Hunting DeFi Predators: Forensic Analysis of Multi-Million Dollar Hacks - DeFi Security Summit 2025

Transcript

Yeah. Okay. Now it works. Hi, how are you? I am Howard [clears throat] Romero, cyber security engineer with web3 forn6 research um and candidate PhD of engineer blockchain security and digital forensics in investigation. Um professionals f focus five years decade in the cover of cyber crimment and distribute ledger technology and blockchain technology invest research with emphasis incident respond

protocols and onchain funds tracing method methodologies and dep implement implementation in web threads environment. Um okay. Uh smart contra narativity assessment adversity testing. Um disclaimer my my English is is is no good. Okay. And I am scary. Um the 50 million H deecting the Radian capital. Okay. Disclaimer I I don't I

don't have a against with people with radian capital only use a case for this uh workshop. Okay. A forensic investigation ho into the lazarus group aquested one the most sophisticated u state sponsor attacks defeat h history. Yeah, the technical deep in dive trace attack victors, attribution makers and operational security fulers in enable North Korean triats actors the compromised radian capital multi- signature h infrastructure. Okay.

Case file the Rian capital incidents target protocol Ran capital crosschains lending protocol with multi-ync signature governance structure okay finance finance finance impact 50 million 50 millions xfiltrate across multiple blockchain networks super chain compromised via malicious erh package zip are ships containing malware into the file.

Um attribution UNC 4736 this is um AP AP in the in the metric attack matrix. Okay. Okay. Classification level. This is analysis uh intelligence from mandian threat intelligence hyper vibe security set of shadows slabs and onchain forensic data for arbitran.

Okay. Um and we are using um arbiton scan uh maybe um tenderly maybe uh aran and any tools for uh trusting for uh transaction deception layer of security controls were bypassed. Okay. deliver mechanism. The attack initiate initiate with with pawn with um sorry >> weapon weapons.

>> Uh okay. Um Okay listen. H the attack in initiate with weapons our ships this week with um legimate security resarch pipe hacking analysis reports pilot our ships [clears throat] indie and sophisticate front end manipulation trojan t intercept transaction signing processes and the browser level. Okay, this is um this uh this is uh able uh access control for PC and operating system. Okay.

operational mechanism. The malware established in the in the in in the man demol um position between genosis safe interface and the signing authority presented begin transaction data for the developers while submiting valition pilots for cryptographic signature in the wallet. Okay. Um the first the first step stakes infiltration social engineer deliver zip our chips to the developer. um into the seat. uh send uh PDF Rship PDF with mal with malware reacts

persistence establishes browser level hooks across the browser connection with uh level level hooks in the connection via for a browser. Uh step three, intersection malware pop saves UA trans UA transaction with um Metamax and wallet. Step four, exploitation malicious transaction sign. Okay.

Okay. Okay. Um so the blind spot this is where the sandra security protocols failed. First of all the front manipulation in the drift operated at the presentation layer intercepting data before it reached the developers visual interface. The safe UI display legitimate contract interactions while the more while the model were modified than their line transaction.

The impact was the standard visual verification protocols became ineffective as developers were reviewing sanitized false positive data rather than the actual play saying the real attacks successful compromise multi-agnet authorities we need radian governance structure this is very um vulnerability um it's with um across the governance structure into the company with um with able signing a transaction of of in the smart contract.

Okay. Um this is RB scan. Okay. Maybe um Okay. Light line of like on transaction time online. Okay. Initial exploitation detect in October anomalous treasure transaction trigger automatic alerts. Okay. Mandian and Seronos initiative parallel forensics investigation in um the next the next day and arbitrum consensus research um the a sign aet lazarus group

confirm track actor in in 21 October uh arbitron implements radian capital explorer address tax for no malicious wallets The threat actor profile UNCC 4736 apples campaign sheet slid the organizational affiliation democratic people republic of Korea reconnaissance grand general bureau campaign classification UNCC 4736 represents man uncatategorized cluster designation of this specific threat group public know as lasser group or hidden cobra in brother service group nomenclature operation mandate revenue generation for

the North Korea state through Systematic charging of cryptocurrency infrastructure exchange and defy protocols, intelligence assessments attribute over two billion in cryptocurrency theft from DPRK affiliated actors since 2017. Technical soph sophistication demonstrates nation state level capabilities including zero day exploitation, supply chain compromise, sophisticated social engineer and crossplatform malware development. The characteristic TTPs spare fishing campaigns targeting blockchains developers to cryptocurrency applications front 10 manipulations more multi-stage laundering operations intelligent resources

attribution based on malware signatures analysis infrastructure overlaps and operational patterns consistent with previous DPRK. >> Okay. Okay. Data kill chain technical reconstruction recon um recon just >> reconize reconense. >> Okay. Track actors identify Ryan's capital high value target research team structure multiign configuration and operation security practice and open source intelligence with techniques of oin weapons um malware engineer to target genosis safe interface payload package in in the zip rit with complete pretext

security um pen Security analysis delivery spear fishing vector for attack and pine deliveries weapons are for multi capital developers and governance participants throughout targets social engineer exploitation of established browser level h persistent uh hijacking transaction signing workflow without triggering endpoint security solution installation malware create pins and hooks into the safe uh monitoring for high value transaction eligible uh for manipulation.

Common and control command and control communication with attacker infrastructure rece malicious transaction pay to situation during singing cere ceremonies. Sorry, this is the uh this is the tweet uh in original for investig investigator of for research of menian oh I'm Sorry.

Lexon learning hardening multicycle operation hardware wireless mandates recurring multi participant to execute critical transaction throughout hardware wallets with physical confirmation screen eliminate uh the front manipulation attack surface open verification implemented sec secondary verification channels for transaction data uh is prefer channel um channel before sending participants show in Independent independent verify transaction details trout uh separate AP calls or blockchain explorex no use u presentation endpoint security hardening

deploy endpoint detection and respond edr uh solution spec specifically configur monitor browse extension assignment software for an anomalous behind indel trip and clash I got in ceremonies for threshold operation exceeding critical threshold threshold holes conduct signing on dedicate dedicate work insulate machine using QR code transaction trans eliminate remote comp compromise big vector intelligence integration estab establish it real time intelligent fits from blockchain security firms integrate

address screen against new uh No exploit database before processing any governance transaction. Okay, this is a screen. Okay. Oh, the other the other the other. Okay, I am going to uh screen uh char my my terminal. Sorry. Moment please. Okay. Um I am um I am going shing my screen terminal with process 4 and six um data on data onchain versus

data offchain. Okay. Uh this is um any any any any script for investigation uh forensics in in blockchain. Wait. Um I am using uh alchemy. Alchemy uh for provider recip and other tools free and arbitrary scan um either scan um BCASB scan.

Ah okay. Anyway, okay. Okay. Any scripts in I am using bash and I using python and in I am using hard hat. Sorry.

46. Thank you. Sorry. Okay. Let's start with uh the timeline of transaction and arvin the scan. Look the attack window in the lay only.

any minutes in the um the pis multis security setup. Uh execute. Wow. Sorry. teach.

Oh no. Okay, no problem. >> Oh no. >> Oh, okay. Sorry. This is a hard liberary for um I am building a scripting for hard hat for analy

analysis for um the tracking transaction in the arbitrary scan. Okay. No h this is step unuh attack timeline recon reconstruction um target contracts. This is uh the target contracts lending pool and locking facil chain initial compromise September uh 11 uh 2020 2024 Telegram me message from compromised contractor

for compromised contractor actor account malicious site file h pipeline hacking analysis report zip and payload app mac back door okay domain um this is a iio indic indicator in indicica uh compromise indicator okay pers persistent and lateral movement moment multiple developer device compromise K loging and transaction manipulation start acting on malician contracts across chains execution October um okay October 60 2024 front end show

begin transaction background sign malicious transaction bypass tenderling simulation Okay. Sorry I Okay, this is uh a script for um

find uh the wallet in blue crate in the in the in the hack. Uh this script h is building on on hard hat library. Okay. Suspicious wallet discovery technical analysis of um outgoing transfer for compromised contract. Okay, this is uh this is um this is wallet um this is wallet in the compromise in RB RB scan. Okay.

Okay. Wallet profiling suspected attacker wallets initial receiver confidence high current balance 24 it transaction comp zero wallet age analysis technic technic identify recite recently create wireless activate attack erh it's very suspicious uh indicator indicator attackers often using fresh wallet to avoid uh tracing um and stolen phones. Okay. K indicators wallets create a 30 days before attack for transaction shortly before or during attacks. No

previous transaction history. Fund from mixer on privacy service with um maybe cash behav pattern analysis track how signature pre pre uh pre-attack preparation state contract deployment with in advice okay multi multi science preparation simulation test transaction for ver verify access attack execution Um rapid sensation of transaction high gas price is the very very uh dangerous um in in indicator of compromise. Ensure

executation coordinate across multic contracts post attack behal of use mixer to allow cashache and crosschain bridges back door removal within uh three minutes or tracking techniques on chain analysis. Okay. Trace all uh transaction from to suspect um suspect suspected wlets. Identify common [clears throat] counter um >> counter parties maps transaction graphs and network analysis. calculate valid clustering coefficients. Um

database or open source in in internet um uh intelligence. >> Okay. Cross reference with uh no essential entities. Check against chain analysis database. Compro compare it with aran intelligence labels. Correlate with nonsense wallet tax. uh CR either scan labels pattern machines uh compared with previous uh UNCC uh 4736 attacks.

This is appetite in the matrix uh metric attack. Okay, this is a framework for cyber security um investigation maybe. Yes. Analyze gas usage pattern transaction timing anal timing analysis smart contract interaction patterns. Okay. indicators. Indicators are AP arbitr evidence technical indicators, malware, you know, command command and control and mayo macing

and social engineer vector via telegram. Tactical indicators multimon preparation period sophic sophisticate chain compromise advanced edr evasion bypass clan operation security okay protocols targeting uh large scale theft cons with u well okay it don't matters I should be

okay. This is a script if I I find in the data on on chain. Bueno. Okay. Isra balance reconstruction analyst lending pool balance change before attack after attack. Okay.

Okay. Money flow the diagram. Ryan lending pool. Um 50 millions maybe is no real um data stolen. uh attacker wallet mixer mixer to cashain price destination chains BC scan Ethereum base and platform for uh play to earn casinos dex swap swap deck swapping multiplay wallets exchange deposit okay money laundering technique that the Detect identify

landering methods rapid dispersal uh mixer usage crocheting bridges detection um deposit and mixer address dex swapping integration st uh field shen detection part of this crazy imbalance transfer. Okay. Okay. So, rip Okay, this is RB scan.

in the scan. This is transaction and in our this is um the report address the the blacklist uh for any comports. say this one behavior >> behavior okay behavior and and transaction in the histoal historical uh data okay this is real uh data of uh

compromise the stolen stolen post we are graphical I use it um collab for anal anal analysis data for extraction data for onchain uh anal analysis of offchain. Okay.

This is data is uh download uh for for arbit scan. Okay. Okay. Download CVS. This is Arvin scan for transaction already. Analy data. Oh, sorry. Okay.

Yeah. Five. Okay. I Okay. Uh this is collab I am using for analysis data for uh on transaction wallets um crochet swapping and anyway live.

Okay. Okay. Value transfer exploder. This is um the light sign of the stolen phones versus this is um real uh stolen phones in the arbitrary scan. Okay. Please say analysis on

last data analysis on chain [snorts] to follow the transaction of the malicious hash. This is the hash of the to for the tool analysis >> forensics >> for transactions and forensics purposes. These address we use it for the market

purposes but also we can check from here the transactions belongs. So if you use the entire address won't

work like this now but basically collab use it for data analysis and to bring analyze data on chain. So here is the total amount of what it was stolen. We have 11 Ethereum 11.9 So from collab we go to analyze all the

transactions and this specific transaction is the highest point that you saw in previously in the chart. There's one at the top left. This is

so this is our we also use it to track data chain. that allows me to do the proper analysis transaction and to check on the date on the values that they were stolen. So here it shows specifically the day we in which the phones on the were stolen.

So we go back generally. So in this case we couldn't compile all these smart contracts since they were not shown in return scrit. It's gone. So basically as we show before one of

the pattern that we saw here is the high to uh is the high gas fee and how fast the funds were deployed among different wallets. So, so let's do now a a live tracking

demo on how we follow and pursue the information around the chain. Okay, sorry. Um this is um in um a script for analysis um the data into the the blockchain arbitrun and BC scan. This is a data is a historical for uh transaction and um balance in in on wallets in in in blue crate in the in the hack.

contract. >> Okay, this is the direction of of contract in involvement in the hack. Ling. >> Okay, let me lending pool smart contract. Sorry. Locking contract. Uh, this is um this is in um smartphone.

>> So we use generally in order to get a more into depth analysis on the forensics point of view. So by using by code No, it's good.

This So this is the event tracker and we can

see here the contracts involved and blog numbers involved. So this is were events that that

involved in the blockchain and we raised that them up as the most suspicious on. Therefore, we analyze them. So we use generally in order to analyze

the in the smart contract but since it's not listed we could analyze from there but you can see that in and re room. We see that the smart contracts involved in the attack, they were in a black list. >> But when we use alchemy, we can see them. But the balances are now zero because since the attack attackers, they empty the funds.

But she's We got the address of the smart contracts. We use the API from Alchemy in order to control the smart contracts to pursue the real data, real time data. So this is a monitoring tool. So we can from where we can test the suspicious behavior of the smart contracts involved.

That's okay. So what we know from the found is that they were talking to a casino as to turn out cash and cai but since they are using ck technology we cannot trace it further So to conclude we are going to analyze

again to PSC scan. It's okay.

So this is a casino address and from here you can see you have zero balance and so we we can tell it's a really technique a really common practice from Lasseros group where the they receive the phones and the phones are emptied fast in order then they cannot be traced from here. So that will be all. Hope you like the show. If you have any questions, please raise your hands.

>> Question. Anyone here speaks English? >> No. Okay.

for capital. I just Yeah.

Ryan Capital. Smart contract. Forection information on chain.

the blockchain, Binance. analysis. Pyon tracking

contract. Smart contract. foreign. No nothing.

investig Gracias. >> [applause]