Cybercrime

FBI Warns of Surge in Attacks Targeting DeFi Platforms

The FBI is warning of an increase in attacks targeting decentralized finance (DeFi) platforms to steal cryptocurrency.

According to the agency, miscreants are taking advantage of the increased interest in cryptocurrency and the complex functionality and the open source nature of DeFi platforms to perform nefarious activities.

Ionut Arghire

August 30, 2022

The FBI is warning of an increase in attacks targeting decentralized finance (DeFi) platforms to steal cryptocurrency.

Cybercriminals are exploiting security flaws in the smart contracts governing DeFi platforms to steal virtual currency and cause investors to lose money, the FBI says.

Smart contracts, which are defined as self-executing contracts containing within their lines of code the terms of the agreement between a buyer and a seller, are present everywhere across the decentralized blockchain network.

Roughly 97% of the $1.3 billion that cybercriminals stole in cryptocurrencies between January and March 2022 came from DeFi platforms, an increase from 72% in 2021 and 30% in 2020.

The FBI says it has also seen cybercriminals initiating flash loans to trigger an exploit in the DeFi platform’s smart contracts (leading to losses of $3 million in cryptocurrency), exploiting a signature verification bug in a DeFi platform’s token bridge ($320 million in losses), and manipulating cryptocurrency price pairs (to steal $35 million in cryptocurrency).

Investors are advised to research DeFi platforms, protocols, and smart contracts to identify potential risks before investing, and to make sure that the DeFi investment platform has had its code audited at least once.

Furthermore, they should be wary of DeFi investment pools with limited timeframes to join, and which feature rapid deployment of smart contracts, as well as of the risks posed by crowdsourced solutions when it comes to bug hunting and patching.

DeFi platforms, the FBI says, should implement real time analytics, monitoring, and testing of code to address vulnerabilities and potentially suspicious activity, and should implement an incident response plan that involves informing investors of any suspicious activity, including smart contract exploitation.

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Latest News

Click to comment

Dealing With the Carcinization of Security

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Marc Solomon

Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Derek Manky

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George