Where Crypto Hacks Soar as North Korea Targets DeFi

The value of funds lost to cryptocurrency hacks has soared this year as decentralized-finance protocols have become an easy target for attackers, a report from blockchain analysis firm Chainalysis showed.

Around $1.9 billion worth of digital tokens has been stolen in hacks this year through July, up 58% from the same period of 2021, according to Chainalysis.

“This trend doesn’t appear set to reverse any time soon, with a $190 million hack of cross-chain bridge Nomad and $5 million hack of several Solana wallets already occurring in the first week of August,” the report said. 

DeFi protocols, especially cross-chain bridges used to transfer tokens across blockchains, have emerged as one of crypto’s weakest links after several large hacks this year. Because such protocols rely on open-source code, criminals can easily find bugs or other vulnerabilities to exploit, Chainalysis said. 

“It’s possible that protocols’ incentives to reach the market and grow quickly lead to lapses in security best practices,” according to the report.

In one ominous sign, criminal crypto activity appears to be more resilient than the wider digital asset market to tumbling cryptocurrency prices. The number of transactions Chainalysis labeled as illicit fell 15% through July from a year earlier, while legitimate transactions dropped at more than double that pace, according to the report. 

Axie Infinity’s Ronin bridge lost about $600 million to hackers in March and Harmony’s Horizon bridge was drained of $100 million in June. 

DeFi protocols have also become a frequent target of state-sponsored hacking groups. North Korea-affiliated groups have stolen approximately $1 billion of cryptocurrency from DeFi protocols so far this year, Chainalysis estimates.

While hacks continue to be a major threat, Chainalysis noted that illicit activity in other areas of crypto has seen a significant drop. Crypto-related scams garnered $1.6 billion so far in 2022, 65% less than a year earlier, according to the report. Revenue on so-called darknet marketplaces is down 43% this year, mainly due to the crackdown on the Hydra marketplace in April.

There are “strong indications” that Lazarus Group, a hacking collective with strong ties to Pyongyang, orchestrated the attack, blockchain analytics firm Elliptic said in a blog post Wednesday.

Most of the funds were immediately converted to the cryptocurrency ether, Elliptic said. The firm added that hackers have started laundering the stolen assets through Tornado Cash, a so-called “mixing” service that seeks to obscure the trail of funds. So far, around $39 million worth of ether has been sent to Tornado Cash.

Elliptic says it used “demixing” tools to trace the stolen crypto sent through Tornado Cash to several new ether wallets. Chainalysis, another blockchain security firm that’s working with Harmony to investigate the hack, backed up the findings.

Department attributed a $600 million heist on Ronin Network, a so-called “sidechain” for popular crypto game Axie Infinity, to Lazarus.

The United States has linked North Korean hackers to the theft of hundreds of millions of dollars' worth of cryptocurrency tied to the popular online game Axie Infinity, the U.S. Treasury Department said on Thursday.Ronin, a blockchain network that lets users transfer crypto in and out of the game, said digital cash worth almost $615 million was stolen on March 23