The curious case of the $600 million crypto heist

Cryptocurrency investors person been transfixed implicit the past fewer days by the antics of a mysterious hacker who stole much than $600 million—before giving immoderate of it back.

But is the thief a bully samaritan who stole the wealth to exposure a unsafe information flaw, oregon did they simply realise they were astir to beryllium caught?

The hacker struck Poly Network, a institution that handles cryptocurrency transfers, connected Tuesday successful 1 of the biggest thefts of integer monies successful history.

By Thursday they had returned immoderate $342 million—still acold abbreviated of the total, but capable to rise furious speculation implicit their motives.

In messages embedded successful the transactions, the thief insisted they stole with good intentions.

"I americium not precise funny successful money!" they wrote, adding it was "always the plan" to instrumentality the stolen funds.

Digital sleuths

Despite their volatility and concerns implicit the immense discarded of energy they generate, cryptocurrencies similar Bitcoin and Ethereum person soared successful popularity successful caller years.

Their combined marketplace worth presently stands astatine astir $2 trillion, creating alluring prospects for hackers.

Most notoriously, thieves stole 850,000 Bitcoins from Japanese speech Mt. Gox successful 2014. Worth astir $470 cardinal astatine the time, the coins would contiguous beryllium worthy a staggering $38 billion.

Another Japanese exchange, Coincheck, was hacked for astir $500 cardinal successful 2018.

But successful some cases, the exertion that cryptocurrency uses allowed immoderate of the funds to beryllium traced—even though for Mt. Gox, it came excessively precocious to prevention the company.

Cryptocurrencies usage blockchains, integer ledgers that grounds each transaction made.

Pawel Aleksander, an adept successful tracking stolen cryptocurrency, said thieves typically effort to screen their tracks by splitting the wealth up and moving it around—"sometimes utilizing hundreds of thousands of consecutive transactions".

But his institution Coinfirm is among a increasing fig that specialise successful pursuing dizzyingly analyzable blockchain transactions, helping instrumentality enforcement agencies and investors to hint stolen assets.

While immoderate crypto-aficionados are hailing the Poly hacker arsenic a hero, others fishy they began handing the wealth backmost due to the fact that sleuths were connected their trail.

The returns began aft SlowMist, different investigative firm, claimed to person identified immoderate of the hacker's idiosyncratic details, including their email.

"It's hard to accidental what the hacker's archetypal volition was," said Aleksander's workfellow Roman Bieda.

"The hacker could beryllium simply acrophobic of enactment taken against him," helium suggested, though helium added that "white hat" ethical hackers bash often question to publically shame companies for their information flaws.

Some investors would besides see it a "fair bargain" for the hacker to support immoderate of the money, arsenic a reward for uncovering the information flaw, Bieda said.

End of the Wild West?

Crimes involving cryptocurrencies are connected a downward trend, contempt spectacular thefts similar this 1 and concerns astir their usage by criminal gangs.

A study this period by information steadfast CipherTrace estimated planetary crypto-crime losses astatine $1.9 cardinal past year, down from $4.5 cardinal successful 2019.

It did, however, pass of an alarming emergence successful hacking and fraud linked to decentralised finance, oregon "defi"—a signifier of crypto-financing, including loans, designed to chopped retired intermediaries similar banks.

The Poly heist is portion of that trend, with the institution calling it the biggest hack "in defi history".

"The imaginativeness of fraudsters successful this manufacture is perpetually developing," said Syedur Rahman, a British lawyer who specialises successful cases involving cryptocurrencies.

But helium added that tighter regulations are progressively forcing cryptocurrency exchanges to verify users' identities, portion law enforcement agencies are increasing much experienced successful handling crypto-crimes.

Hackers extracted a $4.4 cardinal ransom successful Bitcoin from lipid institution Colonial Pipeline successful May, but the FBI was capable to way down astir of the coins and prehend them.

Retrieving stolen crypto-assets tin inactive beryllium difficult, however.

"Criminal activities successful crypto are precise overmuch multinational," said Aleksander.

"It's emblematic that the victims beryllium successful antithetic jurisdictions, and the exchanges are registered successful antithetic jurisdictions."

Victims' conflict to claw backmost wealth stolen successful the Mt. Gox hack has been bogged down successful years of planetary litigation.

And hiring sleuths to hint stolen assets is an costly enactment that is often retired of scope for idiosyncratic investors deed by hackers.

"When you person a user who has mislaid a nominal sum, there's not overmuch that tin beryllium done," said Rahman.

---

---

© 2021 AFP