The United States Federal Bureau of Investigation (FBI) has issued a fresh warning for investors in decentralized finance (DeFi) platforms, which have been targeted with $1.6 billion in exploits in 2022. In a Tuesday public service announcement on the FBI’s Internet Crime Complaint Center, the agency said the exploits have caused investors to lose money — advising investors to conduct diligent research about DeFi platforms before using them while also urging platforms to improve monitoring and conduct m rigorous code testing.

[Katte, S. FBI issues alert over cybercriminal exploits targeting DeFi. (Accessed August 30, 2022)].

“As per blockchain analysis firm Chainalysis, cybercriminals stole $1.3 billion in cryptocurrency between January and March 2022. Almost 97% of the theft amount was stolen from DeFi platforms” [Sharma, R. FBI Warns of Cybercriminal Exploits Targeting DeFi Platforms. (Accessed August 30, 2022)].

In outlining the threat, the FBI noted that criminals are exploiting vulnerabilities in smart contracts to steal crypto from DeFi platforms. The bureau attributed this increase in DeFi attacks to heightened investor interest in cryptocurrencies as well as ‘the complexity of cross-chain functionality and open source nature of DeFi platforms’.

[Mutanya, M. FBI Warns of Increased Cyber Crime on DeFi Platforms. (Accessed August 30, 2022)].

Photo Source

In it’s announcement,

the FBI has observed cyber criminals defraud DeFi platforms by:

• Initiating a flash loan that triggered an exploit in the DeFi platform’s smart contracts, causing investors and the project’s developers to lose approximately $3 million in cryptocurrency as a result of the theft.
• Exploiting a signature verification vulnerability in the DeFi platform’s token bridge and withdraw all of the platform’s investments, resulting in approximately $320 million in losses.
• Manipulating cryptocurrency price pairs by exploiting a series of vulnerabilities, including the DeFi platform’s use of a single price oracle,a and then conducting leveraged trades that bypassed slippage checksb and benefited from price calculation errors to steal approximately $35 million in cryptocurrencies.

[Federal Bureau of Investigation. Cyber Criminals Increasingly Exploit Vulnerabilities in Decentralized Finance Platforms to Obtain Cryptocurrency, Causing Investors to Lose Money. (Accessed August 30, 2022)].

In the announcement the FBI sets forth certain recommendations for investor protection, as follows:

Investment involves risk. Investors should make their own investment decisions based on their financial objectives and financial resources and, if in any doubt, should seek advice from a licensed financial adviser. In addition, the FBI recommends investors take the following precautions:

• Research DeFi platforms, protocols, and smart contracts before investing and be aware of the specific risks involved in DeFi investments.
• Ensure the DeFi investment platform has conducted one or more code audits performed by independent auditors. A code audit typically involves a thorough review and analysis of the platform’s underlying code to identify vulnerabilities or weaknesses in the code that could negatively impact the platform’s performance.
• Be alert to DeFi investment pools with extremely limited timeframes to join and rapid deployment of smart contracts, especially without the recommended code audit.
• Be aware of the potential risk posed by crowdsourced solutions to vulnerability identification and patching. Open source code repositories allow unfettered access to all individuals, to include those with nefarious intentions.

[Id].

The announcement closes with the FBI’s recommendations for DeFi platforms:

The FBI recommends DeFi platforms take the following precautions:

• Institute real time analytics, monitoring, and rigorous testing of code in order to more quickly identify vulnerabilities and respond to indicators of suspicious activity.
• Develop and implement an incident response plan that includes alerting investors when smart contract exploitation, vulnerabilities, or other suspicious activity is detected.

“However, failing all that, the FBI urges American investors targeted by hackers to contact them through the Internet Crime Complaint Center or their local FBI field office” [Katte, supra].

The FBI has been “stepping up its efforts to address crime in the digital asset space with the formation of the Virtual Asset Exploitation Unit. The specialized team is dedicated to cryptocurrency and includes experts to help with blockchain analysis as part of a shift in focus toward disruption of international criminal networks, rather than just their prosecution” [Id].

[For further information on the Virtual Asset Exploitation Unit, see Attlee, D. What the launch of the FBI crypto task force means for the digital asset space. (Accessed August 30, 2022)].