Ministry of interior - Cyberspace & ADAN -Cryptoassets security: protecting people and funds

Transcript

[Music] Good morning. Let's talk about crypto asset security and the recent collaboration between the French Ministry of Interior. It is to say the cyber command which is an agency and adan the industry association to address the issue of protecting people and funds. First this chart represents French ecosystem for combating cyber crime in France. The fight against cyber crime is treated extremely seriously by the

government and a group of central agencies are specifically in charge of dealing with this issue. On the left we have the NC which reports directly to the prime minister. On the top it is a central institution responsible for national cyber security. Moving on to the second column, the Ministry of Defense has its own cyber command cyber command. Next, the Ministry of Justice has a section dedicated to fighting cyber crime. It is called G3 and it's located in the tribunal dear.

Now in the first column the ministry of interior and the the com cyber mile which we are honored to represent today reports directly to the ministry of the interior. Our cyber command is more specifically dedicated to strategy anticipation training and prevention. We to support central services fighting cyber crime which belong to police jean or Paris police. They all comprise highly skilled investigators.

On this slide you can see some key figures from the French Ministry of Interior. A total of 348,000 cyber crime related complaints were received in 2024. marking an impressive 75% increase over the past five years. As you can see, the vast majority of offenses relate to property, mainly fraud. Almost a third relate to offenses against individuals such as online 8, child sexual abuse material or doxing.

One of the most important thread for everyone are data leaks. France has been a hit by this issue. Numerous major companies particularly telecom companies have been affected and through them virtually millions of users their credentials and access are compromised. Not only some actors illegally make money by selling the data but alo users are targeted by fishing scammers or malicious phone calls. Eventually, as many experts have not, there has also been a slight decline in ransomware attacks in 2024 compared to the previous year, as well as the emergence of new

groups. So, this was a very short understanding of terrorist threats in general in France. But what about cryptoreated crimes? So on this slide uh you can see uh the global amount in the world of illicit transaction. So in 20124 we estimated that 50 billions of elicit transaction were made which represents 0.4% of a global crypto transaction volume. So you can see that majority of the the activity is legal. Um we have most transaction illicit transaction made in stable coins.

Um but there is no crypto crime. Uh we only talk about crypto proceeds of crime. So cryptocurrencies is is a tool and it it can be used as a payment method as a source of income or as a money laundering uh technique. Um we uh estimate that there is more than 11 billion of frauds and scam related illicit transaction in the world which is one of the most important uh categories and uh also the theft uh in all their forms uh represent at least 8 billion in 2024. You know in 2025 uh it will be at least 1.5 billion.

So uh what are the techniques and assets used? So you can see um criminal tend to favor um hiding techniques uh such as uh privacy coins such as Monero, decentralized mixer, uh using people as mule to uh deposit or withdraw money on exchanges. uh we have uh for sure bitcoin and ether ether used for elicit transaction but not so much uh it's it's mostly in in stable coin uh which represent more than 55% of the global elicit transaction and also we have a problem with um the the exchanges that criminal favor uh which don't comply with the the

authorities. So uh basically one of the most important uh stuff you heard about is uh kidnapping. Uh in the world in 2025 uh we have at least already more than 31 cases. Uh the French ministry in midMay agrees to take a set of measure to protect people so professional but also their families uh who are being abducted to get a ransom in in cryptocurrencies. 25 people were already arrested including minors and it was a criminal network uh but people u can keep imitating them uh in the last cases. So in the world globally since uh 2020 2014

uh we estimated that there is more uh two there is more than 231 um case ever counted. So what do you earn by uh trying to kidnap people in crypto? Uh you take 20 years of prison at least uh according to the French criminal code. Uh if you if you do physical damage on the victim uh you have at least 30 years of jail and uh if there is also act of torture you can get the life sentence and the majority of the funds are are uh traced and frozen. So congratulation.

Okay. Thank you actually for talking about physical assault. Now we are going to talk about digital threats because this is very important too. So the first category are scams. Basically we have four type of scam we see every day. the fake investment scam, the impersonation, fake technical support and pig butchering also called fake remnants. So basically for the first one you will receive a phone call from someone working in London at a city. This is a trader. They will convince you to invest a vast majority of your saving in crypto and you will have a beautiful dashboard have a huge return in few days or few

weeks but after this time everything will disappear and your money is gone and there never have been any crypto involved. For the second one, they will use data that they can found about you on internet within data leaks and they will connect to your crypto exchanges account and will try to withdraw your crypto. But they will have to face the support and try to impersonate you based on the data they collected about you and they will withdraw all your money. For the fake technical support, you will receive a phone call from someone working at a major crypto company and they will tell you, "Okay, your crypto are under threat. You need to urgently move them to a new account. I just send

you by email a private key, use it to restore a wallet and send the money here." But you act in urgency and after a few minutes, you just realize you lost all of your crypto saving. And for the last one, you will receive a message on a dating app, Messenger app, and you will fall in love with people behind this account. And at some point, they will convince you to invest in crypto or to send them directly crypto, and you will also lose everything you send to them. Okay? Uh all the people outside of crypto love to say crypto is a go-to for criminal and money launderers. All the people inside crypto love to say no no no there is no crypto crime here just

look away please. We all know that the truth is between the two statements and crypto have been used on darknets in 15 years. Nothing new. But nowadays some drug trafficker in real life are using it too. As we can see in this case it's from the financial times in UK. Drug trafficker uh bought crypto to South American supplier. Then they sold the crypto in the street uh to fiat money and they converted this fiat money against crypto with the help of money launderer. And then they make this loop indefinitely.

As we can see here act are also one of the most prominent category in crypto. Uh as we can see every year the amount of act is rising and the amount of stolen money is rising too. So there are two main uh reason first crypto value is rising up and many more people are using crypto. So many more attempts and the last one is the drainer. Uh no one outside of crypto is talking about drainer. Even CTI companies inside of crypto not that much people basically uh in 2023 million have been stolen by crypto drainers group uh and they made 300k victims. In 24 500 million have

been stolen at the same amount of victim. So uh they operate like ransomware groups. They are very organized. You have developers. You have affiliates and payment are splitted between them. And my belief is that in few years crypto drainer amounts stolen will top the amount collected by ransomware groups. So basically what we need to do is uh to reinsure people because uh people think I won't u have a complaint. I won't uh get uh in front of the the police or the because they they can they cannot do anything about it. So they are not trained. So the first thing is to raise awareness and to get communication and

prevention action uh against cryptoreated crimes. Uh the second case is to uh when people are well informed on how to uh fill a lawsuit, we have the lawsuit and the investigation ongoing. Uh when we have the investigation, you have people with more experience uh who know how to trace money and to who understand how crypto uh actually works and you can update the training inside uh the the authorities of we have been doing that um since 2014 at least. uh there are a lot of people who know well the the topics but unfortunately sometimes uh people have a different experience um locally or regionally. Uh

we have trained more than uh 500 people since 2022 including uh foreigners and uh it can be police or John Marie or people from the from the justice too. Thank you. Thank you. Um I'm working at ADAN which is the French and European Association representing crypto assets industry and I'm really glad to be here with the ministry of in to share the work we've done since uh the the unfortunate events of of May and the months uh the previous months. So we realized that while many entrepreneurs and companies and investor try to protect themselves there is no uh there was no clear unified message or good

practice uh adapted to the specific crypto asset industry. That's why Adan and Ministry of Inter decided to work together and we wanted to make sure that everyone from individual investors to big companies had access to clear unified and share advice on good practices to protect themselves. Concretely, we worked on to integrate an entire new selection on the mass security app. uh this is the ministry's application on web and and mobile phone uh to for the public to protect and you have some good practices and it now offers a practical guidance for users entrepreneurs on how to secure their assets and reduce their exposure. This builds on the existing tool which is a which is the national website to help citizen with cyber security issues more

generally and the idea was to adapt cryptospecific layer to that solid foundation. Um so uh in terms of action concrete uh concretely since midmay we have a priority list when people call uh the authorities uh there is an emergency case u local authorities police or jamar they should know that people are at risk or specifically at risk because they they have crypto or they are in the crypto ecosystem notorious or not. Um also uh the ADAN association made a OBSC guide for people to know clearly how to manage their assets but also their

personal image uh on the social networks on media uh including in physical events such as conferences. Um we made a security audit and it's still ongoing uh when uh police and John can provide uh this audit to entrepreneur locally to understand how their home are secured um and how their crypto asset are managed and there is also a self assessment questionnaire which is being provided in collaboration with Adan uh in both digital health and also crypto security.

So, how do you manage your key? Do you have a strong password? Blah blah blah. So, the the few key words we need to end with are moderate. So, moderate your exposure, moderate your your communication, your language. Um, when you are with uh with friends, maybe it's not exactly friends. So, you you will you will brag about your your crypto portfolio. Uh it's dangerous to do that. So, don't do that. Don't disclose your personal details. uh select who can you really trust in a close circle. Uh for example, for multisig or um people who have a part of your uh your seed. Um even family, you cannot trust uh everyone in your family. It depends.

So it it may be a really really close uh circle. Um the third word is lock locking uh your access to your account. uh we know that many people are lazy and they prefer to to uh let the money on the exchange. In this case, you need to have a strong password and two factor authentification. And if you use like classical or more secure uh methods, uh you need to be very careful with your with the with the seed. Don't take a screenshot of your seed. Obviously, don't send it on a web app or a messaging app and and secure your seed not on the on the very small paper which which can be damaged. Use a metal wallet for example and anticipate

uh like a protocol get a protocol for in case of emergency uh who can access your your your funds. Um so if you have a problem or if there is any problem also police must know uh must know all wallets location and possible targets because the criminal if they are organized they can target you but they will also target people in your uh fund access protocol. So this is the main message we need to we need to give you. Thank you.

We take a few question if you have the time. Okay. So I work for exchange and so often times law enforcement is very inbound for us. You know we have a process for dealing with your requests. Um oh hi can did do you want to okay sure. Hi, I work for a centralized exchange and so very often uh in the interest of talking about the feedback loop you mentioned, we get a lot of inbound requests from law enforcement. Uh my question is how do we build a better partnership when we have things to share? For example, um you know, we're a very global company where we might have a victim who's in one country, uh we have a headquarters in another country, but maybe we have a person of interest through thread

intelligence, right? Who may be um in your jurisdiction. like what's the best way for me as a centralized exchange to build a positive contact where we can report those things when sometimes we may know info that other people don't. Um there is no magical answer unfortunately. But uh what is sure is that we have a problem of of time and a problem of space. Time because the the funds the illicit funds move very fast and if you try to to to freeze something it is already too late and uh space because uh criminals as you said they use different jurisdiction and non-comparative exchange. Um in my in my view uh I think we need to try like uh to use more task force such in the case

of ledger we we had with the seal organization for example and have a better partnership between the private sector the developers the exchange lawyers because lawyers can add uh something on the solution. Yeah thank you. I would definitely look forward to a better collaboration just because you know often the data sharing for for us it seems like sometimes we send things into law enforcement it takes a long time. We don't know if it's the right person. It's the law and it's several law in more than 200 countries. So that's the law. Thank you. Next question.

Hey. Hi. Hi. Uh great talk. Yeah. So um we are from It's working. Yeah. Uh great talk. Yeah. So we are from Enscribe team and we are working on you know building trust in smart contracts. When users are interacting with smart contract how they can know it's uh it's secure it's you know it's trustable. So have you heard about this poofing addresses address attack right? All these things. So like what's your thought on how people are interacting with smart contracts? How they can trust it and how you know we can secure those interactions. uh you have several companies I won't mention any but you have several companies including in France we have a lot of talented people I know I'm sure in other countries also but uh the formal verif ver verification of smart contract is

one of the key uh road to protect and to secure smart contracts and there is also collaboration with the computer the location where the ministry of interior is uh in cyber security and they they granted an award uh to a few companies working on that topic. So this is the first uh one of the first solution and the other solution is uh on the wallet and the navigator wallet you also have companies building a solution to have a red flags uh when you try to interact so be careful this is fishing this is a drainer don't sign it so yeah I think yeah that's great and also looking forward to you know more talking more about this yeah to you yeah thank you

after that yeah okay thank you very Thank you. [Applause]