Cybercriminals Hold $115,000-Prize Contest to Find New Cryptocurrency Hacks

A top Russian-language underground forum has been running a
“contest” for the past month, calling on its community to submit
“unorthodox” ways to conduct cryptocurrency attacks.

The forum’s administrator, in an announcement made on April 20,
2021, invited members to submit papers that assess the possibility
of targeting cryptocurrency-related technology, including the theft
of private keys and wallets, in addition to covering unusual
cryptocurrency mining software, smart contracts, and non-fungible
tokens (NFTs).

The contest^[1], which is likely to
continue till September 1, will see total prize money of $115,000
awarded to the best research.

“So far, the top candidates (according to forum member voting)
include topics like generating a fake blockchain front-end website
that captures sensitive information such as private keys and
balances, creating a new cryptocurrency blockchain from scratch,
increasing the hash rate speed of mining farms and botnets, and
demonstrating a custom tool that parses logs for cryptocurrency
artifacts from victim machines,” said Michael DeBolt, Intel 471’s
Senior Vice President of Global Intelligence, in an email interview
with The Hacker News.

Other entries looked at manipulating APIs from popular
cryptocurrency-related services or decentralized-file technology to
obtain private keys to cryptocurrency wallets as well as creating a
phishing website that allowed criminals to harvest keys to
cryptocurrency wallets and their seed phrases.

With underground marketplaces like Hydra^[2]
enabling cybercrime groups to cash out their cryptocurrency haul,
submissions that could be of use to Ransomware-as-a-Service (RaaS)
operators in order to step up the pressure and force their victims
into heeding to their ransom demands is likely to gain huge
attention. But DeBolt noted that most entries so far have been
about instructions or tools for how to plunder cryptocurrency
assets, which is not likely going to be of “immediate significant
value” to RaaS cartels.

Although other instances of incentivized contests involving
topics like mobile OS botnets, ATM and point-of-sale (PoS)
exploits, and fake GPS signals have been observed before in the
cybercrime underground, the development is yet another indication
that criminals are increasingly exploring cutting-edge techniques
to meet their financial motives.

“The biggest takeaway from the adversary side is that this type
of incentivized knowledge-sharing bolsters the already
interconnected and interdependent cybercrime underground by
consolidating illicit resources in one place and making it easier
for like-minded criminals who want to pursue cryptocurrency hacks
by giving them a platform to collaborate, discuss and share ideas,”
DeBolt said.

“Conversely, the biggest takeaway from the defender side is that
we can take advantage of these open contests, to gain an
understanding of current and emerging methodologies and tactics
that we can prepare for. It illuminates things for us and helps to
level the playing field,” he added.