North Korean hackers said to have stolen nearly $400 million in ...

New York CNN Business —

North Korean hackers stole nearly $400 million worth of cryptocurrency in 2021, making it one of the most lucrative years to date for cybercriminals in the severely isolated country, according to a new report.

Hackers launched at least seven different attacks last year, primarily targeting investment firms and centralized exchanges with a variety of tactics, including phishing, malware and social engineering, according to the report from Chainalysis, a firm that tracks cryptocurrency. The cybercriminals worked to gain access to organizations’ “hot” wallets — digital wallets that are connected to the internet — and then move funds into DPRK-controlled accounts.

The thefts are the latest indication that the heavily sanctioned country continues to rely on a network of hackers to help fund its domestic programs. A confidential United Nations report previously accused the regime of North Korea’s leader, Kim Jong Un, of conducting “operations against financial institutions and virtual currency exchange houses” to pay for weapons and keep North Korea’s economy afloat.

Last February, the US Justice Department charged three North Koreans for conspiring to steal more than $1.3 billion from banks and companies around the world and orchestrating digital heists of cryptocurrency.

“North Korea is, in most respects, cut off from the global financial system by a long sanctions campaign by the US and foreign partners.” said Nick Carlsen, analyst at blockchain intelligence firm TRM Labs. “As a result they have taken to the digital battlefield to steal crypto in, essentially, [a] bank robbery at the speed of the internet, to fund weapons programs, nuclear proliferation and other destabilizing activities.”

The North Korean hacking efforts have benefited from the surging value of cryptocurrencies. The rise in cryptocurrency prices and usage has generally made digital assets increasingly attractive to malicious actors, leading to more blockbuster crypto heists in 2021.

According to Chainalysis, most of last year’s thefts were carried out by the Lazarus Group, a hacking group with links to North Korea that has previously been linked to the hack on Sony Pictures, among other incidents. The group has been hit with US sanctions.

There is little the United States or other countries can practically do to combat the North Korean crypto hacking activities, other than sanctions and defensive cybersecurity measures, as criminals face no real chance of extradition.

As the cryptocurrency market grows more popular, “we are likely to see continued interest by North Korea to target crypto businesses that are young and building out cyber defenses and anti-money laundering controls,” said Carlsen.

Feds arrest a New York couple and seize $3.6 billion in stolen ...

1. How relevant is this ad to you?

Video player was slow to load content Video content never loaded Ad froze or did not finish loading Video content did not start after ad Audio on ad was too loud Other issues

Axie Infinity's Ronin network suffers hack and theft of over $600 million

New York CNN Business —

The latest crypto hack has targeted a gaming-focused blockchain network that supports the popular video game Axie Infinity. Hackers made off with about $625 million worth of Ethereum and USDC, two cryptocurrencies, in one of the largest crypto hacks of all time.

The hackers breached the Ronin Network, an independent and Ethereum-compatible blockchain developed by Axie Infinity publisher Sky Mavis. Axie Infinity co-founder Jeff Zirlin discussed the hack on stage during a keynote address at the NFT LA conference.

“We realized the Ronin network has been exploited for 173,000 [Ethereum] and around 25 million dollars in USDC,” Zirlin said, under a screen with the words “State of the NFT Union: Where we are today and what’s next.” USDC is a so-called stablecoin whose value is pegged to the US dollar.

“It is one of the bigger hacks in history,” he added, while vowing to continue building. “We believe in a future of the internet that is open and owned by the users.”

Last year, an anonymous hacker stole roughly $600 million in cryptocurrency from Poly Network, a decentralized finance network, in what was called the largest crypto heist in history. The hacker later gave it back.

John Reed Stark, a former chief of the Security and Exchange Commission’s Office of Internet Enforcement, told CNN the latest hack “is a sobering reminder of just how vulnerable Web3 marketplaces are to cyber attacks.” (Web3 refers to the idea of a decentralized internet powered by the blockchain, the technology that underpins various cryptocurrencies.)

“The entire web3 marketplace is so fraught with chaos and lawlessness, we may never learn the truth about what happened,” said Stark. “And unlike U.S. financial firms who must report cyber-attacks fairly, accurately, promptly, etc., NFT and other Web3 marketplaces do not have to report anything at all.”

Axie Infinity is a successful web3 game in which players use NFT digital pets, called Axies, to interact with the game’s community. Players can use their Axies to battle other players and to breed new Axies. In 2021, the game’s creator raised $152 million in Series B funding led by famed VC fund Andreessen Horowitz.

According to a blog posted to the Ronin network’s official Substack on Tuesday, the system has halted activity on networks that allow players to convert assets in the Axie Infinity universe and to convert currency between the Ethereum and Ronin blockchains. Players who keep digital funds on the Ronin network are currently unable to make transactions.

Beginning on March 23, attackers compromised private keys used to validate transactions on the network, according to the company blog post. These keys allowed the malicious actors to forge fake withdrawals. The activity went unnoticed until a user was unable to withdraw funds and filed a report.

The network pledged to “ensure no users’ funds are lost,” according to the blog post. Most of the stolen funds currently remain in the hacker’s crypto wallet, the company said.

“We are working with law enforcement officials, forensic cryptographers, and our investors to make sure that all funds are recovered or reimbursed,” the network tweeted.

At the NFT LA conference, some attendees just learning about the hack were unperturbed by the news.

“I don’t think the coin is going down too bad,” said Justin Seeley, who owns Axie Infinity NFTs and tokens, said, referring to Axie Infinity’s Ronin token that was had plummeted 20% on the news of the hack.

“Twenty percent … that’s not too bad. Other projects would be down way worse,” added Ben Wright, who also says he is invested in Axie

“We’re in crypto; 20% is nothing,” said Seeley.

Other NFT play-to-earn (P2E) games at the conference were surprised to learn the news

“Axie got hacked!” two workers told each other in disbelief at a booth for Polker, a P2E poker game.

“It worries me, but I like it,” said Conor Thacker, Polker’s managing director. “The more exploits that happen now, the less will happen in the future.”

Elizabeth Warren unveils bipartisan bill to crack down on crypto ...

New York CNN —

As federal prosecutors seek to imprison former crypto darling Sam Bankman-Fried, Sen. Elizabeth Warren is attempting to push through Congress a bipartisan crackdown on money laundering in the crypto industry.

The Massachusetts Democrat is teaming up with Republican Sen. Roger Marshall of Kansas to introduce new legislation on Wednesday that would seek to close loopholes in the financial system that pose national security risks by allowing digital assets to be used for money laundering, Warren’s office told CNN.

Due to time constraints, the Warren-Marshall crypto legislation has little chance of getting through this Congress. The bill would need to be reintroduced when the new Congress is seated.

The effort aims to level the playing field by forcing crypto firms to play by the same rules that apply to banks and traditional firms.

“I’ve been ringing the alarm bell in the Senate on the dangers of these digital asset loopholes, and I’m working in a bipartisan manner to pass common-sense crypto legislation to better safeguard U.S. national security,” Warren told CNN in an exclusive statement.

Alluding to the FTX scandal, Warren said the bankruptcy of a major crypto platform and criminal prosecution of its former CEO means that digital assets are “under serious scrutiny across the political spectrum.”

The push from Warren and Marshall comes just a day after Bankman-Fried, the former CEO of crypto exchange FTX, was indicted for money laundering and multiple other federal offenses. Prosecutors allege Bankman-Fried engaged in a global scheme to deceive and defraud customers, investors, lenders and the campaign finance system.

The new bill, called the Digital Asset Anti-Money Laundering Act, would attack money laundering by attempting to bring the digital asset ecosystem into compliance with the existing system of anti-money laundering in the worldwide financial system.

The legislation would direct the Financial Crimes Enforcement Network (FinCEN) within the Treasury Department to designate digital asset wallet providers, miners, validators and others as money service businesses. That in turn would extend responsibilities in the Bank Secrecy Act to the crypto industry, including Know-Your-Customer (KYC) requirements.

The Treasury Department warned earlier this year that ransomware hackers, drug traffickers and fraudsters are using digital assets to launder illicit proceeds. US officials have also alleged that North Korea, Iran, Russia and other countries have turned to crypto to launder money and even get around sanctions.

“Following the September 11, 2001 terrorist attacks, our government enacted meaningful reforms that helped the banks cut off bad actors’ from America’s financial system,” Marshall said in a statement. “Applying these similar policies to cryptocurrency exchanges will prevent digital assets from being abused to finance illegal activities without limiting law-abiding American citizens’ access.”

The legislation comes as Warren and other lawmakers are scheduled to hold a hearing on Wednesday about the crypto crash and the harm to consumers.

The bill would also force regulators to push ahead with new restrictions aimed at closing a gap for digital wallets that lets people bypass anti-money laundering and sanctions checks.

Specifically, it would direct FinCEN to finalize and implement a rule proposed in 2020 that would require banks and money service businesses to verify customer and counterparty identifies, keep records and file reports linked to unhosted wallets or ones in jurisdictions that are not compliant with the Bank Secrecy Act.

Other requirements in the legislation include:

- Banning banks and other financial institutions from using or transacting with anonymity-enhancing technologies such as digital asset mixers and from handling or transacting with digital assets that have used those technologies.

- Extending Bank Secrecy Rules on reporting of foreign bank accounts to include digital assets by requiring Americans engaged in digital asset transaction greater than $10,000 through offshore accounts to file a report with the Internal Revenue Service.

- Directing regulators to strengthen enforcement of Bank Secrecy Act compliance by establishing compliance examination and review process for money service businesses.

- Cracking down on digital asset ATMs by making sure operators and administrators submit and update the physical addresses of their kiosks.

The stunning revelations in the Bankman-Fried charges underscore how crypto remains the wild west of the financial world. But it’s not clear whether the FTX scandal will be enough to prompt Congress to take major action.

Isaac Boltansky, director of policy research at BTIG, told CNN that despite all the “finger pointing” over FTX, it is “exceedingly difficult” to see Congress passing comprehensive crypto reform anytime soon.

“Everyone on Capitol Hill can agree that Bankman-Fried is a crook,” Boltansky said, “but when we move from the high level to the ground level, it becomes clear that legislative hurdles and potholes remain.”

Boltansky said those obstacles include jurisdictional battles and the “reality that Congress tends to have a relatively short attention span.”

Still, a more targeted legislative package aimed at stablecoins or money laundering has potential to get through Congress next year, he said.

PayPal enables Ukrainian accounts to send and receive money ...

CNN —

PayPal (PYPL) said Thursday it is expanding its services for Ukrainian accounts and allowing them to send and receive money from friends and family.

The payments company also said in a letter to the Ukrainian government that Ukrainian account holders will be able to transfer money from their PayPal accounts to credit and debit cards, as well as to external bank accounts by linking an eligible Visa or Mastercard debit or credit card.

“We believe this service will be helpful for people in Ukraine to receive money from their friends and relatives around the world,” PayPal wrote in a letter dated March 17 to Ukraine’s Minister of Digital Transformation, Mykhailo Fedorov. “It will also help Ukrainian refugees in other countries, so they can receive money to use or withdraw in their current location.”

Previously, PayPal users in Ukraine could only send money internationally from their accounts, not receive it, the company told CNN Business.

PayPal is also waiving transaction fees for remittances to Ukrainian accounts, for both senders and recipients. The change also applies to Xoom, PayPal’s global remittance platform, the company said in a blog post.

Money transferred from a PayPal account to a linked debit or credit card will make the funds available in the card’s local currency. Ukrainian users will be able to send and receive euros, US dollars, Canadian dollars and British pounds.

The temporary service expansion will last through the end of June, the company said.