£3.1 billion was stolen from cryptocurrency businesses in 2022, the biggest year yet for crypto hacking, according to research by Chainalysis.

October was the single biggest month for cyrptocurrency hacking ever, with £630.2 million stolen across 32 different attacks.

The year also saw a peak in March with £594.9m stolen as hacking events undulated throughout the year.

Top Trends

North Korea Drives DeFi Hacks

North Korea-linked hackers such as the Lazarus Group have been the most prolific cyrptocurrency hackers over the past few years, and in 2022 they outdid themselves, stealing an estimated £1.38bn worth of cryptocurrency.

With North Korea’s total exports amounting to £115m in 2020, hacking has made up a considerable portion of the country’s economy.

$1.1bn of this was stolen in hacks of Decentralised Finance (DeFi) protocols.

DeFi protocols were the pimary crypto target in 2021, with the trend only intensifying in 2022, with North Korea as one of the driving forces of this trend.

DeFi protocols accounted for 82.1% of all cryptocurrency stolen by hackers, totalling £2.5 billion. 64% of this came from cross-chain bridge protocols.

These allow users port their cryptocurrency from one blockchain to another, typically by locking the user’s assets into a smart contract on the original chain, and then minting equivalent assets on the second chain.

Bridges are essentially honey pots for hackers, as the smart contracts become huge centralised repositories of funds backing the assets that have been bridged to the new chain.

If a single vulnerability is spotted in the code, it poses a major security risk.

The North Korea-linked hackers typically send much of what they steal from DeFi protocols to other DeFi protocols or use mixers to delete any traces.

This is because DeFi hacks often acquire illiquid tokens that then need to be swapped for more liquid assets via other DeFi protocols.

Mixing it Up 

In order to liquidate large sums, North Korea-linked hackers also tend to send their assets to mixers, cornerstones of the money laundering process in cyrpto.

Tornado Cash was North Korea-linked hackers go-to mixer for much of 2021 and 2022.

For a time, Tornado Cash was the biggest mixer operating, and their technical attributes made funds fairly difficult to trace compared to other mixers.

However, Tornoado Cash was sanctioned in August 2022, so hackers had to look elsewhere for mixing services.

Recommended

• Tech Nation to Cease Operations
• CyberScotland Week to Highlight Growing Threat of Cyber-crime
• CodeClan Partners with Eden Scott in Bid to Close Skills Gap

While still operational, mixers tend to be less effective with fewer users, to Tornado Cash suffered as hackers diversified their mixers.

Hackers turned instead to Sinbad, a relatiely new mixer whcih showed up on BitcoinTalk forum in October 2022. North Korea-linked hackers started using the services in December 2022, Chainalysis reports.

During December 2022 and January 2023, North Korea-linked hackers have already sent a total of 1,429.6 Bitcoin to the mixer, work approximiately £19.66.

Fighting Back 

Chainalysis did see some hope despite the increase in hacking, as the ability of national security agencies to fight back as grown.

The first ever seizure of funds stolen by North Korea-linked hackers occurred in 2022, with agents recovering £24.4m worth of stolen cryptocurrency in the Axie Infinity Ronin Bridge hack.

This, combined with the efforts of OFAC and other agencies to cut off hackers’ money laundering services from the rest of the crypto ecosystem, means that we might see a downturn in these attacks in the coming years.

Get all the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.