KIEŁTYKA GŁADKOWSKI KG LEGAL constantly supervises and prepares its lawyers for the specialization in which they provide services for foreign clients. In order to systematize the conceptual grid of very specialized fields of IT, telecommunications, biology, medicine and modern finance, KIEŁTYKA GŁADKOWSKI conducts internal consultations to improve the experience of our lawyers specializing in legal assistance for foreign clients from the IT and TECH sector. As a result of such internal research, KIEŁTYKA GŁADKOWSKI creates and publishes texts on topics related to modern legal problems, but also to explain the basic concepts of specialized IT and pharmaceutical fields. In this way, KIEŁTYKA GŁADKOWSKI aims to demonstrate to potential clients within specialized industries that our lawyers are also familiar with specialist terms necessary for a proper understanding of our foreign client’s business and legal needs.

This is one of those texts. We invite you to read it.

How to get a cryptocurrency?

Cryptocurrency is not emitted by some central, national bank as it happens with classical form of money (fiat money). Cryptocurrency is made in a digital sphere and the only way to obtain the currency from the blockchain system is to mine it (similarly and metaphorically to the gold mining). Cryptocurrency mining works similarly to the gold mining. Virtual coins can be discovered digitally using computer programs. The Bitcoin, for instance, has set a limit of total of 21 million bitcoins. Thus the faster you dig bitcoins the more of them you will have (if we consider only mining). All bitcoins are lying within the blockchains system and the role of the computer program and the miners is to dig it from that system, precisely to discover it in that system. Thereby there can be one miner or a clubbed miners’ group who dig together, faster and more effectively and then they divide their profits among each other.

What is a mining pool?

Considering the way of digging bitcoin mentioned above, the idea of mining will be more clear and understandable, because it is based on the simple principle the more the better. Working together group of miners increase their chances of findings block at the group level, compared to the individual level. In a pool miner combines their computational resources with those of the other members. If the mining pool is successful and receives a reward, that reward is divided among participants in the pool.

To draw an analogy, a gold digger having the capacity to dig 100 square meters of land in one day will take 100 days to explore one hectare of land for gold. Combining 100 gold diggers can complete the job in just 1 day. The discovered gold can be split among all 100 diggers evenly, assuming all have put in equal effort to explore their assigned portions of land.[1]

How a mining pool works?

Every miner (a participant in the mining pool group) individually contributes their processing power toward the effort of finding block (processing power of their computer). If miners find a block, the pool is successful in their efforts, miner receives a reward (a divided part of found block). Rewards (a divided form of found cryptocurrency) is divided between the individuals who contributed, according to the proportion of each miner’s processing power of work relative to the entire group (there are 2 kind of shares – accepted and rejected, the reward is granted based on the accepted shares.

What are the advantages of mining pool?

• Mining pools offer individuals a more scalable method of participation in the crypto mining.
• In the pool by combining computing power, miners can achieve higher success.
• The success in mining pool does not require acquiring more mining rings or paying more for electricity to achieve higher success rate.
• A large mining pool has a potential to centralize the mining sector.

What are the disadvantages of mining pool?

• Individual miner gives up some of their autonomy to the group in the mining process.
• The group dictates the mining process approach.
• The potential reward is necessarily divided.
• Small number of mining pools dominate the cryptocurrency (especially Bitcoin) mining process (an advantage of centralization).

What are the examples of mining pools?

As we mentioned above there can be a pool consisting of 2 miners or it can be a huge company with their own mining process sector. Thus the examples encompasses such big commercial entities as BTC.com, AntPool. Poolin, F2Pool and anyone with professional computer.

What are other detailed information?

Risk type: Usually low.

Possible exploit: Most are one-way but some accept deposits – and it could enable laundering (but now in force there are legal provisions regulating the anti- money laundering crime in the cryptocurrencies sector, e.g. European Union’s regulations).

Emerging trends: Large corporation or mining pools dominate mining.

To see the biggest mining pools: https://www.buybitcoinworldwide.com/mining/pools/

Sources:

https://www.investopedia.com/terms/m/mining-pool.asp

https://www.investopedia.com/tech/how-do-mining-pools-work/

https://coinmarketcap.com/alexandria/article/what-is-pool-mining#toc-what-are-the-pros-and-cons-of-mining-pools-

https://www.buybitcoinworldwide.com/mining/pools/

[1] https://www.investopedia.com/tech/how-do-mining-pools-work/, (access date: 24^th August, 2021).

Artykuł MINING POOLS – How to get a cryptocurrency? pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

We usually associate the cryptocurrency environment with advanced security measures to secure financial resources. There are even companies that offer cryptocurrency holders advanced methods of securing their wealth through military technology. Nevertheless, the problem of theft is not a foreign topic in the cryptocurrency community.

The graph above shows the size of cryptocurrency theft over a period of 3 years. Different colors indicate different cases of cryptocurrency theft, while the black line shows the number of recorded incidents.

Almost all cases of cryptocurrency theft fall into one of the three theft categories. The categories mentioned are: Exchange attacks, attacks on individuals, DeFi exploits.

Exchange attacks

At this point, thieves have stolen billions of dollars worth of cryptocurrency by attacking exchange wallets. Many companies, including such large and respected companies as Bitpoint, Binance, DragonEx, have been the subject of keen interest from hackers. The question arises as to how hackers managed to break through such advanced security. One of the most common methods used by hackers is social engineering. A hacker typically tries to trick employees of a particular cryptocurrency security company’s customers into downloading special malware that will give them access to one or more accounts. If the attacker is sufficiently determined, he will wait for months or even longer, observing patterns of money inflows and outflows so that he can sense the right moment to steal as much money as possible. What does this look like in practice?  In one particularly audacious case, hackers set up a fake company, complete with website, social media presence and executive resumes.  On the fake website, the hackers posted that they had created an automated trading bot and sent out several messages to employees of the companies/exchanges asking them to download and try a free trial version. At least one of the recipients was tempted by the offer. As it later turned out, the “free trial” included malware that helped hackers obtain the keys to private cryptocurrency wallets of several users. Immediately after gaining access to these accounts, the hackers began siphoning funds from these wallets. Hacking activity is a major threat for exchanges.

Attacks on individuals

A more common method of theft than widespread exchange attacks are attacks on individual cryptocurrency holders, which are also mainly carried out through phishing or social engineering. Any available figures showing the size of this method are unreliable as many people do not report their cryptocurrency stolen. A phishing attack targeting the company “Ledger” was launched in 2020. The company “Ledger” is a popular provider of physical devices on which to store cryptocurrency. In July 2020, the company revealed that the email addresses of many users had been compromised in a data security breach. A few months later in October, Ledger customers reported receiving emails from a perfectly fake website, imitating the real “Ledger” company website.

The fake email, informed Ledger customers that their servers had been hacked with malware and that customer funds were at risk. The email further advised that in order to protect against theft, it was necessary to click on a link that was in the email. By clicking on the link, customers were supposed to download the latest version of Ledger’s software. Once they followed the link, a website appeared that perfectly mimicked Ledger’s website. However, the email and website were part of a sophisticated phishing attack. Instead of downloading an update to the software, Ledger users who clicked the link in the fake email downloaded malware that emptied their virtual wallet. Overall, the CoinTelegraph website reported that Ledger customers who downloaded the malware lost a total of 1.1 million XRP (approximately $645,000) in just the first week after the hackers launched their campaign. Finally, at the end of 2020, in the Key players in crypto report by Chainalysis, we learn that a total of over $3.5 million worth of cryptocurrency was stolen.

DeFi Exploits

In 2020, DeFi platforms experienced a fairly large increase in users using them. Unfortunately, along with the increase in interest, went an increase in hacking attacks. Although DeFi represents only 6% of all cryptocurrency activity, DeFi platforms lost over 33% of their cryptocurrency holdings and fell victim to half of all hacking attacks. Overall, cybercriminals stole over $170 million worth of cryptocurrency from DeFi by means of price manipulation.

This manipulation was the key to almost every significant attack on DeFi platforms in 2020. Due to the fact that transactions on DeFi take place almost instantaneously with very few mechanisms in place to prevent suspicious transactions. Therefore, any thieves can reap huge profits by manipulating cryptocurrency prices on one or more DeFi platforms. These platforms rely heavily on tools called price oracles to obtain asset valuation data from an external source in order to ensure that the said assets are valued in line with the rest of the market. Most DeFi platforms use centralised price oracles that rely on only one node to send data to the rest of the platform and often use a single source of pricing data, thus exposing themselves to attack.

At first glance, price manipulation may seem like an ineffective method of attack for cybercriminals, as raising the price of any crypto asset requires upfront capital. However, this works differently at DeFi, thanks to flash loans.

Flash loans allow DeFi users to enjoy a variety of benefits, such as: receiving loans instantly without posting collateral; using borrowed funds to make transactions elsewhere; and repaying the loan in one instant transaction. If these users do not repay the loan, the entire transaction is immediately reversed, meaning that the lender receives the original capital back as if the loan had never taken place. In effect, this means little or no risk for both parties. It also means that lenders can charge very low interest rates on flash loans. Traders often use flash loans to raise the funds needed to take advantage of arbitrage opportunities and thus use the borrowed funds to take advantage of price discrepancies between platforms, ultimately ending up with a small profit after the loan is repaid.

Examples

Nevertheless, in 2020, cybercriminals took advantage of flash loans. They used the borrowed funds to buy crypto assets, raise the price and sell at a high profit. In this way, they easily repaid the loan and raked in the remaining funds. This is exemplified by two hacking attacks that occurred in February 2020 against the so-called bZx, or DeFi protocol, which allows users to build applications for decentralised lending, margin trading and other financial activities. The first time, cybercriminals borrowed a large amount of a cryptocurrency called Ether from bZx as a flash loan, used it to buy and drive up the price of packaged Bitcoin on Uniswap – at one point, the packaged Bitcoin price on Uniswap reached 109.8 ETH, compared to 38 for the overall market. The hackers then exchanged the packaged bitcoins for pure profit in the form of Ether, some of which was used to repay the original flash loan. In total, the attacker netted $350,000 in Ether cryptocurrency. The second attack, is a copy of the first and made a profit of $633,000.

An example of this type of theft from 2021 is more spectacular. On 10 August 2021, DeFi’s platform “Poly Network” announced that it had fallen victim to a hacking attack and lost $600 million. The stolen assets included about $253m in tokens on the Binance Smart Chain, $266m in Ethereum tokens and $85m in USDCs on the Polygon network, according to cryptocurrency wallet addresses revealed by Poly.

Experts say the hacker was able to exploit a cryptography or network coding issue. To authorise the movement of funds, users sign using cryptographic signatures or a string of letters and numbers similar to a password. In this case, the hacker likely targeted a weakness in the cryptography that allowed him to sign for the transfer of assets.

Despite the technological progress and thus the increase in anti-hacking safeguards, thefts targeting cryptocurrency holders will only increase, because with the increase in safeguards, the methods of theft will develop.

Sources:

https://www.cnbc.com/2021/08/11/over-600-million-dollars-was-stolen-in-a-massive-defi-hack.html

https://www.cnbc.com/2021/08/11/cryptocurrency-theft-hackers-steal-600-million-in-poly-network-hack.html

https://www.ledger.com/

https://markets.chainalysis.com/  Chainalysis “Who is who in the Blockchain. Mapping the key players in the cryptocurrency ecosystem”

Artykuł Theft in the cryptocurrency environment pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.