Lurking in the shadiest corners of the dark web is a \u201cwell-established\u201d ecosystem of hackers that target cryptocurrency users with poor \u201csecurity hygiene,\u201d according to Binance\u2019s chief security officer.<\/p>\n
Speaking to Cointelegraph, Binance CSO Jimmy Su said in recent years, hackers have shifted their gaze toward crypto end-users. <\/p>\n
Su noted when Binance first opened in July 2017, the team saw plenty of hacking attempts on its internal network. However, as crypto exchanges continued to beef up their security, the focus has shifted. <\/p>\n
\nPhishing scams are particularly prevalent in emails.<\/p>\n
They are used as a way to collect your sensitive information by impersonating someone you trust.<\/p>\n
Use the blog below to learn how to stay safe from them. https:\/\/t.co\/UtKBvR52lX<\/a><\/p>\n
\u2014 Binance (@binance) July 4, 2023<\/a><\/p><\/blockquote>\n
\u201cHackers always choose the lowest bar to achieve their goals, because for them it\u2019s a business as well. The hacker community is a well-established ecosystem.\u201d<\/p>\n
According to Su, this ecosystem comprises four distinct layers \u2014 intelligence gatherers, data refiners, hackers and money launderers. <\/p>\n
Data gatherers<\/h3>\n
The most upstream layer is what Su described as \u201cthreat intelligence.\u201d Here, bad actors collect and collate ill-gotten intel about crypto users, creating entire spreadsheets filled with details about different users. <\/p>\n
This could include crypto websites a user frequents, what emails they use, their name, and whether they\u2019re on Telegram or social media.<\/p>\n
\u201cThere is a market for this on the dark web where this information is sold […] that describes the user,\u201d explained Su in a May interview.<\/p>\n
Su noted this information is usually gathered in bulk, such as previous customer information leaks<\/a> or hacks targeting other vendors or platforms. <\/p>\n
\nAn employee of our email vendor, https:\/\/t.co\/6vM4WAcJal<\/a>, misused their employee access to download & share email addresses with an unauthorized external party. <\/p>\n
Email addresses provided to OpenSea by users or newsletter subscribers were impacted.https:\/\/t.co\/Osb6qqkqZZ<\/a><\/p>\n
\u2014 OpenSea (@opensea) June 30, 2022<\/a><\/p><\/blockquote>\n
In April, a research paper by Privacy Affairs revealed cybercriminals have been selling hacked crypto accounts for as little as $30 a pop<\/a>. Forged documentation, often used by hackers to open accounts on crypto trading sites can also be bought on the dark web.<\/p>\n
Data refiners<\/h3>\n
According to Su, the data gathered is then sold downstream to another group \u2014 usually made up of data engineers that specialize in refining data.<\/p>\n
\u201cFor example, there was a data set last year for Twitter users. […] Based on the information there, they can further refine it to see based on the tweets to see which ones are actually crypto-related.\u201d<\/p>\n
These data engineers will then use \u201cscripts and bots\u201d to figure out which exchanges the crypto enthusiast may be registered with.<\/p>\n
They do this by attempting to create an account with the user\u2019s email address. If they get an error that says the address is already in use, then they\u2019ll know if they use the exchange \u2014 this could be valuable information that could be used by more targeted scams, said Su. <\/p>\n
Hackers and phishers<\/h3>\n
The third layer is usually what creates headlines. Phishing scammers or hackers will take the previously refined data to create \u201ctargeted\u201d phishing attacks. <\/p>\n
\u201cBecause now they know \u2018Tommy\u2019 is a user of exchange \u2018X,\u2019 they can just send an SMS saying, \u2018Hey Tommy, we detected someone withdrew $5,000 from your account, please click this link and reach customer service if it wasn\u2019t you.\u2019\u201d<\/p>\n
In March, hardware wallet provider Trezor warned its users about a phishing attack designed to steal investors\u2019 money<\/a> by making them enter the wallet\u2019s recovery phrase on a fake Trezor website.<\/p>\n
The phishing campaign involved attackers posing as Trezor and contacting victims via phone calls, texts, or emails claiming that there has been a security breach or suspicious activity on their Trezor account.<\/p>\n
A screenshot from a phishing domain copying Trezor\u2019s website. Source: Bleeping Computer<\/figcaption><\/figure>\n Getting away with it<\/h3>\n
Once the funds are stolen, the final step is getting away with the heist. Su explained this could involve leaving the funds dormant for years and then moving them to a crypto mixer such as Tornado Cash.<\/p>\n
Related: <\/em><\/strong>Arbitrum-based Jimbos Protocol hacked, losing $7.5M in Ether<\/em><\/strong><\/a><\/p>\n
\u201cThere are groups that we know that may sit on their stolen gains for two, three years without any movement,\u201d added Su. <\/p>\n
While not much can stop crypto hackers, Su urges crypto users to practice better \u201csecurity hygiene.\u201d<\/p>\n
This could involve revoking permissions for decentralized finance projects if they no longer use them, or ensuring communication channels such as email or SMS that are used for two-factor authentication are kept private. <\/p>\n
Magazine: <\/em><\/strong>Tornado Cash 2.0 \u2014 The race to build safe and legal coin mixers<\/em><\/strong><\/a><\/p>\n<\/div>\n
![](\"https:\/\/s3.cointelegraph.com\/uploads\/2023-07\/7bb17273-afec-4c73-b8bf-31f1c6136daa.png\")