Blog

In the past, hackers looking to “monetize” their hacking efforts used one of these cybercrime strategies:

• Hack into computers to steal credit card data and purchase things

• Hack into applications to modify code and fraudulently order things

Today’s hackers are more intelligent, more ambitious and more malicious, so they do much more than simply break into systems for short-term gain. Instead, they gain access to enterprise network files and data, exploit employees through social engineering and scams, steal identities, and carry out cyber-extortion schemes. They also deploy ransomware to lock corporate systems and data and then demand hefty ransoms from their victims. Digital currencies help enable many such cybercrimes, especially ransomware attacks.

Here’s how.

What is a Digital Currency?

A digital currency is a form of money that’s only available in non-physical form. Like standard fiat currencies, they can be used to purchase goods and services. Such transactions are usually carried out on devices like laptops or smartphones with an “electronic wallet.”

Digital currencies are a superset of “cryptocurrencies.” Cryptocurrencies like Bitcoin, Ethereum, Dogecoin, etc., are decentralized, independent, portable and divisible – qualities that are helping to democratize finance and improve financial inclusivity.

Cryptocurrencies rely on cryptography to secure and verify transactions, manage the creation of new units, and prevent counterfeiting—all well and good.

The not-so-good: cryptocurrencies also create a veil of anonymity that creates many problems, particularly concerning cybercrime.

Anonymity and Cryptocurrencies

Since its inception, privacy and anonymity have been the critical driving principles of the cryptocurrency movement. For example, Bitcoin – the world’s most valuable cryptocurrency – consists of multiple components, such as addresses, private and public keys, and transactions that are all read in text strings. These strings don’t directly link to anyone’s personal identity, ensuring a fair amount of anonymity and privacy in financial transactions.

Over the past decade, other fully anonymous cryptocurrencies have also started to emerge. Unfortunately, these developments are likely to lead to a surge in cybercrimes.

Anonymity, Cryptocurrencies and Cybercrime

Since cryptocurrencies are decentralized, i.e. not regulated by a government authority like the Bank of Canada, crypto transactions are not closely monitored. As a result, these alternative currencies create multiple opportunities for cybercrime.

Hackers can break into cryptocurrency exchanges and trading platforms to carry out anonymous transactions or steal funds. Criminal organizations also use cryptocurrencies to launder money. In 2018, criminals in Europe laundered dirty money worth about $5.5 billion through cryptocurrencies. Crypto transactions do not require real names, so criminals remain unidentified as they use crypto to steal money or perpetrate other crimes. They can also move these ill-gotten gains across borders since they’re unlikely to be monitored by international anti-crime agencies. Cybercriminals also leverage this anonymity to exploit peer-to-peer/sharing economy platforms and profit from fake transactions. 

Cryptocurrencies (especially Bitcoin) are also fueling the rise of ransomware attacks. In 2021, several such attacks crippled multiple organizations in the U.S., UK, Australia, and elsewhere. Often, the attackers demanded ransom payments in cryptocurrencies. Many affected organizations did pay these ransoms to recover access to their locked systems and data. The most recent example is Colonial Pipeline, an American oil pipeline operator that paid hackers nearly $5 million in ransom – in difficult-to-trace Bitcoins. 

Criminals demand ransom in cryptocurrencies, knowing that they’re unlikely ever to be traced – much less caught. With their victim thousands of miles away, hackers can be anonymous in cyberspace during the attack and remain anonymous as they collect their ransoms.

Other cybercrimes that can be anonymously perpetrated (or concluded) using cryptocurrencies include:

• Crypto-jacking: Criminals secretly use a user’s browser to fraudulently mine new cryptocurrency units

• Compromised registration forms: Steal users’ information from trading platforms and sell it on the Dark Web for profit.

• Malware attacks: Malware steals crypto-mining resources from mining machines or cryptocurrencies from online wallets

Crypto phishing attacks are also becoming increasingly common. Criminals send sophisticated emails to victims to redirect them to a fake version of a real cryptocurrency site. They then steal their credentials and, eventually, their funds. In July 2020, Twitter was the target of such an attack, with hackers gaining access to 130+ accounts (including Elon Musk and Bill Gates) and using them to promote a Bitcoin giveaway scam.

The increasingly egregious role of cryptocurrencies in cybercrime has prompted several official authorities to call for global crypto regulation and restrict their use.

Conclusion

The best way for organizations to protect themselves from crypto-powered cybercrime is to implement robust and up-to-date crypto cybersecurity controls. Since such crimes are on the rise, the onus is on organizations to err on the side of caution. For assistance with strengthening your cybersecurity ecosystem, particularly from crypto-related risks, reach out to Packetlabs.