Thieves Steal $45M; Hacker Returns $71M

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, $25M in ethereum was stolen, Sonne Finance was hacked, a thief returned stolen crypto, Canada indicted its crypto king, the U.S. blocked a purchase by a Chinese crypto mining firm, Canada took regulatory action against Binance, and two senators were concerned about cryptomixer policy.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

The U.S. Department of Justice has indicted siblings Anton and James Peraire-Bueno for allegedly manipulating the ethereum blockchain to steal $25 million worth of cryptocurrency in just 12 seconds. Arrested in Boston and New York, the two face charges of wire fraud, conspiracy to commit wire fraud and money laundering, each carrying a potential 20-year prison sentence.

The brothers exploited their skills in computer science and math to tamper with ethereum’s protocols, affecting millions of users worldwide, the indictment says. They allegedly manipulated transaction validation processes to access and alter pending transactions. The brothers are accused of concealing their identities and using multiple cryptocurrency addresses, foreign exchanges and shell companies to hide their actions.

Decentralized lending protocol Sonne Finance suffered an exploit that resulted in the loss of about $20 million worth of cryptocurrency. The project identified a vulnerability in Sonne’s Compound v2 forks, which the hacker exploited via a donation attack. Sonne Finance has paused all markets on the Optimism network, though markets on Base remain operational. Although Sonne Finance cannot recover the stolen funds, it continues to investigate the exploiter’s identity. The project said it would offer an undisclosed amount as a bounty to the hacker in exchange for the return of the funds.

A thief returned $71 million worth of stolen cryptocurrencies after the wallet-poisoning scam drew multiple blockchain investigation firms to the investigation. On-chain security firm Lookonchain detailed the attack in a social media post, saying that the scam occurred when an investor accidentally transferred 97% of their holdings worth $71 million in wrapped bitcoin to a bait wallet address that mimicked the victim’s own wallet. After initially converting the stolen wBTC to ETH, the attacker spread the funds across over 400 crypto wallets, eventually dispersing them into over 150 wallets. The attacker returned the funds later though, after security firm SlowMist published an analysis suggesting the attacker’s potential Hong Kong-based IPs.

Self-proclaimed Canadian “crypto king” Aiden Pleterski and his associate Colin Murphy are reportedly facing fraud charges after receiving over C$40 million from investors. Twenty five-year-old Pleterski faces charges of fraud and laundering the stolen funds, while 27-year-old Murphy is facing fraud charges and was released on an undertaking, according to the Ontario Securities Commission and the Durham police.

The charges come after a 16-month investigation by Durham Regional Police, which began after customers complained of investment fraud in July 2022. The investigation found that Pleterski and Murphy falsely claimed to generate large weekly profits through fake investments. In August 2022, Ontario’s Superior Court declared Pleterski and his company AP Private Equity Ltd. bankrupt and said Grant Thornton was appointed as trustee. Court records indicate that Pleterski received C$41.5 million in investment funds but invested only 1.6% of it. Pleterski was released on a C$100,000 bail, with his parents acting as sureties, and is required to surrender his passport to the Durham police.

U.S. President Joe Biden cited national security in an order prohibiting Chinese-owned specialized cryptocurrency mining firm MineOne Cloud Computing Investment I L.P. from acquiring land near Francis E. Warren Air Force Base in Cheyenne, Wyoming. Biden’s decision follows findings that MineOne, a British Virgin Islands company owned by Chinese nationals, bought property close to the base in June 2022.

The U.S. order mandates MineOne to divest ownership within 120 days and remove all equipment within 90 days, with the Committee on Foreign Investment in the United States verifying compliance. MineOne and affiliates must cease any access to the property and cooperate fully with CFIUS or face penalties for noncompliance.

The Financial Transactions and Reports Analysis Center of Canada took regulatory action against the crypto exchange giant Binance for allegedly violating money laundering regulations. FINTRAC said Binance failed to register as a foreign money services business and did not report virtual currency transactions exceeding $10,000. FINTRAC has imposed a C$6,002,000 administrative monetary penalty. The infractions included 5,902 instances between June 1, 2021, and July 19, 2023, where Binance did not report large transactions as mandated. FINTRAC is part of Canada’s financial intelligence unit. It aims to detect and prevent money laundering, terrorism financing and other illicit activities in Canada’s financial system.

Sens. Cynthia Lummis and Ron Wyden have criticized the U.S. Justice Department’s recent enforcement actions against cryptomixers. In a letter to U.S. Attorney General Merrick Garland, the bipartisan lawmakers expressed “grave concerns” about the DOJ expanding the definition of money transmission. Wyden stated that the DOJ’s interpretation could criminalize software developers for writing and publishing code used by others, a precedent that he believes contradicts established law and raises First Amendment issues.

This criticism follows the DOJ’s actions against Samourai Wallet and Tornado Cash, accusing them of operating unlicensed money-transmitting businesses.

Wyden and Lummis argued that the Bank Secrecy Act defines a money-transmitting service as one that involves the acceptance of currency, funds or value. They said that noncustodial crypto service providers do not “accept” crypto assets from users and thus should not be classified as money transmitters.