North Korean hackers stole a record $1.7B of crypto last year

That's the primary way hacks are conducted by most hackers. Hackers are primarily social engineers, not technical. Technical hackers are extremely rare regardless of nationality.

I'm just a 'regular security guy' but in that link you posted they detail that after the initial phishing compromise "The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes." They don't detail the bugs that got them access to the nodes but this didn't give them control of the network so "the attacker found a backdoor through our gas-free RPC node, which they abused to get the signature for the Axie DAO validator. ...Sky Mavis requested help from the Axie DAO to distribute free transactions ... Axie DAO allowlisted Sky Mavis to sign various transactions on its behalf. This was discontinued in December 2021, but the allowlist access was not revoked."

Sounds like a pretty classic hack to me. They got into the network, got access to some important servers (how? they should be totally segregated from the corporate network). Then found a depreciated endpoint that allowed them blindly sign transactions. This is bread and butter for any pentesting work, makes me wonder if any of these web3 orgs are hiring security firms to test their systems and not just smart-contracts.

Their keys their coins.

I'm almost convinced that this is how they recruit those mule burners, since signing up for employment requires a lot of personal information that can be leveraged into opening bank accounts or other financial vehicles in that person's name.

Because we don’t, and there is considerable friction required to have financial privacy, most people don’t bother unless they really need it or are unusually privacy conscious. Really needing it may often mean they are doing something nefarious.

That doesn’t mean the technology to enable privacy is “bad”, it means it’s too hard to use and that as a society we have done poorly at guaranteeing people’s right to privacy.

Not so long ago you might have ben able to say the same thing about people communicating with end-to-end encryption, but thanks to a concerted effort to improve the UX of this tech. and it’s adoption by some very widely used services, it’s now commonplace. End to end encryption could no longer be argued to be mostly used by criminals.

Hopefully we will get there with financial privacy too.

NB: in neither case am I suggesting that the government should be unable to require you to provide information in some situations (or face the consequences of withholding it against, say, a court order), only that dragnet surveillance of everyone by default is never acceptable.

This left only the bravest parties, and criminals to use it, leading to a high proportion of users being criminals.

If it weren't for that uncertainty about the legal treatment TC would receive from government (say if Congress passed legislation explicitly providing a right to use financial privacy technology), a huge proportion of the whole crypto economy would have been using Tornado Cash, as they should be, because privacy is an absolute bare minimum for a functioning financial system.

The conceptual treatment you're giving transaction encryption is to treat privacy as criminal. This is an ideological outlook that promotes putting total trust and faith in a small elite in government and finance to engage in warrantless dragnet surveillance of every one's financial transactions.

One of the more recent difficulties with a lot of privacy technology is that the main user might not be the abused and those wanting to avoid being abused, but instead... really awful criminals.

And with anything cryptocurrency or blockchain in the last decade, it's not only the users who are criminals, but much of the technology itself is built by scamming atop scamming.

I'd quibble with any article today that mentions cryptocurrency/blockchain at all without acknowledging how sketchy the entire space is.

Pre-Web cynical cyberpunk writers were better at predicting much of the modern world, than were the optimistic techies who mostly saw tremendous opportunity for goodness.

In this case: https://archive.ph/SUYp1

Each APT usually utilises a specific set of techniques to commit these heists: https://attack.mitre.org/groups/

Obviously perfect correlation is not possible but set of utilised techniques are usually enough to pinpoint the specific APT.

Seems like most of this theft is happening when people port currency between exchanges and the bridge is vulnerable.

Take the US Trident 2 [1]. Wikipedia lists a cost of $31 MM, in 2019 dollars, which would be about $37 MM today. With $1.3 BN you could buy 35 of those.

But the North Koreans are not buying their missiles from Lokheed-Martin. They are building them in house, so you'd expect them to pay much less for labor and materials.

[1] https://en.wikipedia.org/wiki/UGM-133_Trident_II

It's actually the third real world use case, behind getting better drugs than from your local dealer and the entirety of the ransomware industry.

What do you mean by supposedly?

> It also exposes a wider problem the crypto community are not addressing.

What wider problem? That money (in any form) can be stolen by a malevolent state?

I would say, conservatively, the traditional banking and real estate markets are 10,000x worse than crypto markets, but are un-policed because it's hidden, unlike the public blockchain networks. The few scams that are exposed, like the HSBC money laundering scandal, dwarf all of the crime every committed via crypto. But we didn't even put HSBC out of business or put a single employee in jail!

Here is the Danish money laundering fraud that just concluded with $2 billion in fines on $160 billion in laundered money https://www.justice.gov/opa/pr/danske-bank-pleads-guilty-fra...