Binance CSO warns of darknet collaboration in crypto theft.

Lurking in the shadiest corners of the dark web is a “well-established” ecosystem of hackers that target cryptocurrency users with poor “security hygiene,” according to Binance’s chief security officer, Jimmy Su.

Speaking to Cointelegraph, Su said that hackers had shifted their gaze toward crypto end-users in recent years.

Su noted when Binance first opened in July 2017, the team saw plenty of hacking attempts on its internal network. However, the focus has shifted as crypto exchanges continued to beef up their security.

Phishing scams are particularly prevalent in emails. They are used as a way to collect your sensitive information by impersonating someone you trust. Use the blog below to learn how to stay safe from them. https://t.co/UtKBvR52lX

— Binance (@binance) July 4, 2023

“Hackers always choose the lowest bar to achieve their goals because, for them, it’s a business as well. The hacker community is a well-established ecosystem.”

According to Su, this ecosystem comprises four distinct layers: intelligence gatherers, data refiners, hackers and money launderers.

Data gatherers

The most upstream layer is what Su described as “threat intelligence.” Here, bad actors collect and collate ill-gotten intel about crypto users, creating entire spreadsheets filled with details about different users.

This could include crypto websites a user frequents, what emails they use, their name, and whether they’re on Telegram or social media.

“There is a market for this on the dark web where this information is sold […] that describes the user,” explained Su in a May interview.

Su noted this information is usually gathered in bulk, such as previous customer information leaks, or hacks targeting other vendors or platforms.

An employee of our email vendor, https://t.co/6vM4WAcJal, misused their employee access to download & share email addresses with an unauthorized external party. Email addresses provided to OpenSea by users or newsletter subscribers were impacted. https://t.co/Osb6qqkqZZ

— OpenSea (@opensea) June 30, 2022

In April, a research paper by Privacy Affairs revealed cybercriminals have been selling hacked crypto accounts for as little as $30 a pop. Forged documentation, often used by hackers to open accounts on crypto trading sites, can also be bought on the dark web.

Data refiners

According to Su, the data gathered is then sold downstream to another group — usually made up of data engineers specializing in refining data.

“For example, there was a data set last year for Twitter users. […] Based on the information there, they can further refine it to see, based on the tweets to see which ones are actually crypto-related.”

These data engineers will then use “scripts and bots” to figure out which exchanges the crypto enthusiast may be registered with.

They do this by attempting to create an account with the user’s email address. If they get an error that says the address is already in use, they’ll know if they use the exchange, which could be valuable information that more targeted scams could use, said Su.

Hackers and phishers

The third layer is usually what creates headlines. Phishing scammers or hackers will take the previously refined data to create “targeted” phishing attacks.

“Because now they know ‘Tommy’ is a user of exchange ‘X,’ they can just send an SMS saying, ‘Hey Tommy, we detected someone withdrew $5,000 from your account; please click this link and reach customer service if it wasn’t you.’”

In March, hardware wallet provider Trezor warned its users about a phishing attack designed to steal investors’ money by making them enter the wallet’s recovery phrase on a fake Trezor website.

The phishing campaign involved attackers posing as Trezor and contacting victims via phone calls, texts, or emails, claiming that there has been a security breach or suspicious activity on their Trezor account.

Getting away with it

Once the funds are stolen, the final step is getting away with the heist. Su explained this could involve leaving the funds dormant for years and then moving them to a crypto mixer such as Tornado Cash.

Related: Arbitrum-based Jimbos Protocol hacked, losing $7.5M in Ether

“There are groups that we know that may sit on their stolen gains for two, three years without any movement,” added Su.

While not much can stop crypto hackers, Su urges crypto users to practice better “security hygiene.”

This could involve revoking permissions for decentralized finance projects if they no longer use them, or ensuring communication channels, such as email or SMS used for two-factor authentication, are kept private.

Magazine: Tornado Cash 2.0 — The race to build safe and legal coin mixers

We will continue to update Phone&Auto; if you have any questions or suggestions, please contact us!

Share:

Was this article helpful?

93 out of 132 found this helpful

Discover more

DeFi

Coinbase CEO Bitcoin could be the key to expanding Western civilization

Coinbase CEO believes that Bitcoin may become a key to the expansion of western civilization and sees potential for c...

Bitcoin

Spot Bitcoin ETFs: More Than Just a Drop in the Bitcoin Bucket 💰📈

While some may be disappointed by the short-term performance of a Bitcoin ETF, according to VanEck advisor Gabor Gurb...

Market

Bitcoin traders are anticipating a rebound to previous high levels of trading after the price of BTC reaches $42,000.

Bitcoin has successfully risen back up to the $42,000 mark, indicating a possible end to the recent sell-off. This de...

News

The Secret Language of Robots: Trustworthiness and Dialects

A team of German researchers has discovered mixed findings regarding the trustworthiness of an artificial intelligenc...

Policy

Breaking News: WisdomTree Tries to Crack the SEC Code for Bitcoin ETF Approval

WisdomTree submitted an updated S-1 form to the SEC for their Bitcoin ETF prospectus, following in the footsteps of o...

News

Elon Musk Seeks More Voting Control at Tesla: A Quest for AI Influence

Elon Musk has proposed a compensation plan that would grant him 25% voting control at Tesla, with the ultimate goal o...