DEX hacking prosecution, first in the US
The U.S. Department of Justice announced Wednesday that it has charged Shekib Ahmed with a hacking attack on a decentralized exchange (DEX).
This is the first criminal case regarding an attack on a smart contract operated by a decentralized exchange.
The U.S. Department of Justice has charged Ahmed with wire fraud and money laundering. The suspect was arrested in New York State.
According to the indictment, Ahmed, a former senior security engineer at an international technology company, used his expertise to defraud exchanges and their users, extorting about ¥1.3 billion (about $9 million) in crypto assets. stole the
They then allegedly laundered the stolen funds by exchanging cryptocurrencies and making a complex series of transfers on the blockchain using foreign exchanges.
Ahmed has skills in smart contracts and blockchain audits, which he abused.
Tyler Hatcher, a special agent with the Internal Revenue Service’s Criminal Investigative Service (IRS-CI), commented:
The suspect’s skills fell short of the IRS’s Criminal Investigative Division’s Cybercrime Division. Together with the Homeland Security Investigation Service and the Department of Justice, we will continue to be at the forefront of cyber investigations to track down and hold accountable these scammers.
What is DEX (Distributed Exchange)?
A decentralized exchange built on blockchain. It is also called “DEX” from “Decentralized EXchange”, which is an English translation of “decentralized exchange”. Since transactions are conducted directly between parties without going through a central administrator, there is no need to pay a fee to the administrator, and other features include low liquidity and the user managing the private key.
Specifically, in July 2022, Ahmed exploited a vulnerability in the smart contract of a decentralized exchange to insert fake price data and inflate the data by approximately 1.3 billion yen (approximately $9 million). Illegally charged a fee. The fee is withdrawn from the exchange in the form of virtual currency.
In addition, we will contact and negotiate with this exchange, and if the exchange does not report the attack to law enforcement, we will keep about 210 million yen ($ 1.5 million) and return the rest of the funds. was winning.
In laundering illicit earnings, they transferred funds from the Solana (SOL) blockchain to the Ethereum (ETH) blockchain to hide the origin and used the cryptocurrency Monero (XMR).
Although the name of the decentralized exchange was not disclosed in the indictment, considering the modus operandi and timing, it is possible that the attack was related to the July 2010 hacking of the Solana network exchange Crema Finance. is pointed out.
connection: DeFi protocol “Crema Finance” on Solana, recovered stolen virtual currency equivalent to 1.2 billion yen
Increasing number of hacks to blockchain
According to a report released by bug bounty platform Immunefi, the number of hacks across blockchains increased by 63% year-on-year in the second quarter (April-June) of 2023.
Total losses decreased by 60% from last year, but the total number of hacks increased by 65%. In particular, the majority of attacks targeted DeFi (decentralized finance) platforms, with 79 incidents reportedly resulting in a total of approximately ¥31.9 billion ($228 million) worth of damage in the second quarter. rice field.