Step by step: How crypto fraud and security breaches are investigated

What’s an exchange’s next move after falling victim to a security breach? This is a step-by-step guide to following a crypto thief’s tracks through analytics software.

It’s every exchange’s worst nightmare: Falling victim to a security breach. An incident can disrupt a trading platform’s operations for weeks, affect customer confidence and damage a carefully cultivated reputation — even causing crypto markets to fall in some cases.

Crypto companies have been ramping up their security measures in recent years, determined to ensure that malicious actors don’t get an opportunity to infiltrate their systems. This has prompted hackers, scammers and fraudsters to rely on more sophisticated techniques.

One crucial weapon has emerged that helps trading platforms take speedy action in the event that their infrastructure is compromised: Analytics software. But how do these companies go about their investigations whenever a breach is reported? What are the tools that can be relied upon to follow a thief’s tracks?

This is a step-by-step guide to investigating crypto fraud, security breaches and ransomware.

Hunting the hackers

Irrespective of whether cryptocurrencies are stolen through fraudulent activities or scams — with ransomware becoming an increasingly popular method for swindling victims — investigation techniques often follow a similar pattern.

The first step is to identify a criminal’s crypto address as soon as possible. This information can then be passed on to analytics software companies, which can immediately tag the address as high risk. Doing this quickly can ensure that the entity is easier to track. There can be times when there’s little information about an address hash, but this doesn’t mean that there’s a dead end. That’s because transaction and date filtering can be used instead.

Next, it’s a race against time to start tracking bad actors who may begin to obfuscate the funds that they have misappropriated. They may start sending transactions to other exchanges or use mixing services and darknet entities. Although this commonly happens immediately after crypto has been taken, it can sometimes take months or years for obfuscation to commence — when a criminal may think no one is looking. Analytics providers can offer transaction alerts to ensure that victims can be immediately notified when funds flow to or from an address.

These transaction alerts need to be acted upon as a matter of urgency, as work begins to follow the trail. A crucial step involves notifying exchanges that might end up receiving some of this crypto to ensure they are able to block stolen funds that flow into their accounts. Visualization tools can play a role in illustrating how misappropriated assets are distributed — and show the addresses that may be directly or indirectly connected to the criminal.

An investigation in action

Crystal Blockchain has shared an example of how investigations work in practice. The analytics software provider recently played an instrumental role in examining the aftermath of a hot wallet security breach that affected Eterbase in September 2020, which Cointelegraph reported on at the time.

Immediately after the theft took place, Eterbase sprang to action by publicly announcing the address that was used by the Bitcoin thief. This enabled Crystal to immediately tag this wallet as a high-risk entity.

Quickly, it became possible to piece together information about this address — including statistics on further transactions and connections. It soon emerged that this suspicious wallet had connections to 16 other addresses.

Through Crystal’s All Connections tool, it was revealed that this address had indeed received funds from Eterbase, as well as other exchanges, which had been sent on to a plethora of unnamed entities.

The company said it was able to look further than a one-hop distance — and include indirect connections in its results. From here, it was established that 80% of the total funds that were stolen had been sent to a mixing service.

Eterbase went live once again on Jan. 15 — with its team asking exchange users to stop using old crypto deposit addresses that belonged to their accounts. In an update at the end of January, the company said that an official investigation is still ongoing — and it stressed that affected users who are eligible for a refund will receive one as soon as possible.

Keeping track

Crystal Blockchain says crypto crime is growing in parallel with the crypto markets. The company recently released a map of security breaches and fraud within the digital assets sector over the past 10 years.

The interactive timeline tracks the number of incidents in every year since 2011, and also provides a total figure for the funds that were stolen. Its data suggests that $1.48 billion was taken across 28 incidents in 2020.

Users who visit this article can also use a spinning globe to find out the total volume of funds that have been stolen in countries around the world — with the hardest-hit nations colored in the darkest shade of red.

According to Crystal, the most common locations for exchange breaches include the U.S., the U.K., South Korea, Japan and China. The largest-ever crypto security breach remains the incident involving the Japanese exchange Coincheck in 2018, overtaking the Mt. Gox incident back in 2014.