foreign
[Music]
my name is Heidi I'm a part of the
special investigations team at coinbase
and I am super excited and also very
honored to be able to present to you
guys at Devcon rug life using blockchain
analytics not only to detect illicit
activity but also to track stolen funds
and hopefully stay safe and I really
like the previous presentation actually
right before mine because it was all
about sort of detection right but this
is about once your funds kind of get
stolen what do you actually do
so quick tldr I know we all don't have
time to be sitting around a panel all
day so if you've got places to go tldr
is be paranoid be paranoid that is
literally the end of this presentation
the rest of this presentation is going
to be full-on paranoia mode you're going
to want to lock down everything throw
out your computer and just give up on
this but if you want to stick around for
the rest of it let's go for it so first
and foremost we need to find what
illicit actually is right there are a
lot of people who say oh scammers are
illicit dark markets are bad beths are
also Bad true Traders you know who do
Market manipulations they're also bad oh
fact entities more recently also bad
like we've got a whole like swath of
different Terrible Bad actors out there
but today we're only going to be
concentrating on one which is theft I
personally believe that thefts are like
the worst thing that can happen with
this ecosystem right first and foremost
you see millions and millions of dollars
like just last night we saw 100 million
dollars being drained out of mango
Finance right that's horrible for the
entire ecosystem doesn't matter what
chain it happened on right not only that
but it also drives more regulator
scrutiny do we really necessarily want
that we want to be able to develop right
we want to be able to build without
having to even consider things like that
so this is why we need to start thinking
about things like how do we prevent this
kind of stuff now
I don't want to spend that long on this
I think we need to talk about different
theft typologies out there now I largely
bucket into three different sort of
categories first and foremost you have
the dev team initiated thefts right AKA
we all know these rugs right what does a
rug actually look like first and
foremost you've got some token dumping
you've got unlimiting or even limiting
usually of functions as well as cashing
out of any and all proceeds possible now
sometimes with rugs what will also
happen is websites will 404 and
obviously social media accounts will go
totally dark now the biggest bucket
though are third-party thefts right and
those I actually put into two different
categories first and foremost you've got
hacks right third parties hack into
places all the time right for example
let's think of these different Sexes
that have been hacked in the past couple
of months right and also you've got
another thing called Market manipulation
as we all know like with mid what
happened with mango last night now what
exactly do we Define as a hack well a
hack is very similar actually to a rug
right the only different friends I would
say In This Very generalized sort of
rule of thumb is that with a hack you
usually don't have the website of the
team
the social I don't know it is not
working
um this video of the team also going
down
um so you don't have that actually
happen with a hack now
um but what you do see is obviously the
cashing out and of proceeds extremely
extremely rapidly and obviously The
Dumping of funds now in terms of Market
manipulation what usually happens there
is a is usually a flash loan will be
taken out nine times out of ten and what
will happen is there's a certain pool is
manipulated right where one token's
price is arbitrarily pushed up for
example what happened last night with
mango right price automatically gets
pushed up then suddenly a dumping of
that mango right and then in exchange
for tokens that you know actually have
value and finally there's another bucket
of thefts right and I'm not going to go
too much into these but these are sort
of more third-party service attacks so
think of for example when you you're in
a Discord right you're managing a
Discord you probably have a whole bunch
of different Discord Bots out there
right they're doing a whole bunch of
different things but sometimes those
Discord Bots get exploited meaning that
you know people who are investing in
your projects sometimes fall for those
exploit and then unfortunately you get
their funds siphoned off of them and
then they blame you which isn't really
fair but it definitely happens
now I actually want to go into detection
methods like how do we actually detect
this kind of stuff how do we find this
stuff right and so there are a lot of
ways to do detection Forda just did an
amazing presentation on how they go
about doing detection but for as a
protocol what you want to do is you want
to actually just set up alerting for
large flows of funds that's actually
something that the Florida does another
thing you can do as well is use various
different platforms that have listed on
here to actually start you know alerting
you for when sort of any sort of strange
activity happens
finally another thing you might consider
doing is following a whole bunch of
Auditors online because chances are on
Twitter the Auditors will alert you
probably before you know you know even
your most Avid Twitter followers alert
you of something strange happening now
unfortunately this is all fine and great
but once a transaction is broadcast to
the blockchain you're screwed right
you're done for so this is great we can
detect this all day every day but we
need to actually prevent this stuff
right and so what we need to actually do
is we need to start detecting this sort
of weird kind of activity before any
money starts to move right and so if
you're a Dev there are a couple things
you can do first off you want to
constantly audit right your debits and
credits and I know this sounds super
effing
oh I just got one out again um I know it
sounds super boring but for example
Nomad they would have been able to
detect some strange stuff happening
going all the way back to July and they
could have probably prevented what then
ended up happening at the beginning of
August now another thing you might want
to do too is Monitor who's transacting
with your contract what are they
actually doing with their funds right
and finally another thing too is you
want to be monitoring your site's back
end but also your site's front end for
example seller Bridge that's actually
how they were exploited more recently
right is their front end was attacked
now this is all great but if you're an
investor right this means nothing to you
like you're not going to be debiting and
crediting a particular like protocols
smart contracts that's not your job
right so what should you be doing well
one thing you can do is make sure you
know what contracts you're actually
interacting with right so when you're on
metamask and you are trying to do a
transaction before you click that button
make sure that the contract is indeed
the contract you want to be transacting
with finally
um or next rather revoke cash so for
example when you interact with a
contract right you before you interact
with that thing to send your tokens
anywhere you have to allow those tokens
to be moved right now when you allow
those tokens to be moved with that
contract you're granting that contract
license to move them you want to revoke
those every once in a while because
chances are those contracts you
interacted with back in 2021 or even
2020 they might not even exist anymore
right you don't want to have anything to
do with them right so revoke those I
would say just clean them out probably
every once a month or so probably and
last but certainly not least is you want
to monitor the social medias of your
projects right and as well as all of the
wallets that you hold I know this is
exhausting and annoying but it's also
one way to also stay a little bit more
safe
now I want to get to the most fun part
of this presentation which is actually
tracking the funds so let's say your
Project's wrecked right like suddenly
all the funds have been siphoned off or
let's say you're an investor and you
invest actually in a project and oh damn
their money is all gone what happens
like can I even do anything right so
I'm not going to be boring you guys with
many more bullet points on slides don't
worry this is the last one but um first
and foremost you want to learn how to
read etherscan right there's no point in
like pretending to track funds if you
can't re-eat their skin right and I know
etherscan is painful to read as
arvestgan is is snow Trace all the other
ones are but it's super super important
to learn how to read a block Explorer
another thing too is once you learn how
to read a block Explorer you're going to
be much more Savvy with blockchain
analytics tools like Dune and bloxy and
whatnot and they're going to be able to
help you track on those funds further
now there are a whole bunch of other
tools out there that I haven't listed on
this slide but yeah these at least at
the very least are free and open source
um now another thing you can also do as
well is leverage Twitter investigators
but I say that with a massive caveat so
there are a lot of really amazing
Twitter investigators out there right
and I think we probably all know their
names right but there are also some
overzealous researchers as well and I
saw this in fact actually last night
with a mango exploit there were several
people who called out several different
addresses but were indeed not related to
the mango Finance exploit um so yeah
it's kind of frustrating at times for
people like me when I'm going through
this and I get pings from all sorts of
people about things so yeah leverage
them but do it cautiously the biggest
point on here though that I want to make
is if you do have a project that gets
hacked right or if you're part of a
project that gets hacked what you want
to do is immediately reach out to law
enforcement so ic3 is with the FBI and
you can file a complaint with them
um and they're they're quite good at
tracking down funds
um this is regardless of whether or not
you're us-based because chances are you
probably have an investor somewhere in
there in your project who might be
us-based so I would go ahead and file it
with them as well as obviously whoever
your local law enforcement is now the
next biggest point on here is if you are
a Dev and your guys's project gets
hacked you want to communicate
communicate communicate because the
worst thing is you're silent right and
then all of your investors are sitting
there like what the hell is going on oh
my God oh my God oh my God and then
immediately the flood starts and
immediately people are like oh my God
the project got rugged and then all the
rumors the rumor mill begins right so
you want to communicate as much as
possible as much as you possibly can and
I know you're going to probably hire
lawyers and whatnot but try to
communicate as best you possibly can now
I want to get you guys prepared for uh
my favorite thing which is story time
because I want to actually give you guys
a good case study and unfortunately this
is not going to be a nice story time
this is going to be a nightmare story
time we're going to be talking about the
Ronin theft that happened earlier this
year I'm sure we all know about it but
about 600 million dollars was stolen
from the Ronin bridge and what
effectively happened was these guys
stole all this um eth um and as well as
usdc from the Ronin bridge I think it
was like 173 000 and they had all this
eth right what did they do with it first
and foremost what they did with it is
they started cashing it out at various
different Sexes now this was also around
the same day where the Ronin Bridge came
out and they finally announced that they
had been exploited and what do you think
the attackers did they had to
immediately stop because the Sexes then
caught on like oh dear God we're being
used to cash out of these terrible
proceeds we gotta stop this and of
course the attackers then also pause too
right and then two weeks later they
start mixing funds through tornado cash
right and all of this ethos flows
through tornado cash now one thing I
have to mention is this was a ton of eth
right I just mentioned it's 173 000 each
this is a ton of money I had never seen
this much money flow through tornado
cash so the sheer volume was already
unprecedented but the other thing that
was also crazy too was these guys were
rinsing and repeating the exact same
methodology over and over and over again
right so what they would do is they
would mix the money through tornado cash
and then they would they would then swap
it using the same decks over and over
again to Ren BTC which is a Bitcoin
proxy right and then after that what
they would do is they would burn that
brand BTC in exchange for Bitcoin and
this happened Time After Time After Time
day after day and I mean we're all human
right these attackers are human right
and so we like a good pattern and it's
one thing that you'll notice in this
presentation is that patterns get
repeated all the time and that's the
part of doing and analytics and tracing
funds right is you start to notice these
typologies over time now what happened
with this Bitcoin this Bitcoin was then
sent on to chipmixer and you guys might
know chipmixer chip mixer is a Bitcoin
mixing service now when I look at chip
mixer I think to myself oh my God that's
so 2019 no one uses chip mixer anymore
like there are so many better Services
out there right and of course again why
am I saying that so 2019 right well what
I'm essentially saying by that is
there's no liquidity in there right you
want a deep liquidity pool when you
actually care about privacy right
because you don't want to be found out
you don't want people like me to go
looking for you right and of course
these guys had a ton of money that was
flowing through chip mixer right so what
effectively happened was is
unfortunately we could trace through it
and a lot of it went to an APAC based
sex but not all of it so not all of the
funds actually were mixed this way this
was only their pattern in May and by the
way we're going to skip all of the
patterns that happened in June and July
and we're gonna go straight to the
pattern that started in late August and
is continuing to today so some of that
Bitcoin that they had what they started
actually doing in this is late August
beginning of September they started
splitting it out into these weird
increments of rounded five six seven and
eight BTC right they split out all these
funds what do they do with it send
directly to Ren mint some Ren VTC great
right this is a very very very easy
pattern to detect on chain right and
from there what they did was they used
the decks they swapped it into ustt and
then they got a little confused Midway
they wanted some eth go back into usdt
and they ended up cashing it out at
otc's in butcher Sexes and they continue
doing this pattern right through
September it was the I mean it was very
very obvious right even if you were to
just look at Ren BTC based mints you'd
be able to find this stuff
what they also did is they got lazy in
between and just cashed out directly
from tether now one thing that you'll
notice is that I have usdt and eth
written on here right and for those of
you that are Savvy you're like hey wait
a second Heidi what about gas fees did
you did you get anything out of gas fees
Yes the gas fees actually originated
from those Sexes right here right so
it's a very roundabout pattern that we
end up seeing so what also ended up
happening as well is they had this large
sum of Bitcoin and they got super super
lazy and they started just cashing it
out directly to Sexes and then they
decided to get unlazy because
unfortunately some people found them and
they decided to go back to the ren BTC
route and then do the same thing over
and over again right now what am I
trying to take away with this case study
that was a lot right this was
overwhelming now what I'm trying to help
you with this is blockchain analytics
ain't easy it's quite complicated and
trying to recoup stolen funds is no joke
right it's not only extremely costly
it's very very very time consuming right
I've been tracking these guys literally
or Yeah March right and not only that
but the amount of funds that you know
the whole like crypto Community has been
able to recoup has been so limited right
so you don't want this to happen now
luckily we do have the transparency of
the blockchain right now which allows us
obviously to trace funds right the fact
that it's permanent it's immutable right
and it's fully transparent awesome right
but it doesn't change the fact that
tracing this money is a lot more work
down the line than actually trying to
prevent the bad activity
now let's go into actually what we can
do about this right I hope I scared you
guys enough
um now we've got the crazy slide that I
actually want to take a pause on and I
want you guys to actually take a picture
of because I'm not going to be talking
about it because I want us to actually
talk through case study examples
so on this slide we've got lots of
different recommendations in terms of
General stuff blockchain stuff social
media email stuff and doing your basic
due diligence I.E d-y-o-r
cool we all got our photos awesome okay
worst case
um I can share the slides with you after
the fact now I want to share a couple
examples
um with you guys and I want to share an
example of being impulsive and not
checking the contracts that you're
interacting with before you interact
with them now back in April
um board API clubs Instagram was hacked
I'm sure you guys remember this right
their Instagram was hacked suddenly
there was like this announcement of like
oh we're giving away this land all you
have to do is if you hold an ape this
meant this Lan token and of course
people fell for this right they didn't
actually look at the correct that they
were interacted with and what happened
well sure enough you can imagine what
happened all of their most prized nfts
were ripped from them right and one
thing that was very noticeable when
looking at this initial contract is that
there was this set approval for all
function that kept on being called by
these addresses that had been fished
over and over and over again rapidly and
when you see this on chain run run from
that contract right because what that
effectively that contract products being
run by some sort of phishing a person
who's doing phishing now these nfts were
immediately sold for Ethan a whole bunch
of different marketplaces right and then
after that the eath was cashed out a
bunch of sexes immediately right really
good then also it was sent to the
Ukrainian Armed Forces that's
interesting maybe that tells us about
where the threat actor might be we'll
see in just a second and then we also
see that they're sending money to a
karting shop so they're clearly buying
fake IDs right probably using those fake
ID to sign up for those Sexes
interesting right now remember how I
talked about those gas fees those are
something you want to look at when
you're initially interacting with a
contract right so you can see where did
they initial get will you get their
funds from and if you take a look at
that East right the original like that
paid those topped up that address to
initially get those gas fees you'll
actually find that that address indeed
also did a whole bunch of different
fishing and made a ton of money right
great what else can we find out about
this address one thing that I found that
was really interesting with this
particular dress it also cashed out a
whole bunch of sexes as well
was that it also sent money to this very
interesting social nft marketing page
right so essentially what you could do
is you could pay this money to Market
your nft project on various different
social media websites interesting I
don't think that's Ukrainian right there
right and my perspective actually is is
these probably is guys probably actually
just donated to the UK in armed forces
in order to pay probably throw people
like me off of their tracks right and so
this is one very very easy way to do it
because as we all know that address for
the Ukrainian Armed Forces is tagged on
etherscan right so it's very very
obvious so this is an example of being
impulsive and this is what you don't
want to do so take those two minutes
literally two minutes right and look at
that address before you interact with it
right look at what those other addresses
that are sending funds are actually
doing right or they actually like are
they actually getting something for it
are they actually minting any land are
they getting nothing out of it right
now I also want to talk about an example
of social engineering this has nothing
to do with blockchain analytics yet but
it will right so here's a great example
from Poly play and they were amazingly
transparent about their exploit that
happened last year this is actually on
what from one of their tweets
um as you can see here uh the finance
team reached out to Poly play in order
to pretty much list their token right
and as you can see is this looks pretty
you know legit in terms of a you know
LinkedIn page he's got like 400 some odd
followers this seems like a pretty legit
email or whatever it is but there are a
couple funky things with it right first
off they're asking they're saying hey
you know please donate to the binance
charity Foundation that's a little weird
right like and they're asking donation
in Bitcoin too I don't know that's a
little sus right
um so it's one thing that you want to
kind of look at right when you're
looking at um people who reach out to
you is verify indeed their identities
right for example if you look up Teddy
Lynn right now on LinkedIn I'm sure this
isn't the only Teddy Lin of Finance
you're gonna find right and so it's one
thing that you're going to want to do
you're going to want to verify with
these teams before you know you start
interacting with them right because the
worst thing is is you get down the line
they send you over documents to agree to
you download that document and that
document includes a whole bunch of
malicious code and your whole project
gets screwed over right and what's
interesting about this particular social
engineering incident is that Poly play
ended up getting hacked right because of
all of this and what happened well if
you looked on chain you'll actually find
that the Poly play hack is related to
the bzx hack that happened back in
November and also a link to the
mgnr.iohack as well and if you look
backs up what you'll end up finding is
all of them fell for very similar social
engineering tactics so this is a common
one used by many nation states actually
one in particular and you guys can guess
who that might be
now
one thing we talked about before is
what's the difference between a hack and
a rug right but I actually want to about
what is the difference between an actual
Dev team cash out and a rug because a
lot of times Dev teams I mean a lot of
times Dev teams need to cash out of
their funds right they make money they
need to be able to move their money
around and do things that maybe not not
isn't crypto right how do they actually
do that and I want to give you guys an
example of how legit team looks like
when they're Cashing Out versus an
illegit team because I think the the
comparison is quite Stark so in this
example what we have here is we have 10
ktf which is a very large nft project
they get proceeds right from their nft
sales and you can see that on chain and
all of those are then sent to the 10K TF
deployer address that deployer address
then sends on to their gnosis multisig
fine that seems fair right another thing
that we also see too is renga deployer
they also send funds onto our gnosis
multisig so if you weren't following
projects which I wasn't
I had no idea these projects were
intertwined actually until I was looking
at their gnosis multi-sig and actually
found oh wow they're clearly a part of
the same ecosystem right and if you take
a look at their gnosis multisig and by
the way this is a great practice right
you want to see a project using a
multi-zig and keeping their funds locked
up there they sometimes will actually
Cash Out directly to FTX right but they
do this over time right their website is
still active their social media is still
active these guys are still clearly
involved with the community right so
nothing weird is going on here this is
the kind of activity you want to be
seeing when you're analyzing on chain
seeing where devs are cashing out at now
what do you not want to see this is
exactly what you don't want to see so
I'm sure you guys heard about the squid
Game Rug pull last year but essentially
the squid team token launched right on
the BSC Network and um what effectively
happened was you couldn't trade this
squid token so you could only trade it
uh you could only buy it with BNB
because it was on the pan it was on
pancake swap but you couldn't sell it so
effectively what happened was the price
was driven up to like twenty five
hundred dollars right and suddenly one
day the website 404s all social medias
are gone all social medias are deleted
right and suddenly then the squid token
is swapped for B and B and fully dumped
right suddenly the squid token now is
valueless now one thing the devs did
right here though is they decided to
unlimit that contract so this suddenly
you could actually sell your squid but
of course it was worthless so who cared
at that point in time right and so
anyways you had this B and B right these
guys then decided to rapidly send that
BNB through tornado right and again this
was a very high volume going through
tornado at that point in time so it was
kind of traceable now there's one thing
to note about privacy protocols privacy
Protocols are incredibly important I'm
not trying to be a proponent here in
this presentation to say oh you know we
can demix everything you know or
whatever but what I am trying to say
about privacy Protocols are that
unfortunately illicit actors while they
do use them it is quite easily traceable
to see where they're moving funds to
because usually they move a ton of money
at once and why do they do that because
they're paranoid they don't trust anyone
with that money but themselves so the
sooner they can get that money out the
better right privacy Protocols are
incredibly important and I think we're
going to still continue seeing in the
them in the space in fact I've been
super excited to see all the ZK Stark
discussion here right
um but effectively all these funds then
went through tornado cash and again
these guys rinsed and repeated the exact
same transaction patterns because once
they got that B and B out what they
immediately did and this is all in one
single transaction every single time was
they would swap that B and B uh for die
right and this is still on BSC and they
would bridge that die through any swap
then into each base die or on other
stable coins right and this was a very
very very particular pattern so it was
super super obvious now once they had
this die in this eath-based die what
they end up doing with it well this each
base die they ended up swapping for ease
and then they sent it through tornado
one more time on ethereum right and they
could not be more paranoid right but of
course they're moving this money through
super super fast again super obvious now
one thing I've noticed actually about uh
these attackers more recently is and
especially in the squid game situation
right as you guys remember this
particular rub was super super known
right this was all over mainstream media
right so this guy was Super Hyper
paranoid right so what he decided was
this oh I'm just gonna sit on this
money for a while but he just didn't
want to sit on that eat no no no no he
wanted to earn some yield so he decided
to swap that money in a usdt and lend it
to the usdte's pool and then he also
lented out the compound and from there
he sat pretty for a while and then
slowly started cashing out to uh two
different APAC based Sexes right and
this is actually a pattern of activity
that I've continued seeing quite often
unfortunately now what it's an
unfortunate but also fortunate right
because once they're sitting in these
pools we can still see that that's the
beauty of the blockchain right and so
because of that is once they exit out
right it's kind of great because we can
also potentially recoup all the
interests that they've earned so it's
one thing to also think about now I want
to leave you guys with a couple
predictions because I only have a couple
minutes left is and by the way I wrote
this slide deck a week ago this was
before the BNB Bridge attack this was
also before mango Finance but
unfortunately this is now reality we
expect we see hacks and scams continue
even in the bear market right D5
protocols particularly those with high
tvl right will continue to be perceived
unfortunately as honey pots right and
threat actors as I was talking about
before they're mainly going to continue
sitting on funds right that's actually
what we're seeing with the BNB Bridge
attacker right now he's just sitting on
the funds we see that actually with
quite a few different attackers at the
moment right and to possibly earn yield
right for example if you take a look at
mango Finance guy what do you think he's
investing in right now I'm not going to
say you guys look it up
anyways some quick break predictions
right first and foremost be paranoid
right hopefully this has been a lesson
in paranoia here and you want to protect
yourself before something happens right
you don't want stuff to be broadcast to
the chain right that is the like that is
the ultimate like thing that you do not
want to have happen because once it's
broadcast to chain it's done right money
is gone right and of course you want to
do your own research that should be
obvious right do not rely on other
randos to do research for you and just
believe them because they're anons on
Twitter uh that you know what they're
saying is correct you want to verify and
last but certainly not least definitely
learn how to read a block Explorer block
explorers are extremely powerful and all
of this research I actually mostly did
using Dune analytics and just etherscan
as well as be a c scan a couple others
and don't forget to set up monitoring
and uh that's all thanks guys
[Applause]
[Music]