The US Federal Bureau of Investigation (FBI) has warned investors that cybercriminals are “increasingly exploiting vulnerabilities” on the decentralised finance (DeFi) platforms in an attempt to steal cryptocurrency.
In its PSA released this week, the FBI attributes vulnerabilities in smart contracts that govern the decentralised exchanges as the primary exploit for hackers to conduct crypto theft.
“Cyber criminals seek to take advantage of investors’ increased interest in cryptocurrencies, as well as the complexity of cross-chain functionality and open-source nature of DeFi platforms,” said the FBI.
What's more, the agency has recommended that all DeFi platforms improve their security measures in light of the ongoing threats.
The #FBI warns that cyber criminals are increasingly exploiting vulnerabilities in decentralized finance (DeFi) platforms to steal investors cryptocurrency. If you think you are the victim of this, contact your local FBI field office or IC3. Learn more: https://t.co/fboL1N17JN pic.twitter.com/VKdbpbmEU1
— FBI (@FBI) August 29, 2022
DeFi – crypto’s wild west
The DeFi systems allow for financial products to become available on a public, decentralised blockchain network avoiding intermediaries such as banks or brokerages.
These markets are considered the wild west of the crypto world, where lack of regulation and promise of higher returns have attracted a mixed bag of traders.
Between January and March 2022, cybercriminals stole $1.3 billion in cryptocurrencies, almost 97% of which was stolen from DeFi platforms, according to the US blockchain analysis firm Chainalysis.
Alarmingly, this is an increase from 72% in 2021 and 30% in 2020.
Criminals generally exploit DeFi platforms by initiating a flash loan vulnerability, exploiting signature verification or by manipulating trading pairs, the FBI said.
To this effect, the agency asked investors to do their due diligence while using DeFi platforms and use platforms that have conducted audits or been around for some time.
Read: Decentralised Exchanges – The 'Wild West' of the crypto world
Exercising safety on DeFi
Here are some top tips to consider as you venture into the world of crypto investments:
Read: How to not get scammed on the crypto market
CeFi vs DeFi
Choosing which platform you are going to operate in is a crucial first step when becoming a crypto trader.
Centralised Finance (CeFi) platforms like Binance and Coinbase would be the safest bet to start trading, as they are simpler and come with a more regulated setting.
However, centralisation also means a single point of failure: crypto exchanges are known for becoming victims of hacks as well.
Regardless, it is always recommended to consider cold storage (that's taking things offline) when it comes to your crypto assets.
Check credentials of developers
If the developers are anonymous or have a pseudonym –– it’s a red flag.
You should be able to look up the developers, their credentials and past projects. If that information doesn’t add up, stay away.
It is also very interesting to note that Satoshi Nakamoto, the creator of Bitcoin, is a pseudonym.
Social media and telegram participation
Most cryptos will have an active telegram group, Reddit page and even social media handles.
New coin developers face a lot of scrutiny on social media, answering all queries from prospective investors and keeping a healthy online presence is a strong indicator of a legitimate token.
On the flip side, scam coin developers are notorious for removing anyone from groups for asking too many questions.
Auditing smart contracts
It's always good to check if the cryptocurrency is audited by a reputed third-party organisation.
An external audit is a good indicator of the smart contract soundness but not necessarily of the project’s soundness.
Check if smart contracts have a time lock to avoid rug pull, while smart contacts for scam coins will not have a lock.
Also, a good rule of thumb: if the white paper is bogus, the coin is bogus.
The FBI recommends to: “Research DeFi platforms, protocols and smart contracts before investing and be aware of the specific risks involved in DeFi investments.
“Ensure the DeFi investment platform has conducted one or more code audits performed by independent auditors.
“A code audit typically involves a thorough review and analysis of the platform’s underlying code to identify vulnerabilities or weaknesses in the code that could negatively impact the platform’s performance.”
Trial investment
Invest a very small amount and then try to pull it out.
Scam coins may modify their smart contracts, making it impossible to withdraw funds.
Token distribution
Finally, using a token explorer, check the distribution of the token.
FBI adds: “Be alert to DeFi investment pools with extremely limited timeframes to join and rapid deployment of smart contracts, especially without the recommended code audit.
“Be aware of the potential risk posed by crowdsourced solutions to vulnerability identification and patching.
“Open source code repositories allow unfettered access to all individuals, to include those with nefarious intentions.”
If the token distribution is limited to a few wallets, and if the token is only listed on DEX platforms — stay away.