Blockchain & Cryptocurrency , Cryptocurrency Fraud , Fraud Management & Cybercrime

Cryptohack Roundup: Crackdown on Hamas' Cryptocurrency Flows

Every week, ISMG rounds up cybersecurity incidents in digital assets. This week: A crackdown on Hamas' cryptocurrency accounts, more revelations from the trial of Sam Bankman-Fried, Voyager Capital settles with the U.S. Federal Trade Commission - while former CEO Stephen Ehrlich does not - and Elliptic says hackers laundered $7 billion via cross-chain services. Also: Upbit saw attackers targeting its platform more than 159,000 times in the first half of this year, Stars Arena fixed a critical bug, THORSwap halted services to freeze movement of stolen funds, Galxe said it would compensate victims of a DNS attack, HTX's hacker returned the stolen funds for a "bounty," and Hong Kong sets up a working group to supervise crypto trading platforms.

See Also: OnDemand | Strengthen Cybersecurity with a Multi-Layered 3-2-1-0 Data Protection Strategy

Authorities are working to shut down cryptocurrency accounts belonging to Hamas after the terrorist group overran the Israeli border Saturday in incursions from the Gaza Strip. The cyber branch of Israeli police announced on Tuesday that it froze Hamas accounts on Binance, reported The Times of Israel. State authorities also worked with British police to freeze an account in Barclays bank, the newspaper said.

Cryptocurrency fundraising for terrorist financing activity is relatively low when compared to traditional fiat currency, said TRM Labs. Hamas nonetheless was the first terrorist organization to embrace cryptocurrency, with the organization's military arm, the Izz-Al Din-Al Qassam Brigades, attempting to use cryptocurrencies as an alternate fundraising method starting in early 2019, TRM said.

Hamas supporter GazaNow received about $5,000 since the Saturday attack and has a total of $800,000 associated with its cryptocurrency address since launching in August 2021, TRM calculates. A handle on social media network X, formerly Twitter, called @tofanalAqsa - the Hamas codename for its terrorist operation - solicited crypto donations through its Twitter account but failed to raise "significant" funds.

There will be an "increased focus on cutting off Hamas' ability to raise and move funds in the coming days and weeks," TRM said (see: ISMG Editors: How Crypto Helped Finance Hamas' Attacks).

More revelations about allegedly lax practices at FTX and sister trading firm Alameda Research continue to surface as the trial of former crypto wunderkind and disgraced FTX former CEO Sam Bankman-Fried progresses in U.S. federal court.

Among them: former Alameda head turned star witness Caroline Ellison testified Wednesday that Bankman-Fried ordered Alameda to bribe Chinese government officials $150 million in order to unfreeze accounts worth about $1 billion. Ellison recorded the transaction in a spreadsheet as "-$150 million for the thing," reported New York Magazine.

The bribe came after Bankman-Fried and Ellison attempted to retrieve money from the frozen accounts using Thai prostitutes' identities, The Washington Post reported. Ellison has testified that despite her title as Alameda co-CEO, and later as the sole CEO, she reported to Bankman-Fried. At one point, Bankman-Fried directed her to prepare fraudulent balance sheets for lender Genesis Global Capital that hid loans from FTX, Ellison testified. The former Alameda Research executive pleaded guilty to federal charges last December.

Bankman-Fried is on trial for two counts of fraud and five counts of conspiracy tied to charges that he shifted as much as $14 billion in customer funds from FTX to Alameda. He has pleaded not guilty. A prosecutor asked U.S. District for the District of Southern New York Judge Lewis Kaplan to instruct Bankman-Fried's defense counsel to have the defendant simmer down during Ellison's testimony, New York Magazine also reported. During a sidebar, a prosecutor told Kaplan that "the defendant has laughed, visibly shaken his head and scoffed." The over-the-top expressions could have a visible effect on Ellison, "especially given the history of this relationship, the prior attempts to intimidate her, the power dynamic, their romantic relationship," the prosecutor said. Ellison and Bankman-Fried had an on-again, off-again dating relationship.

The trial has other former employees coming out of the woodwork to describe working conditions. Aditya Bharadwaj, a former Alameda engineer who has recently been vocal about how the company operated, tweeted that Alameda lost $100 million after a trader clicked on a phishing link - one of the many such instances that led the company to losing millions of dollars. He also said that a former employee may have leaked an old version of plaintext keys, allowing an attacker to steal more than $50 million. "Even after all these incidents, no serious attempt was made to change the way we operated," he wrote.

Defunct crypto platform Voyager Digital settled with the U.S. Federal Trade Commission after the consumer agency accused it of misleading consumers. Voyager continued to assure consumers in the weeks leading up to its July 2022 bankruptcy that their funds were insured by the Federal Deposit Insurance Corporation, the FTC said in a complaint filed in federal court.

Just two weeks before freezing customer access to accounts, CEO Stephen Ehrlich sent a letter to consumers calling Voyager "well-capitalized and positioned to weather the bear market," telling them that their money was "as safe with us as at a bank."

The FTC cited these assertions in its complaint: "In reality, Voyager was not an FDIC-insured institution, the FDIC does not insure crypto-assets, and even consumers who held cash with Voyager would not be eligible for FDIC insurance in the event that Voyager failed," it said.

A settlement that still requires approval by a judge imposes a $1.65 billion fine on Voyager, with payment suspended to refund creditors during bankruptcy proceedings. The settlement also enjoins the company from disclosing "any nonpublic personal information about a consumer" without prior consent.

The agency said that Ehrlich has not agreed to a settlement and the FTC's case against him will proceed in federal court.

Ehrlich also faces additional litigation initiated by the Commodity Futures Trading Commission seeking restitution, disgorgement, civil monetary penalties, permanent trading and registration bans. The CFTC complaint alleges Ehrlich and Voyager pooled customer assets stored on the Voyager platform and "transferred billions of dollars' worth of customers' digital asset commodities as 'loans' to high-risk third parties."*

Hackers cumulatively laundered $7 billion of "illicit or high-risk funds" through cross-chain and cross-asset services, Elliptic said in a new report. North Korea's Lazarus Group is the "largest source" of all illicit funds laundered through cross-chain bridges and the third largest source of all cross-chain crime overall, having laundered over $900 million through cross-chain methods, it said. The amount of funds laundered via coin swaps, bridges and decentralized exchanges stood at $2.7 billion between July 2022 and July of this year (see: Researchers: North Korean Hackers Gain Speed, Flexibility).

Hackers targeted South Korean crypto exchange Upbit more than 159,000 times in the first half of this year, according to the local Yonhap News Agency, which cited the crypto firm's parent company Dunamu. The amount more than doubled compared to the first half of 2022 and spiked 1,800% compared to the same period in 2020. Upbit is one of South Korea's largest cryptocurrency exchanges, with a trading volume of around $1.2 billion. The company reportedly strengthened its hot wallet security and moved 70% of its holdings to cold wallets for safekeeping.

Avalanche-based social protocol Stars Arena last Thursday fixed a critical vulnerability that would have allowed hackers to drain more than $1 million worth of Avax coins from the project's smart contract.

THORChain-based decentralized exchange THORSwap is "temporarily transitioning" into maintenance mode to prevent hackers from moving funds via its platform. It will remain in maintenance mode until "a more permanent and robust solution can be implemented to ensure the platform's continued security and integrity," the company said. An illicit actor known as the FTX hacker transferred $38 million worth of cryptocurrency over the past week via THORChain.

Web3 credentials and rewards platform Galxe said it will make whole users who lost money in a recent DNS attack and provide an additional 10% over the initial loss amount to "show our appreciation for your trust in Galxe." The refund for 980 victims will cost the company a little over $396,000 .

The hacker who stole $8 million from crypto exchange HTX - formerly Huobi - returned the funds, and received a "whitehat bonus" of $400,000, the company's advisor Justin Sun said. The hacker advised the company on how to fix the hot wallet-focused vulnerability, to which HTX responded with a request, asking them to submit a security vulnerability report to "avoid similar incidents in the future," assuring the hacker that their "privacy will be protected."

The Hong Kong police and Securities and Futures Commission on Wednesday announced a working group to supervise crypto trading platforms. Comprising lawmakers from the police's Commercial Crime Bureau, Cyber Security and Technology Crime Bureau, Financial Intelligence and Investigations Bureau and the SFC's Enforcement Division and Intermediaries Division, the group is expected to boost coordination, facilitate information sharing on suspicious activities tied to virtual asset trading platforms as well as to assess risks.

*Updated Oct. 12, 2023 18:28 UTC: Adds that the Commodity Futures Trading Commission is also suing Stephen Ehrlich.