How Traditional Security Failures Enable Billion-Dollar Crypto Heists, Simeon Nguen | ETHSofia 2025

So, one of the most isolated countries in the world so happens to be the bane of crypto in a way. And it's kind of paradoxal that they're able to hack thousands of companies yet they're isolated and we see them as underdeveloped but at the same time they score huge heists. So uh we see obviously uh 7 months ago history was made and we had the largest theft in human history 1.4 Four billions stolen from bybit. And this is not just in the crypto space.

This is in general the biggest theft bigger than any bank robbery, bigger than any art theft, by corporate fraud, anything. It was just out of this world. And what happened was through social engineering. And one modified JavaScript file later, we see uh the consequences. uh 2024 DMM bitcoin again hacked lost a lot of money same with taxi infiniti but the interesting thing is that the blockchain was not compromised all of those security breaches happened because of traditional failures so I think this is a part which is being largely neglected because of the whole uh hype around securing web three and we're leaving another side open so hopefully By the end you would see reason in that uh the story of North Korea didn't happen overnight.

It was evolution and all the way back in 2009 we see them starting with really script kitty attacks website defasement det and so on. When they eventually evolve to be able to hack actually a bank the bank of Bangladesh lost $81 million because of a mistake. It should have been 1 billion but North Korea made a typo and that saved them. Uh after that they started uh discovering the crypto space and playing around with the idea of crypto and seeing if they can breach uh some exchanges and whatn not just to uh get funds. After that they oops they targeted uh the supply chain and they discovered that why hack one company when you can hack the key company the vendor and hack pretty much thousands of companies because of that.

Uh they've obviously played around with cloud. Everything nowadays is running in the cloud. Every company loves it. Hackers also do love it. And last but not least, AI uh is also coming into the game for North Korea.

They have developed a research center specifically for AI to pretty much uh assist all of their operations, not just cyber security, but we're talking about traditional warfare, so weapons of destruction. Uh we should not think about North Korea as like the traditional hackers because they are state sponsored threat. So uh it's estimated that they have around 7 to 8,000 operatives. Not all of them are hackers but uh it's estimated that they have like around 300 hackers. So this is still a huge capabilities.

Not all of them do cyber crime uh for the sake of money. Some of them do it for espionage and getting uh sensitive documents. uh as I mentioned research center uh 227 already established and it's uh estimated that they have 90 AI specialists who are already working on making all of their operations better, faster and to scale them up. Uh obviously the operators keep really a small amount of money uh compared to what they're generating. And uh all of the stolen crypto, the stolen dollars, euro, whatever, uh it some part of it obviously goes to sponsor lavish lifestyles, but it's actually used to fund their nuclear program and buy intercontinental ballistic missiles.

Uh why did they switch to crypto? Uh obviously banks do have a lot of money and they targeted them. But after the Bangladesh hack, banks pretty much evolved. Swift made them evolve because they've enrolled the customer security program which made it really harder for them to target banks and obviously because of the traditional finance uh bureaucracy in a way. Uh it's really harder for them to launder the money to pretty much uh get it out.

So we have a lot of limitations when we're talking about uh traditional finance the working hours uh the KYC and very important reversals are possible until settlement so all their efforts can be undone and uh crypto by itself the whole idea it wasn't just a new target for them it was the perfect target uh for all the reasons you see uh obviously reversible uh crossber transfers just like that and it's a young industry which prioritizes growth over security and we're obviously seeing a lot of examples uh for that. So they adapted, they improvised and they overcame uh so every blue uh every hack more or less follows the following uh blueprint uh in four phases. Obviously the first would be reconnaissance where they need to investigate everything about the company. They need to map out the attack surface. They need to know your business, your servers, your open ports, everything, your employees, and just get an idea of uh who you are, who works for you, who might be the key people to target.

After that, they start trying to get access, maybe days, maybe months, really depends. Uh but always hackers choose the the easiest path, the path of least resistance because they're kind of lazy, at least most of them. So uh they target the weakest link in the whole chain which is the people and uh we see that with fake job offers with uh uh malicious documents sent to key people or just compromising the supply chain uh which we're seeing uh in a lot of cases after they get initial access. This is what really separates them from amateurs that they do not rush. They take their time.

they get familiar with the workflows with the system with the internal infrastructure just to get an idea. So they really just sit and shadow uh in the uh environment until it's time to execute. So everything pretty much comes down to this moment of execution where they need to be really quick, everything needs to be uh prepared and they need to make sure that it works because one mistake can cost them a lot of money. Uh so yeah, hackers have to be lucky just one time and companies have to be lucky all the time. And it's really interesting the contrast in their arsenal because they have some really advanced nation state capabilities uh military grade malware so to say uh like Nimdor completely uh injects itself into memory hard to detect by antiviruses and uh different types of root kits for Windows for Linux doesn't matter they have it more or less so and it's obviously intended to bypass uh all the flagship security vendors uh it would be naive to assume that they would roll out malware that would get detected by crowd strike or whatever.

Uh but on the other side for their entry tactics they use things which you can uh pretty much uh say they are quite simple like job offers like update your drivers things like that. So things you would warn your grandma or parents about not to fall for. And uh yeah, obviously they uh have force multipliers to make it harder to detect, to make it faster, to make it better. And with AI, it would be a big change. So if they do not go the traditional route of compromising your company, they have another way to compromise them.

And there are already a lot of uh workers uh embedded in companies, Fortune 500 companies. There were even uh 300 confirmed uh cases in the US where companies were breached. So there might already be inside of your company, especially if you do remote working. Uh it's really simple as you see the flow. get stolen identities, apply for a job, get the job, and then work as a standard employee who just happen to have some fun side activities like data theft, excfiltration, back door installation, you know, regular employee stuff.

Uh, so yeah, uh, of course they are not hackers, so they stay embedded. The main idea of those workers is to generate revenue to have many concurrent jobs because it's estimated that they bring around 500 million in revenue per year. So if if it all happens that one of those guys you see there is working at a key company, he might later get activated as a back door to allow the other groups within North Korea to infiltrate the company. Uh and obviously we couldn't go without that 19 days of surgical precision and uh we have to take a look of course at the bywith hack uh since it was really significant and how it actually started and showed it more or less it was a traditional security failure. So on February 2nd uh boring domain getstockpric.

com gets registered which will later be used as command and control server. after that uh a developer gets compromised by apparently a straight uh trading app. So pretty much it was Python code which he ran and it exploited uh Python YAML derization bug which pretty much created remote code execution on his machine. From there out, his machine beaconed out to the command and control server to download additional code which pretty much harvested all of his uh credentials, his key keychains, uh AWS session tokens and everything which might be considered as juicy. They've tried to establish persistence but they couldn't because uh the tokens uh expired.

So pretty much they had to get new fresh tokens every 12 hours because this is how long it lasted. And this is the cool thing about uh stealing tokens that even with MFA, you can bypass it by just stealing the tokens more or less. Uh yeah, they've uh enumerated the internals of the AWS uh instances they've had and they've pretty much uh replaced the JavaScript uh file with 20 additional lines of code. And from that moment on for the routine transactions from uh by bit we saw pretty much what happened. Obviously there was blind signing on the side of bybit but uh even still do you see more or less anything non-traditional here it was just compromise the developer malware uh AWS S3 bucket enumeration and update the JavaScript file and hope and pray that everything goes according to their way.

Uh so what we have is a focus on the left side where we really want to secure the web three side of things. We're doing a lot of smart contract audits. We're doing uh management of key material and everything just on that side. So we've built a digital fortress and we have pretty much left the window open for them to do all the things on the right side. So session hijacking, exposed credential, just traditional cyber security stuff uh which we have missing integrity checks, not code signing and so on.

So this is in a way the hacker way that it's a game of cat and mouse and once you up the security on one side, hackers are forced to find another way in because there's just no other way what's going to happen there. you know, there's no longer going to be any hackers. I don't think so. So, uh, yeah, they focus on traditional stuff while we seem to focus more on the web3 side. And they turn our assumptions into attack vectors because when we're thinking, okay, we're too smart to target, but they might actually already be in our supply chain.

We might be thinking, okay, we have the best in-class security, but they have nation state resources. And obviously they would be testing their code against the top-notch security vendors. Uh our team is too smart for social engineering, but your best developer just got a job offer from North Korea and he's happy to click whatever they send him. Uh MFA protects our account. Sure, they steal session cookies and our vendors are trustworthy, but the vendors are the primary target because why just hack one company when you can hack all of them just like with by bit.

They hacked safe and they specifically targeted by bit. So start where you are and use what you have. It's not impossible to stop them. Sure, they have a lot of patience, a lot of capabilities, but companies just need to also do the basics and uh verify obviously the people they're hiring, especially if they're remote uh employees. They need to be doing uh secure uh supply chains.

So why are you for example having some imports of a GitHub project which has two stars uh obviously hunt for indicators thread hunting it's really important and uh it would be really really good if you happen to do red teaming not pentesting because if you if any of you have done pentesting you know pentesting has scopes and scopes are limiting but the hackers don't have limits so in a pentesting scenario normally social engineering is completely out of the picture, but in red teaming that might be fine. And emulate the threat of North Korea with their playbooks. Use their tactics, techniques, procedures. Uh just do it the way they would do it. And even better, if you have blue team and red team, they can work together to know, okay, when the red teaming is doing this action, the blue teaming team is indeed uh detecting it.

So verify uh the controls you have in place. Uh now this is uh about the thread hunting part of it. Uh just how to potentially maybe discover them if they might have access. Uh those are some of the key things. But just uh look for unusual uh hours for commits, login, login from weird countries.

Uh VPHVPN chain logging. Uh for example, some developers might not be able to explain their own code. There might be differences in quality. Uh so inconsistent work. Uh but yeah, you really should be performing uh thread hunting just to try and detect them.

And the last uh part will be the AI amplification uh amplification which would as already mentioned definitely help them in uh areas of mass vulnerability scanning and better validation uh in AI assisted exploit development and research and uh probably in malware as well. Uh, so they didn't hack the blockchain, they hacked the supply chain, they hacked the people, they hacked the cloud, and don't let traditional security be your billion dollar blind spot. Uh, that's pretty much it. Thank you. Heat.