Cryptohack Roundup: Samourai Mixer Takedown

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, Samourai Wallet co-founder was arrested, a $45M hack hit Hedgey Finance, El Salvador wallet data leaked, another was charged in the OneCoin case, the SEC wants to fine Terraform Labs, prosecutors want a three-year prison term for CZ, and Thailand cracked down on unauthorized operators.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

U.S. and Portuguese authorities arrested the co-founders of cryptomixing service Samourai Wallet for allegedly executing more than $2 billion in unlawful transactions, including more than $100 million in money laundering transactions originating from dark markets. Federal authorities arrested CEO Keonne Rodriguez, 35, in Pennsylvania and will seek the extradition of CTO William Lonergan Hill, 65, from Portugal.

U.S. authorities worked with Icelandic law enforcement to seize the Samourai web domain and its servers. The operation also served a warrant to Google, blocking the cryptomixer’s app from the Google Play Store.

The Department of Justice alleges that Rodriguez and Hill designed Samourai Wallet to offer features such as a cryptomixing service called Whirlpool to facilitate criminal conduct and encouraged users to launder criminal proceeds through the mixer on social media platforms. Hill allegedly discussed Samourai’s use by criminals operating in online black markets in private messages.

Rodriguez and Hill each face charges of conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison, and one count of conspiracy to operate an unlicensed money transmitting business, which could result in a maximum five-year sentence.

Token infrastructure platform Hedgey Finance underwent two simultaneous exploits that resulted in a combined loss of $44.7 million. One exploit caused a loss of over $42.8 million on the Arbitrum network, on-chain security firm Cyvers said, adding that the attacker has already transferred a portion of the stolen funds to the Bybit cryptocurrency exchange. Prior to this, hackers stole $1.9 million worth of cryptocurrency on the Ethereum network, Cyvers said. Hedgey confirmed the exploits and said it is investigating the vulnerability that led to these attacks.

Hacker group CiberInteligenciaSV released what it says is sensitive information linked to El Salvador’s state-operated bitcoin wallet Chivo, releasing source code on the criminal forum BreachForums. The development follows a string of Chivo-related security breaches, including the exposure of personal data of nearly the entire adult population of El Salvador.

El Salvador in 2021 became the first country to adopt bitcoin as legal tender, and Chivo was promoted as the official BTC wallet for citizens. The wallet has encountered numerous issues from the start, including user-reported bugs and technical glitches. Despite reports of a data breach concerning Chivo in April, the Salvadoran government has not issued any official response.

Law enforcement has reportedly charged William Morrow in the OneCoin case, alleging that he was complicit in concealing the source of funds related to the company by providing false information to banks. Morro allegedly facilitated the transfer of $35 million to a Hong Kong account and $6 million to a U.S. account in 2016. He faces charges of conspiracy to commit bank fraud.

OneCoin, founded in 2014 by Karl Sebastian Greenwood and Ruja Ignatova, employed a global multilevel marketing network to promote its cryptocurrency. Greenwood was arrested in 2018 and sentenced to 20 years in prison. Ignatova, the alleged mastermind, remains at large since 2017 and is on the FBI’s Ten Most Wanted Fugitives list. Recently, Irina Dilkinska received a four-year prison sentence for her involvement in the project.

Federal regulators want a federal judge to fine Terraform Labs and its co-founder Do Kwon a total of $5.3 billion for defrauding investors after a jury found them liable for civil fraud (see: Cryptohack Roundup: Terraform Labs and Do Kwon). The U.S. Securities and Exchange Commission filed a motion Friday requesting $4.7 billion in disgorgement and prejudgment interest from Kwon and Terraform for their involvement in the 2022 Terra-Luna collapse. The agency also sought civil penalties of $420 million for Terraform and $100 million for Kwon.

A Manhattan federal jury found Kwon and Terraform liable for misleading customers about the safety of investing in Terra USD, an algorithmic stablecoin, and its underlying blockchain’s utility. Investors purchased over $2 billion worth of UST from various trading venues. The SEC called its proposed fines “conservative” and “reasonable,” considering Kwon’s substantial gains from Terraform’s stablecoin. Terraform Labs in a Friday memorandum suggests a maximum fine of $3.5 million. Kwon proposed he pay $800,000 in civil penalties and no disgorgement.

U.S. prosecutors are seeking a 36-month prison term for Binance founder Changpeng Zhao, alleging that the former crypto exchange’s CEO deliberately violated the country’s laws to bolster his company’s growth and personal wealth. Zhao’s defense team responded by filing a memo advocating for probation, highlighting his cooperation and the significant fines he and Binance have paid so far.

Zhao pleaded guilty to anti-money laundering and sanctions violations in November and agreed to pay a $50 million fine and resign from his CEO position. Binance settled for $4.3 billion, one of the largest corporate settlements ever made. With his impending sentencing on Tuesday, Zhao is currently out on bail on a $175 million bond (see: Binance Chief Resigns in Money Laundering Plea Deal).

Thailand’s Securities and Exchange Commission intends to restrict local access to unauthorized cryptocurrency platforms and has asked investors to withdraw their funds from such platforms. A government committee on preventing technology-related crimes directed the agency to furnish information on unauthorized digital asset service providers to the Ministry of Digital Economy and Society.

On court approval, the ministry will likely block access to these platforms. Although the SEC didn’t specify the criteria for legitimacy, it provided a website for investors to verify business operators. Blocking access aims to curb criminal activities such as money laundering. The Thai SEC has previously taken legal action against crypto exchanges Binance and Bybit for unauthorized operations in Thailand.