How dApps Can Stop Money Laundering

Transcript

And before we get started, we'll just talk a little bit about ourselves. Um, I'm Julia with Zero Shadow. Zero Shadow does uh security prevention and instant response. So, we're trying to be your security partner for the entire life cycle. Um, if you're trying to make sure that you don't get exploited and if you do the tracing and the recovery of the funds. >> Yeah. And quickly about 1 in for those who don't know what 1 in is is used to be the biggest DEX aggregator and at this DevCon is maybe will be a biggest liquidity uh layer in in DeFi after it and yeah we we are the set of protocols that do different stuff. Uh and what we take also very seriously is security or

risk management that we're going to also tell you about a bit in a bit. >> Yeah. So what is the problem statement here? It's that your total value locked is entirely North Korea and that's what's making up your protocol fees. Um we saw this very clearly with the buy hack. Um we at zero shadow were the ones uh who were tracing those funds. And if we're looking at this, this is a overall summary graph of how the funds were flowing. And you can see that these funds hit a lot of different decentralized applications along the way. So, North Korea very famously always swaps all of their funds that they stole into ETH or some kind of um more stable and non-reasable asset. Then

they move the funds across chain. They use a lot of different bridger bridges to do that and they go across a lot of different chains in the process. We've also increasingly seen that they're using lending protocols as kind of like a storage spot to hold the funds for a little bit before they continue on with the laundering. And then ultimately they're trying to um exit via over-the-counter brokers um a lot of them that are Chinese-based. So along this way, um this is a little bit of an ideological position, but there are a lot of applications that we're interacting with um in this process and we're talking to them about um what they're seeing on their side um

in terms of these stolen funds moving and also if they have any way to intercept these funds or at least dissuade this activity from happening. And you can see that when this kind of activity happens, it can be pretty drastic. So this is uh Thor chain movements in early October. There's suddenly a four times spike in the activity on October 2nd. That's because four different North Korea hacks were suddenly going through that bridge at the same time. So these are all fees that Thor Chain in this case are gaining a lot of um profit off of. And so maybe there's something that uh they want to do about it. Um, I think there's two real reasons besides it's the right thing to do that you might want to try

to intercept elicit activity. One is that the law enforcement is looking at these things. Um, and it's not just US law enforcement. So, at the end of April, we saw that EXCH was taken over. that was a centralized uh service but that was uh Netherlands and German law enforcement that actually took note of how much activity was going through and decided to take action. The other is the impact of institutional trade that's coming. Um there's been a lot of talks this week about how how much Tradfi and these uh institutions are planning to integrate a lot more with decentralized applications and they're just going to

have caution if they see a lot of Twitter posts about how one protocol is especially being used uh by bad actors. So, um, if you're in that position where you say, "Yeah, I do want to try to do something and take action against being used for illicit activity," uh, then you might hit some kind of design barriers that are impacting your ability to actually implement these kind of changes. And there's a few that we see come come up again and again when we're talking to services about if they're able to do anything. The first is contract upgrade restrictions. So, uh, the way that the protocol was designed, uh, was pretty finite and it doesn't have really good ability to add some

upgrades to maybe have delays or freezing or whitelisting or blacklisting. These are all features that might be um, impactful, but there's this restriction in the current version of the system to actually be able to put that forward. The second is composability considerations. And definitely there's um certain parts of your ecosystem that might be uh better used for actually trying to stop list activity than others. If your token is being traded across all these different decentralized exchanges and crosschain, maybe that's going to be very complicated to try to freeze funds, for example. But if you have a bad actor depositing directly into your lending

pool, that might be a better scenario where you can actually try to take action. And so thinking about those kind of more specific use cases where there might be a real change. The third is address turnover. So we see that bad actors are ripping through new addresses extremely quickly for the bybit hack. By the first six months, we had counted 12,000 addresses that these actors had used. And so if you're just using some kind of general know your customer know your transaction kind of platform and just trying to receive blacklists or even via word of mouth via someone in a telegram chat with you saying block block this address you're

just always going to end up falling behind because the turnover is so quick. And then the last one is small teams. um totally see it and know it that a lot of uh these teams are maybe one security person maybe not even and you want to focus on building and growing and not necessarily the security side. So that can be a huge barrier to actually implementing some kind of changes to try to thwart this activity. But we have some baseline recommendations that we've seen are working and um want these to be at least good takeaways and we can start a conversation if you want to think about what else you can do more specifically.

So the first is delay functionality. This is really really impactful that you don't have to take custody of any funds but you can just add some kind of considerations for making it harder and having more friction to actually move this elicit activity forward. So some of the delay functionality you could think of is by volume. How many of your users are trading $100,000 at a time versus $1,000 at a time? How many of them are doing that multiple times in a row? because we'll see uh five bridges in a row. They're each 500k. That might not be your typical user that's doing that.

So, you can start to make some special considerations there. You can also think about just having a time delay. Maybe it just takes a few more hours to do certain activity and that's giving you more time to think about um causing friction and making them maybe move to something else and away from your protocol. Also, address needs a non higher than zero. This is a huge one and this is going back to the fresh addresses that we were talking about. If you have an address where it's only received funds and it's never sent anything before, you can consider having some kind of additional checks that you do before that address is going to interact with your protocol. Um, and again, I think this is one where if you review your

your system and look at how many fresh addresses are uh potentially illicit versus normal users who just continue to reuse their addresses, you'll you'll notice this kind of trend. Token risk categorization. This is the idea that if you know that uh bad a token with a blacklisted token is being used, you can just kind of exclude it from your data set. live blacklist. This is the idea um which Oris will talk more about about how you can make much more comprehensive and dynamic blacklists that go beyond just an address list and have a much more real time look at what bad activity might be touching your protocol. Uh it's

kind of like an oracle in a way where it's constantly live updating and you have that feed that's integrating directly into your systems. And then the last one, front back controls. The idea here is that you might just you might have multiple layers where there are um integrations with with your protocol and you want to make sure that you're accounting for those and you have risk controls at each of those layers. So it's not just the website, it's not just maybe the contract itself, but it's everything in between. Um so one case study here, um this is also from Bybit with Mantle. Um this was uh at the very beginning of the BBE hack. We saw that Mantle was able to

save 15,000 CME from uh being taken by the North Koreans. And in this case uh that was at the time that was about $40 million. So how did they do this? First of all, they had a delay window. So they didn't let the funds move right away. they had in place that they could not not freeze those funds necessarily, but at least stop the activity and have some time to take a breath and think about well what are we doing here and and what do we want to do next? Then they actually blacklisted the exploer address and then they had the ability to actually move those funds to a recovery address. And so the controversy here is that this is centralized activity. This

is not fully decentralized and I completely see that. I think also it was interesting to see the community response um to this action because there weren't a lot of people saying in a very ideological way, oh we should never do this, we should let them take the money. There was a lot of I understand in this situation why this needed to be done or I understand that we want to help in a security sense. So I think that the ethos is kind of showing that there there is some degree that if you can do something that maybe you should do something. I think the balancer exploit has also shown that and the response that people had to different layer 2 actions >> and I can pick it up from here. Yeah.

For a while. So for what Julia mentions uh that one of the last things that Jula mentioned was very relevant to me is the front and back end controls. What we do at one lin we categorize security to three layers to the front ends uh to the protocol and to the back end controls. Not all the device has probably backands uh who doesn't want to have like back ends controls but we have actually because of main thing security and uh what we do sometime we we have a lot of security triggers on the front ends uh which even the site topic of conversation on the protocol level I think we are all as industry is not really there to have some some ML controls on a protocol level layer even if there was like a lot of controls but

on the back end level we advance a lot on how we uh controlling the identifying and screening of the bad actors in the space and uh this is what we are building at 1 in mainly the back end for uh screening controls and identifying of bad actors and we do that not just on the uh bad actors that been been identified by that scan or someone else last week last day last hour last minute in the space what we do we try to uh uh create build profiles around addresses and clustering at addresses and prevents the the bad actor becoming before becoming the bad actor on chain and this is thanks a lot to zero shadow zero

shadow doing amazing job uh in terms of uh security and identifying patterns identifying wallets identifying uh different group of bad actors in this space and supplying us this data uh we actually created even the direct uh supply of data to from zero shadow to the one in back end and they have a full access to uh the one in block lists. What what we do like what the most probably biggest thing we are building right right now is one in that improving the security space uh in defi is clustering of different patterns in the space with also the help of inner works.

So what does it mean? It means that based on the uh log data we are receiving from interacting with our interface, we can cluster different bad actors wallets to under one category of bad actors for different type of profiles and by that we can say and report properly then on those actors say who they are and then report if needed. So uh what I'm trying to say that it's not the the control we probably used to have with such tooling SL chain analysis term labs elliptic what we try to do we try to understand why this wallet was blacklisted and what is this wallet not like relying only on the data that

someone supplied to us and do that on the on the smart data fingerprints. Uh yes thank you. So and uh also to do that successfully this is what actually we come up and do with zero shadow we uh uh we preparing the playbooks for that and uh because we we we don't need we don't seeing that you know some probably uh discussions are happening in each country to regulate defy to put it under KYC to to make the the gatekeeping window for D5 protocols but we think that probably the most one of the most one of the at least ways to go would be to create a patterns patterns on what to do on the uh on the DeFi protocol to make it better secure and one of the

playbooks is what Julio already mentioned token risks. Yeah, working with different type of tokens that uh different type of risks that identify different type of tokens to not let user use it. Uh transaction simulation this is what we do for for the 1 in wallet uh users. uh the the playbooks we are creating I don't know if you saw that but you can Google that we have one in security white paper and uh we are releasing new version two this is actually the the the playbooks controls we have it one in and we kind of sharing with with the community to to work on the same and uh post incident flows this is probably one of the most important is that when you have the playbooks you of course follow them but you cannot

bulletproof yourself from bad actors using you so what we do is uh after uh we identify any anomalies any added bad actors patterns using oneish protocols is to isolate trades that we profited out of the user uh as the protocol as a company sometimes it's swap surplus as we don't have trading fees at one in it's only company funds it's not user funds because we are not custodial and then uh do some review and reporting with those funds can you only yeah >> um yeah So this is a case study which is showing some of that um enhanced address list that we were talking about where

you're profiling um how how the users interacting not just by their address but by their entire online presence. And here this they chose to remain anonymous but this was a large centralized exchange that found that their token was being laundered by bad actors. And you can see from the chart that these big spikes were really coming from a bad actor and that the the normal users were at a much lower um to volume of usage per transaction. And so what what happened here was that the laundering was deterred because of using these overall user heruristics to really create these uh friction, create those delays for the

the bad actor to actually be able to bridge the funds and then the moment that the funds were a ever successfully bridged being able to actually freeze those funds. And so that really deterred the actor and they stopped using that that service and and uh they have much better uh statistics we could say after that. Um so one example there >> yeah this is coming back to the isolation. So and we will give you one example what for example we do and try to make other device maybe doing in the space because it's not that much popular uh for example protocols to do is in case you have some uh fee extraction you you make revenue out of out of the

someone who is using a platform as an interface as a protocol or whatever you are in defi you can also uh uh do something with those funds not keeping it for yourself yeah just for example uh give it back to the victim yeah which is always the good Okay. So in our case what we do uh we try to always isolate for example at 1 in we have S surplus uh from every user who is swapping at 1 in and so we when we identify that this is swap surplus from the bad actors wallet we isolate and with the help was with of zero shadow we also try to identify the uh the victims and give it back give it back based on the uh court order green light from the law enforcement in case we're coordinating with them or actually

this is Something that zero shadow is pushing with also security ali aliens and seal 911s is the coalition of different partners where you can identify each other before sharing for example the fees you're isolating in case one of the partner is the is the victim of of the hack and uh yeah so what I was trying to say that uh this is the hygien we do for at one inch for the app and we try to also to h give the same hint to our our partners in defy to do kind of the same. Yeah.

And this is actually the case that we did once time uh with the with the one in uh for those who who don't know we have two kind of uh swap systems at one in one is aggregation we aggregate among like all the available liquidity in the space mms and PMMS and one is intentbased. So intentbased is just make an intaker. Yeah. So we have resolvers who is providing liquidity in the in the one in fusion we call it uh intentbased space. So that's why you see a resolver is usually a third party actor like uh I don't know winter mute cumberlands and so on. So what happens the bad actor before it was identified by anyone as a bad actor uh entered the one in DAB

space uh settled the uh make made an limit order limit order was settled uh with the one of the one in resolvers and oneinch resolver make huge amount of fees out of this settlement uh they arbitrageed. So what we did we just uh uh isolated those fees and uh then after the investigation and law enforcement coordination we uh sent at least the part of the money that was stolen from the user from the user to this victim. >> Yes. And thank you please.

>> Yeah. Um that's it. if you want to talk to us about um any of these designs uh or playbooks or if you want to try to join this coalition that talked about which is trying to have um faster return of fees uh without waiting for law enforcement requests which can take a lot of time then just reach out to us. Thank you. >> Thank you Julia and arrest. I don't know if there is any question.