experts, which it calls Sentinels, to maintain its TRDB.
Any white hat hacker or security expert can become a Sentinel by analyzing and validating incident reports and other data points. For their contributions, they receive Sentinel Points (SP), which are reputation points that determine their standing in the security community. Sentinel Points can be converted to UPP tokens—the Sentinel Protocol’s circulation currency.
By integrating Sentinel Protocol into their platforms, cryptocurrency exchanges will be able to detect and block of fraudulent and malicious transactions by comparing source and destination addresses against Sentinel’s TRDB. This is especially useful to DEXs, where hackers are flocking to launder and cash their ill-gained fortunes.
The automated vetting of cryptocurrency addresses will help build trust, ensuring customers that they will not become involved in transactions with malicious parties. It will also make it much harder for criminals to use cryptocurrency exchanges to hide their traces and spend their stolen cryptocurrencies without giving themselves away.
Organizations can freely integrate Sentinel’s TRDB API into their software and query the database. In the near future, more advanced features will be available, such as Machine Learning-based anomaly detection or Distributed-sandboxing, both of which can be purchased with UPP tokens. Customers can purchase UPP from exchanges. Sentinels can convert their Sentinel Points to UPP. Using this method, white hat hackers can earn money by using their security expertise.
Sentinel Protocol has already partnered with Bibox, one of the top ten cryptocurrency exchanges in terms of trade volume, to protect users against scams and fraud. Sentinel Protocol is also working with decentralized exchanges such as IDEX, DDEX and DEx.top to explore ways they can leverage the TRDB. These DEXs share Sentinel Protocol’s initiative of stopping the use of stolen cryptos, improving compliance with Anti-Coin Laundering (ACL) and potential counter-terrorism finance regulations later in the future. Hopefully, these partnerships will help identify and trace cybercriminals that are financing their malicious activities through cryptocurrencies.
The decentralized approach to fighting fraud and scams is a crucial step toward making sure that cryptocurrencies are a reliable component of the future of payments and finance.
Get the TNW newsletter
Get the most important tech news in your inbox each week.
This post is brought to you by The Cointelegraph and shouldn't be considered investment advice by TNW. Yes, TNW sells ads. But we sell ads that don’t suck.
