In the first six months of 2022, Web3 projects have lost more than $2 billion to hacks and exploits -- more than all of 2021 combined. The Verge reports: That's according to research from blockchain auditing and security company CertiK, which on Thursday released its quarterly Web3 security report covering Q2 of this year. The report paints a sobering picture of a cryptocurrency space still plagued by hacks, scams, and phishing schemes while also facing relatively new threats like flash loan attacks. CertiK puts particular focus on this last category of threat, which has been created by the invention of flash loans: a decentralized finance mechanism that lets borrowers access extremely large amounts of cryptocurrency for very short periods of time. If used maliciously, flash loans can be used to manipulate the value of a certain token on exchanges or buy up all of the governance tokens in a project and vote to withdraw all of the funds, as happened to Beanstalk in April.

In total, CertiK's report claims that a total of $308 million was lost across 27 flash loan attacks in Q2 2022 -- an enormous increase compared to just $14 million lost to flash loans in Q1. Phishing attacks also increased in frequency between Q1 and Q2 of this year, with CertiK recording 290 in the most recent quarter compared with 106 in the first three months of the year. Discord was the vector for the vast majority of phishing attempts, a signal of its continuing popularity as the social network of choice for the cryptocurrency and NFT scene, despite ongoing security concerns. CertiK also found that so-called "rug pulls" -- where the founders of a project halt development and abscond with the funds -- were down 16.5 percent from the previous quarter.

An anonymous reader quotes a report from The Block: Ronin, the Ethereum-linked sidechain that underpins play-to-earn game Axie Infinity, lost $540 million in crypto to an exploit in March. While the US government later tied the incident to North Korean hacking group Lazarus, full details of how the exploit was carried out have not been disclosed. The Block can now reveal that a fake job ad was Ronin's undoing. According to two people with direct knowledge of the matter, who were granted anonymity due to the sensitive nature of the incident, a senior engineer at Axie Infinity was duped into applying for a job at a company that, in reality, did not exist.

Earlier this year, staff at Axie Infinity developer Sky Mavis were approached by people purporting to represent the fake company and encouraged to apply for jobs, according to the people familiar with the matter. One source added that the approaches were made through the professional networking site LinkedIn. After what one source described as multiple rounds of interviews, a Sky Mavis engineer was offered a job with an extremely generous compensation package. The fake "offer" was delivered in the form of a PDF document, which the engineer downloaded -- allowing spyware to infiltrate Ronin's systems. From there, hackers were able to attack and take over four out of nine validators on the Ronin network -- leaving them just one validator short of total control. [...]

In its post-mortem, Sky Mavis revealed that the hackers managed to use the Axie DAO (Decentralized Autonomous Organization) -- a group set up to support the gaming ecosystem -- to complete the heist. Sky Mavis had asked the DAO for help dealing with a heavy transaction load in November 2021. [...] A month after the hack, Sky Mavis had increased the number of its validator nodes to 11, and said in the blog post that its long-term goal was to have more than 100. Sky Mavis declined to comment on how the hack was carried out when reached. Earlier today, ESET Research published an investigation showing that North Korea's Lazarus had abused LinkedIn and WhatsApp by posing as recruiters to target aerospace and defense contractors. But the report did not tie that technique to the Sky Mavis hack. The Block notes that Axie Infinity "boasted 2.7 million daily active users and $214 million in weekly trading volume for its in-game NFTs in November last year -- although both numbers have since plummeted."

Users affected by the exploit will be reimbursed via the company's funds, along with the $150 million it raised in a round led by Binance in early April. "The company said recently that it would begin returning funds to users on June 28," adds the report.

What is likely one of history's largest heists of personal data -- and the largest known cybersecurity breach in China -- occurred because of a common vulnerability that left the data open for the taking on the internet, say cybersecurity experts who discovered the security flaw earlier this year. WSJ: The Shanghai police records -- containing the names, government ID numbers, phone numbers and incident reports of nearly 1 billion Chinese citizens -- were stored securely, according to the cybersecurity experts. But a dashboard for managing and accessing the data was set up on a public web address and left open without a password, which allowed anyone with relatively basic technical knowledge to waltz in and copy or steal the trove of information, they said. "That they would leave this much data exposed is insane," said Vinny Troia, founder of dark web intelligence firm Shadowbyte, which scans the web for unsecured databases and found the Shanghai police database in January.

The database stayed exposed for more than a year, from April 2021 through the middle of last month, when its data was suddenly wiped clean and replaced with a ransom note for the Shanghai police to discover, according to Bob Diachenko, owner of the cybersecurity research firm SecurityDiscovery, which similarly found the database -- and later the note -- through its periodic web scans earlier this year. "your_data_is_safe," the ransom note read, according to screenshots provided by Mr. Diachenko. "contact_for_your_data...recovery10btc," meaning the data would be returned for 10 bitcoin, roughly $200,000. The ransom amount matches the price that an anonymous user began asking for last Thursday on an online cybercrime forum in exchange for access to a database the user claimed contained billions of records of Chinese citizens' information stolen from a Shanghai national police database.

Crypto broker Voyager Digital has filed for bankruptcy protection, days after suspending all trading and withdrawals on its service. From a report: Voyager announced late Tuesday that it had filed for Chapter 11 bankruptcy in New York federal court. The company said prolonged volatility in the crypto markets and the default by Three Arrows Capital on a $666 million loan from Voyager required decisive action. "This comprehensive reorganization is the best way to protect assets on the platform and maximize value for all stakeholders, including customers," Voyager CEO Stephen Ehrlich said in a statement. Three Arrows, a crypto hedge fund also known as 3AC, has itself filed for bankruptcy after being ordered to liquidate by a court in the British Virgin Islands. Three Arrows had bet big on the Terra crypto ecosystem that collapsed in value in May when its stablecoin, UST, lost its peg to the dollar. The bankruptcy for Voyager comes despite Alameda Research, a crypto company run by Sam Bankman-Fried, extending two credit lines to the crypto broker: one for about $200 million and the other for about 15,000 bitcoin.

Vauld, a Singapore-headquartered crypto lending and exchange startup, has suspended withdrawals, trading and deposits on its eponymous platform with immediate effect as it navigates "financial challenges," it said Monday. From a report: The three-year-old startup -- which counts Peter Thiel-backed Valar Ventures, Coinbase Ventures and Pantera Capital among its backers and has raised about $27 million -- said it is facing financial challenges amid the market downturn, which it said has prompted customer withdrawals of about $198 million since June 12. Vauld enables customers to earn what it claims to be the "industry's highest interest rates on major cryptocurrencies." On its website, Vauld says it offers 12.68% annual yields on staking several so-called stablecoins including USDC and BUSD and 6.7% on Bitcoin and Ethereum tokens.

A hacker has claimed to have procured a trove of personal information from the Shanghai police on one billion Chinese citizens, which tech experts say, if true, would be one of the biggest data breaches in history. From a report: The anonymous internet user, identified as "ChinaDan," posted on hacker forum Breach Forums last week offering to sell the more than 23 terabytes (TB) of data for 10 bitcoin BTC=, equivalent to about $200,000. "In 2022, the Shanghai National Police (SHGA) database was leaked. This database contains many TB of data and information on Billions of Chinese citizen," the post said. "Databases contain information on 1 Billion Chinese national residents and several billion case records, including: name, address, birthplace, national ID number, mobile number, all crime/case details." Reuters was unable to verify the authenticity of the post. The Shanghai government and police department did not respond to requests for comment on Monday.

The British army is "investigating an apparent hack," reports Engadget, after its official Twitter and YouTube accounts were compromised Sunday: News of the breach was first reported by Web3 is Going Great . According to the blog, both accounts were simultaneously compromised to promote two different cryptocurrency scams.

Although it has since been scrubbed, the army's verified Twitter account was briefly changed to look like a page for The Possessed, a project involving a collection of 10,000 animated NFTs with a price floor of 0.58 Ethereum (approximately $1,063). During that time, the account tweeted out multiple links to a fake minting website....

Over on YouTube, the army's channel [had] been made to look like a page for Ark Invest...livestreaming videos that repurpose old footage of Elon Musk, Jack Dorsey and Ark CEO Katie Wood discussing cryptocurrency. The clips feature an overlay promoting "double your money" Bitcoin and Ethereum scams. According to Web3 is Going Great, a similar scheme netted scammers $1.3 million this past May. It's unclear who is behind the attacks.

What exactly happened after El Salvador president Nayib Bukele made Bitcoin a legal tender for the country? "As Bitcoin has dropped more than 50 percent of its value this year, there have been suggestions that El Salvador's investment has pushed the country to the brink of bankruptcy," writes a Salvadoran political/human rights journalist in the New York Times.

"However, implying that the country's risk of default derives from the crypto-enthusiasm is wrong: The economic turmoil preceded and is bigger than that." The article notes that prior to their move into Bitcoin, "the Salvadoran economy was already stretched. Total debt amounted to about 90 percent of G.D.P., a large chunk of which had been accumulated by prior administrations or spurred by pandemic-related expenses."

But what are we missing with this focus on Bitcoin? Mr. Bukele has weaponized Bitcoin to whitewash his government's growing authoritarianism on the world stage. By spreading his propaganda, Bitcoin believers are promoting a product — and lining their pockets — at the expense of our rights and livelihoods.... Over the past three months, the government has used a state of emergency to imprison almost 40,000 people, often without defense. Mr. Bukele has begun to crack down on press freedom, through a gag law that prohibits reproducing messages from gangs and his government hasn't investigated the illegal use of Pegasus spyware to monitor dozens of journalists who cover El Salvador, including me, from independent news outlets between 2020 and 2021. Reporters have already fled the country, fearing reprisal for doing their jobs....

It's pretty obvious to anyone who visits any place in El Salvador other than its beaches that Mr. Bukele is not building a techno-utopia; he's building a run-of-the-mill authoritarian state in a tech disguise. Bitcoiners would do well to remember that when they cheer for Mr. Bukele, they're not ushering in the technology of the future; they're enabling a regime that's violating the human rights of its citizens. After all, the economic freedom Bitcoin promises is worth nothing to Salvadorans if it's the only freedom we can hope to have.
But even ignoring human rights issues — the Bitcoin experiment remains unpopular in El Salvador: Remittances account for more than 20 percent of El Salvador's G.D.P., because of a large diaspora mainly based in the United States. But, according to the Central Bank of El Salvador, only 1.5 percent of remittances went through digital wallets in April, which shows Salvadorans haven't gotten onboard with Bitcoin despite the promise of needed savings. And Mr. Bukele's plan for selling his Bitcoin bonds has stalled.

Just one year into Mr. Bukele's Bitcoin experiment, average Salvadorans can tell that Bitcoin isn't working for them. In May, a national poll showed that 71 percent of Salvadorans said they didn't see any benefit from the law for their family economy. Another found that about two of every 10 Salvadorans support the decision to adopt Bitcoin. Those Salvadorans haven't adopted the currency. A paper published in April by the National Bureau of Economic Research concludes that "despite the legal tender status of Bitcoin and the large incentives implemented by the government, the cryptocurrency is largely not an accepted medium of exchange in El Salvador...." A December national poll showed that only about 11 percent of respondents believed the main beneficiaries of the Bitcoin law are the people, while about 80 percent believed it's either the rich, foreign investors, banks, businesspeople or the government.

Slashdot reader thegarbz writes: In 2019 Maastricht University in the Netherlands was hit with a ransomware attack which locked 25,000 staff and students out of their research data. The university agreed to pay a ransom of €200,000 to unlock the encrypted data, reports German broadcaster DW. It seems that a small part of the ransom has been recovered, but with a twist.

A university official said the money will go into "a fund to help financially strapped students."

An anonymous reader shares this report from NBC News: A controversial bitcoin mining operation on the largest of central New York's Finger Lakes does not meet the requirements of state climate laws, New York's Department of Environmental Conservation ruled Thursday, denying an air permit request the entity's owner, Greenidge Generation LLC., made in March 2021.

Renewing the air permit for the Greenidge facility on Seneca Lake "would be inconsistent with or would interfere with the attainment of statewide greenhouse gas emission limits," the Department of Environmental Conservation, or DEC, said in its ruling. It added that the company, which burns natural gas at its plant, has "failed to demonstrate that the continued operation of the facility is justified notwithstanding this inconsistency, as it has not provided any electric system reliability or other ongoing need for the facility." Greenhouse gas emissions from the plant have increased "dramatically" since a previous permit was issued to Greenidge in 2016 and after the 2019 enactment of New York's Climate Leadership and Community Protection Act, DEC said.

Local residents and environmental groups lauded the decision. Greenidge said it would continue to operate the plant under its current permit while it challenged the DEC ruling....

Greenidge took over a mothballed power plant on the shores of Seneca Lake in 2014 and requested permits to operate it as a so-called peaker plant, providing electricity to the grid in times of heavy use. While the operation initially supplied most of its power to the grid, DEC found its main purpose has become bitcoin mining.
The article adds that the global usage of electricity for bitcoin mining "roughly equals the consumption of Pakistan, according to the University of Cambridge Bitcoin Electricity Consumption Index."

The EU has moved to rein in the "wild west" of crypto assets by agreeing a groundbreaking set of rules for the sector, adding to pressure on the UK and US to introduce their own curbs. From a report: Representatives from the European parliament and EU states inked an agreement late on Thursday that contains measures to guard against market abuse and manipulation, as well as requiring that crypto firms provide details of the environmental impact of their assets. "Today, we put order in the wild west of crypto assets and set clear rules for a harmonised market," said Stefan Berger, the German MEP who led negotiations on behalf of the parliament. Referring to the recent slump in cryptocurrency prices -- the total value of the market has fallen from $3tn last year to less than $900bn -- Berger added: "The recent fall in the value of digital currencies shows us how highly risky and speculative they are and that it is fundamental to act." The markets in crypto assets (MiCA) law is expected to come into force at about the end of 2023. Globally, crypto assets are largely unregulated, with national operators in the EU required only to show controls for combating money laundering.

A Wednesday meeting secured a final deal on anti-money laundering legislation for crypto transfers and largely overturned a proposal from the EU Parliament to impose laundering checks on all payments to private wallets. CoinDesk reports: The final proposals will mean customer identity needs to be verified for even the smallest crypto transfers, if it's between two regulated digital wallet providers -- but payments to unhosted private wallets will largely be left out of laundering checks. EU lawmakers and government representatives have been meeting over the last three months to hash out a political deal on the bill, which was introduced in July 2021 by the European Commission. Two sources leaving the meeting, who asked not to be named, told CoinDesk a deal had been reached on the legislation after just over an hour of talks.

Just under an hour following the publication of this article, EU lawmaker Ondrej Kovarik confirmed the provisional deal in a tweet, saying that it "strikes the right balance in mitigating risks for fighting money laundering in the crypto sector without preventing innovation and overburdening businesses." Outside the meeting room, Kovarik told CoinDesk that negotiators had found a "good balance" that would not prevent innovation. "It will allow the further development of crypto in Europe," Kovarik said.

For the rules on transfers to unhosted wallets, Kovarik said the final result had "moved quite far from the initial proposal of the European Parliament" -- something likely to be met by a sigh of relief by many in the industry. Kovarik said those unhosted wallet rules would only apply when transfers were made to a person's own private wallet, and only when the value was over 1,000 euros ($1,052). [...] Lawmakers and governments overturned European Commission plans to exempt small transactions, arguing that price volatility and the ability to break up payments into smaller chunks would make it unworkable for crypto. Further reading: Crypto Rules To Make Europe a Global Leader As Prices Plunge (The Associated Press)

A British Virgin Islands court ordered the liquidation of Three Arrows Capital, the crypto hedge fund that bet big on everything from Bitcoin to the ill-fated Luna tokens and then succumbed to a $2 trillion wipeout of the digital-asset markets. From a report: The court, which made the order on Monday, has appointed two partners at consulting and advisory firm Teneo to handle the liquidation, according to a person familiar with the matter, who declined to be identified because the information is confidential. Teneo will oversee talks with potential buyers that may be interested in Three Arrows's remaining holdings, such as tokens or equity stakes in crypto startups, the person added. A website will be set up to locate creditors and determine who is owed what. Three Arrows has invested in a range of decentralized finance platforms such as Aave and dYdX, as well as crypto infrastructure firms such as StarkWare, according to its website. It's not immediately clear what or how much of these holdings will be subject to a sale.

The chairman of the U.S. Securities and Exchange Commission (SEC), Gary Gensler, said on CNBC's Squawk Box that the only token he would lump in with commodities was bitcoin. From a report: Gensler pointedly declined to name any cryptocurrency other than the original one, notable because the market has been operating under the assumption that there is a sort of wink-and-nod understanding that ether is also not a security. "Many of these financial assets, crypto assets, have the key attributes of a security... some like bitcoin, and that's the only one, Jim, I'm going to say, because I'm not going to talk about any of these tokens, my predecessors and others have said they're a commodity," Gensler said. He made the comment as he discussed the importance of collaborating with the Commodity Futures Trading Commission (CFTC).

Russian lawmakers on Tuesday approved a draft law that would potentially exempt issuers of digital assets and cryptocurrencies from value-added tax. Reuters reports: Unprecedented Western sanctions have hit the heart of Russia's financial system over events in Ukraine and lawmakers have scrabbled to bring in new legislation to soften the blow. The draft law, approved by State Duma members in the second and third readings on Tuesday, envisages exemptions on value-added tax for issuers of digital assets and information systems operators involved in their issue. It also establishes tax rates on income earned from the sale of digital assets.

The current rate on transactions is 20%, the same as for standard assets. Under the new law, the tax would be 13% for Russian companies and 15% for foreign ones. The draft must still be reviewed by the upper house and signed by President Vladimir Putin to become law.

An anonymous reader quotes a report from TechCrunch: The House Committee on Financial Services released a report late last week offering a harrowing glimpse inside Robinhood during the frenzy around Gamestop stock early last year. The stock trading and investing app was blindsided by the surge in interest from the first big "meme stock" after Redditors and other retail investors rallied around $GME and sent its price into the stratosphere. For Robinhood, which offers individual investors a relatively frictionless way to dive into the stock market, the saga was simultaneously a massive windfall of new users and brand interest and an existential threat that almost did the company in.

House Financial Services Committee Chairwoman Maxine Waters (D-CA) called for a deep dive into what happened behind closed doors, and the new report, "Game Stopped: How the Meme Stock Market Event Exposed Troubling Business Practices, Inadequate Risk Management, and the Need for Regulatory and Legislative Reform," collects the committee's findings. The report, embedded below, is culled from a number of hearings, 95,000 pages of documents and 50 interviews. "My Committee's investigation into the matter showed we need better market regulation to address the troubling business practices that were uncovered during our investigation," Waters said. "Payment for order flow and gamification make it profitable for a new generation of trading apps to push retail investors to make as many trades as possible, making the markets more volatile than ever."

The committee described Robinhood's business as "troubling," citing its preference for aggressive growth without adequate risk management. The report also found that the majority of financial firms the committee examined don't have any plans in place to prepare for another risky phase of "extreme" market volatility. According to the report: "On the morning of January 28, 2021, Robinhood had approximately $696 million in collateral already on deposit with the NSCC, leaving it with a collateral deficit of approximately $3 billion, which it was required to post to satisfy the NSCC's clearing fund requirement or risk being in violation of the NSCC's rules and potentially losing the ability to clear trades for their customers altogether. [President and Chief Operating Officer for Robinhood's clearing operation] Swartwout confirmed that this amount came as a surprise to Robinhood and explained to Committee staff that they had anticipated and prepared for the $1.4 billion of collateral deposit requirements that represent 'core' charges, but because they did not model for Excess Capital Premium charges, Robinhood therefore did not expect and had not arranged adequate funding for the additional $2.2 billion Excess Capital Premium charge. On the morning of January 28, 2021, Jim Swartwout texted Gretchen Howard at 6:29 a.m. EST, writing 'Huge liquidity issue.'" "Ultimately, the company secured a waiver for its collateral requirements, paused some trades and averted disaster but there's no guarantee that history won't repeat itself and shake out a different way," concludes the report. "In light of the report, Waters called for 'significant' legislative reforms to prevent another Robinhood-style near-meltdown."

Further reading: FTX Exploring a Deal To Buy Robinhood

According to Bloomberg, the cryptocurrency exchange FTX is reportedly considering a deal to acquire digital trading platform Robinhood. From a report: Robinhood has not yet received a formal notice from FTX of any such takeover, the report said, while adding that FTX could ultimately choose not to pursue a purchase. The report of a potential acquisition by FTX comes just over a month after Sam Bankman-Fried, the CEO and founder of FTX, disclosed a 7.6% stake in Robinhood, paying $648 million at the time. As of Monday's close, this position was worth closer to $513 million. In a statement to Yahoo Finance following this report, Bankman-Fried said: "We are excited about Robinhood's business prospects and potential ways we could partner with them, and I have always been impressed by the business that Vlad and his team have built. That being said there are no active M&A conversations with Robinhood."

In recent days, Bankman-Fried's companies -- FTX and Alameda Research -- have offered loans to crypto firms in rough financial straits, with some likening his actions to those of Warren Buffett's during the Financial Crisis. Bankman-Fried's crypto exchange FTX offered crypto lender BlockFi a $250 million line of credit. Meanwhile, the 30-year old billionaire's trading firm, Alameda Research, has given Canadian crypto exchange Voyager a total line of credit in cash and crypto equal to more than $500 million. Similar to what Binance's founder, Changpeng Zhao, told Yahoo Finance, Bankman-Fried's actions could be interpreted both as a profit-making opportunity and a way to squash contagion in a sector where firms remain deeply intertwined in their financial dealings.

Prominent crypto hedge fund Three Arrows Capital has defaulted on a loan worth more than $670 million. Digital asset brokerage Voyager Digital issued a notice on Monday morning, stating that the fund failed to repay a loan of $350 million in the U.S. dollar-pegged stablecoin, USDC, and 15,250 bitcoin, worth about $323 million at today's prices. From a report: 3AC's solvency crunch comes after weeks of turmoil in the crypto market, which has erased hundreds of billions of dollars in value. Bitcoin and ether are both trading slightly lower in the last 24 hours, though well off their all-time highs. Meanwhile, the overall crypto market cap sits at about $950 billion, down from around $3 trillion at its peak in Nov. 2021. Voyager said it intends to pursue recovery from 3AC (Three Arrows Capital). In the interim, the broker emphasized that the platform continues to operate and fulfill customer orders and withdrawals. That assurance is likely an attempt to contain fear of contagion through the wider crypto ecosystem. "We are working diligently and expeditiously to strengthen our balance sheet and pursuing options so we can continue to meet customer liquidity demands," said Voyager CEO Stephen Ehrlich.

Austria-based crypto trading platform Bitpanda is slashing its headcount to ensure sustainability, the company said in a Friday blog post. CoinDesk reports: Bitpanda's founders said the firm needs to let employees go as it scales down due to market conditions. The company said it is aiming for a target headcount of 730. It has just over 1,000 employees, according to LinkedIn.

"We reached a point where more people joining didn't make us more effective, but created coordination overheads instead, particularly in this new market reality," Bitpanda wrote. "Looking back now, we realize that our hiring speed was not sustainable. That was a mistake." In addition, recent offers will be retracted, and employees have been notified.

Goldman Sachs is looking to raise $2 billion from investors to buy up distressed assets from troubled crypto lender Celsius, according to two people familiar with the matter. CoinDesk reports: The proposed deal would allow investors to buy up Celsius' assets at potentially big discounts in the event of a bankruptcy filing, the people said. Goldman Sachs appears to be gauging interest and soliciting commitments from Web3 crypto funds, funds specializing in distressed assets and traditional financial institutions with ample cash on hand, according to a person familiar with the situation. The assets, most likely cryptocurrencies having to be sold on the cheap, would then likely be managed by participants in the fundraising push. Celsius has tapped restructuring advisory firm Alvarez & Marsal, the Wall Street Journal reported Friday afternoon. Earlier this month, Celsius abruptly paused withdrawals, swaps, and transfers between accounts, citing "extreme market conditions." The disclosure sent bitcoin's price below $20,000 and prompted the firm's token to take a 60% tumble.

As of Monday, the company said it's still working on "stabilizing [their] liquidity and operations."