White Hats Hack Ronin Bridge

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, a $12M white hat hack on Ronin Bridge, Cryptonator indictment, potential prison sentence in Crypto.com case, a $212K Convergence hack, Do Kwon’s extradition, and the FBI published a scam warning.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

White hat hackers withdrew $12 million from the Ronin Network by exploiting an undocumented vulnerability – the largest amount that can be withdrawn in a single transaction. Ronin paused transactions and said it is addressing the issue. The hackers returned the stolen funds and will get a $500,000 bounty for their “forced audit.”

Ronin had originally said that customer funds would be refunded regardless of hackers’ actions. The incident comes two years after North Korea’s Lazarus Group stole $625 million from the Ronin Network bridge. Law enforcement has so far retreived about $36 million of the stolen funds.

The U.S. Department of Justice indicted Russian national Roman Pikulev for founding and operating Cryptonator, an unlicensed cryptocurrency exchange that allegedly processed over $235 million in illicit funds. Pikulev and his associates are accused of running Cryptonator from 2014 to March 2023, facilitating an international money laundering scheme that supported computer intrusions, ransomware scams, fraud markets and identity theft.

Cryptonator was not registered with the U.S. Financial Crimes Enforcement Network and lacked anti-money laundering processes. Prosecutors said the platform’s business model catered to criminals, enabling them to exchange cryptocurrencies and cash out coins into fiat currency, while anonymizing the sources of the funds. Pikulev, also known as “Boss,” used U.S. technology providers and advertised on social media to promote the scheme.

Investigators said that Cryptonator facilitated over 4 million transactions totaling $1.4 billion, with Pikulev taking a small cut from each deal. The platform also transacted in millions with darknet marketplaces, scam addresses, high-risk exchanges and sanctioned entities.

Australian prosecutors are seeking a prison sentence for a Crypto.com user, Jatinder Singh, who accidentally received nearly $7 million and spent most of it before the exchange discovered the error three years ago. Crypto.com in May 2021 mistakenly transferred 10.47 million Australian dollars to Singh and his partner, Thevamanogari Manivel, instead of issuing a $100 refund due to an employee’s error. By December 2021, Singh had bought multiple homes and gifted a friend 1 million AU$, claiming he believed he had won an online raffle.

In an Aug. 2 court hearing, prosecutor Campbell Thomson reportedly argued that the amount involved made it more than a crime of opportunity, seeking jail time for Singh. Singh’s lawyer Martin Kozlowski contended that Singh did not fully understand the situation, adding that the funds came from a multinational company that only discovered the loss during an audit months later.

Prosecutors reportedly argued in March 2023 that Singh might flee the country, with only $4.9 million recovered and some funds sent abroad. Singh’s sentencing is scheduled for September.

Manivel received a seven-month prison sentence that she has already served and an 18-month community corrections order in September after pleading guilty to recklessly handling the proceeds of crime.

Decentralized finance protocol Convergence suffered a smart contract exploit that allowed a hacker to mint and sell $210,000 worth of native tokens and steal $2,000 in unclaimed staking rewards, said “Wireshark,” the protocol’s pseudonymous founder. The vulnerability was due to a recent change in the smart contract code that removed a crucial line after four audits, aimed at gas optimization. This error allowed the hacker to exploit the contract. Convergence told users that their funds were safe, but recommended withdrawing assets from the platform. The protocol’s total value locked fell from $5.79 million to $3.69 million after the attack.

An appeals court in Montenegro has denied a U.S. request to extradite former Terraform Labs CEO Do Kwon, ruling that he will instead go to South Korea. This decision upholds a High Court of Podgorica’s late June ruling. Kwon and his legal team have been involved in a prolonged legal battle over his extradition, with Kwon reportedly preferring to be extradited to his home country of South Korea. In South Korea, financial criminals typically face a maximum sentence of 30 to 40 years, whereas the U.S. can impose consecutive sentences for each crime.

Kwon was arrested in Montenegro in March last year for attempting to board a flight to Dubai using a counterfeit passport and false Costa Rican travel documents. The U.S. Securities and Exchange Commission sued Terraform Labs and Kwon in February 2023 in connection with the collapse of the algorithmic stablecoin Terra, which caused $40 billion in losses. Terraform Labs and Kwon reached a $4.47 billion settlement in May with the SEC, which includes $3.58 billion in disgorgement and $420 million in civil penalties. The settlement also bars Kwon from serving as an officer or director of any public company.

The FBI published a warning about scammers posing as employees of cryptocurrency exchanges to steal user funds. Scammers contact potential victims through calls or messages, claiming there are issues with the user’s account or that it is being compromised. They attempt to obtain access codes, direct users to click on malicious links, or request identification information, which allows them to access and steal digital assets.