A Scammer Robbed, Real Victims Betrayed Again -By Fransiscus Nanga Roka

A scammer losing their stolen crypto-currency to a different criminal may seem like justice. However, it’s just another crime. The individuals that first had their money stolen still don’t get paid back, and the criminals fight amongst each other for the loot.

On October 16, CoinDesk stated that Chainalysis had found a task scam operator as a victim of the hack of the Ledger hardware wallet. At that time, over 60 Bitcoin, which equaled about $4.8 million for Chainalysis, had been taken from these users. These scams would offer individuals money to do paid online tasks; however, when the individuals wanted to get their earnings back, the scammers required them to make a deposit first.

The irony cannot hide the fact that money obtained from employment candidates has been used by another criminal enterprise as its “loot.”

Ledger confirmed that there was a malicious device (implant) placed in one of the devices being distributed by Southeast Asia’s crypto-reseller CryptoBilis. According to Ledger’s technical analysis of the incident, the malicious device intercepted recovery words that were presented to the user during the initial device configuration process and transmitted these recovery words via a cellular connection. The attacker chose to target the route by which secrets were delivered to the user instead of having to demonstrate a compromise of the device’s secure chip.

In other words, that simple comparison points out how poor simplistic security claims can be. If you have an off line key, but your recovery phrase has been stolen through some type of malicious hardware, there is nothing that will keep it safe.

The same is true for other aspects of the investigation. While reports have referred to CryptoBilis as an authorized distributor of products from the manufacturer, labeling the distributor as unauthorized would be incorrect. The fact that the products were sold through the channel provided by CryptoBilis does not prove that CryptoBilis installed implants or was aware of the installation. Therefore, the investigators must determine when/where the product was tampered with and who knew about the tampering.

Loss estimates continue to be tentative. At the time of this writing, early reports showed loss estimates of approximately $86 million. Bitquery later reported that they estimated $102 million in losses across 335 wallets on six different blockchain networks. However, Bitquery specifically states in their report that blockchain records do not provide information about how each recovery phrase was compromised, nor did Ledger verify Bitquery’s estimated total. Although transaction tracing provides evidence of funds being moved from one address to another, it does not automatically prove that each individual device has been compromised.

The strategic response must address both thefts.

The first step is for law enforcement to create a joint investigation that links the original task-scam complaints to the hardware-wallet theft. This should include preserving all devices used by victims, purchasing records, shipping history, and digital evidence from the victims as well as establishing the proper chain of custody for each item. Additionally, law enforcement should seek out lawful preservation and/or freeze orders on any stolen assets that can be traced to a known third-party intermediary.

In addition, the process of recovery must place priority on those who have made a claim that is supported by evidence. It would be a second injustice if the court were to simply return the money to the person who committed the fraud. The courts need to decide which party owns what, the competing claims, and the amount of restitution that needs to be paid using a public process.

Thirdly, both manufacturers and distributors must have an independent evaluation of the controls that cover purchasing, returns, storage, and reselling. An authorization badge given by the seller will not be adequate unless there are verifiable sources for products and enforceable procedures for handling them. When conducting investigations into possible contractual responsibility and/or potential liability, it is important to avoid prejudging negligence.

Fourth, when issuing a consumer alert regarding compromised channels, it is important to include a list of those channels as well as some practical ways for consumers to respond. Consumer alerts should never instruct consumers to provide their recovery phrases so that they can get help. When migrating from what may be a compromised device, the migration process must occur on a known-safe computer and the user must create a new recovery phrase.

Regulators must also demand rapid reporting of incidents and credible third-party forensic reports. “Our systems were not compromised,” might indicate where your system begins and ends but does not address if customers received the security that was promised to them.

Self-custody places much of the burden of responsibility on the user. However, self-custody cannot be used as an excuse to avoid taking responsibility for each step in the chain.

An appropriate ending to this tale is compensation to the first-time victims, holding accountable individuals who were shown to have acted incorrectly, and ensuring the protection of computer equipment until it reaches the user. None of these can be accomplished through a criminal’s mortification.

Fransiscus Nanga Roka

Faculty of Law University 17 August 1945 Surabaya and Managing Partner Law Firm Victorious Indonesia