Cryptocurrencies continue to gain mainstream adoption and are now the world’s second most valuable digital asset class. As the market evolves and becomes more mainstream, the security of transactions and the verification of ownership of digital assets becomes more important. The rise of the internet, mobile devices, and the more than 7000 digital assets currently listed on cryptocurrency exchanges have created a perfect storm for cybercriminals. Criminal elements have turned to token cloning and other forms of fraudulent activity to take advantage of the growing investment opportunities and the lack of standardization in the cryptocurrency market.
Cryptocurrencies have also given rise to new types of cyberattacks. Verification and liquidation services (VVS) are a type of attack that exploit the verification services that some cryptocurrency exchanges offer to users. These services allow users to verify their identity and store their cryptocurrencies on an exchange for a small fee. Cybercriminals have created verifier services that mimic the verification services offered by legitimate exchanges and extort users by demanding a fee for accessing the exchange. Once the cybercriminals have extorted the fee, they can transfer the user’s cryptocurrency assets to another wallet address without any additional verification. In this blog post, we’ll explore the types of scales that cryptojackers use, how they identify targets, and how they extort users by using VVS services.
What is a Cryptojacking Scale?
A cryptojacking scale is a tool used by criminal elements to identify cryptocurrency traders. They use these scales to monitor the networks of cryptocurrency users and extort them by demanding a fee for their services.
In this blog post, we’ll explore how cybercriminals use scales to identify targets and how they operate with VVS services.
How do Cryptojackers Identify Targets?
The process of identifying a target is complex, but at its core, the steps are the same. The cybercriminals will search for an exchange that offers VVS services and then check the transaction volume in terms of dollars. For example, if an exchange with millions of dollars in monthly transactions offers VVS services, it’s more likely to be targeted by criminals.
Once they identify an exchange that they believe can be exploited, they will conduct a background check on the company by obtaining information on their domain name registration data and corporate filings. They will also look for any online references and social media posts from employees or executives from the company. With this information, they can identify which executives to target as well as what their email address would be. From here, they can search for a way to contact the individual by phone or email and get them to send their credentials to a phishing site that looks like it’s from the exchange (see figure 1).
Figure 1: An illustration depicting how cybercriminals target exchanges with VVS services
How do Cryptojackers Extract Value from VVS Scales?
The first step in these scams is often the creation of a VVS service that mimics the verification and liquidation services offered by legitimate exchanges. Once they have created this fake service, cybercriminals will contact users who have stored their cryptocurrencies on an exchange and extort them for fees to access their accounts.
The primary way cryptojackers extract value from these services is by requesting high amounts of cryptocurrency for minimal fees. For example, one popular scam asks for a fee of $50 or less in order to withdraw cryptocurrency from your account. While this sounds like a fair deal at first glance, calculating the equivalent amount in U.S dollars is not as easy as it may seem. It’s important to consider factors such as the difficulty of converting into fiat currency, price fluctuations, and transaction costs when determining how much money you are actually paying for access to your coins. This scam can often result in victims losing hundreds or thousands of dollars worth of cryptocurrency assets without any additional verification or service provided by the VVS service.
Wrapping Up: Mitigating the Threat of VVS Scales
As the cryptocurrency market continues to grow, cybercriminals are adapting and evolving their tactics. One of the most effective types of tactics cybercriminals have used is using fake verifier services created by them and then extorting users for a fee.
This blog discusses some ways that companies can prevent themselves from falling victim to this type of attack. The blog post discusses precautions companies can take to help avoid or mitigate the risk of being targeted by VVS scales:
1) Ensure that your company’s KYC/AML policies are in place and up-to-date;
2) Restrict access to your company’s exchange account using 2FA and multi-factor authentication;
3) Always report any suspicious activity on your cryptocurrency exchange immediately;
4) Enable full two-way verification (2FA), which requires both yourself AND the person providing you with a service, such as a vendor or customer, to verify each transaction.
Hypernet Labs has developed a crypto-mining scale that is able to identify targets as they are mining cryptocurrency. This process is called cryptojacking, where hackers are able to use a computer processor to mine cryptocurrency in the process of visiting a website. Along with the cost to the user, it can also potentially cause the computer processor to overheat and potentially damage the computer.
This scale can identify that an individual is using their computer for cryptojacking and will not allow them to use the device. The scale also prevents users from mining any cryptocurrency, which is a large problem in the mining industry. This scale is designed to mitigate the threat of VVS scales and prevent them from affecting users negatively.By identifying users and preventing them from mining any cryptocurrency, Hypernet Labs has created a scale that will prevent VVS scales from affecting users negatively.