What Will You Find in This Report on Blockchain Threat Actor Tracking?
Blockchain threat actor tracking means following the public record of cryptocurrency transfers to see how attackers move money. NIST notes that Bitcoin users are pseudonymous and that all transactions are publicly visible. Treasury has named wallet addresses used by the Lazarus Group to launder stolen funds. This page introduces a Brandefense report on how threat actors use blockchain.
Learn Technical Method of Threat Actors’ Different Ways
The technical details of the blockchain ledgers and how threat actors use them. The report will show many points about tracking threat actors who are using blockchain technologies.
Gain Knowledge About Future
By understanding their working model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic.
What does the Tracking Threat Actors on Blockchain report cover?
The report is numbered BD20231116 and was written by its Threat Research Team. The version history lists version 1.0, dated 16.11.2023. It has four chapters: an introduction, a chapter on analyzing data stored in a blockchain, a chapter on methods used to avoid being tracked, and a conclusion.
Wallets and transactions
The analysis chapter starts with cryptocurrency wallets and then moves to transactions. It explains four Bitcoin address types and how to tell them apart by prefix:
- Legacy addresses start with “1”.
- SegWit addresses start with “3”.
- Native SegWit addresses start with “bc1”.
- Taproot addresses start with “bc1p”.
The report walks through a Bitcoin wallet where funds left in less than 1 hour, which it reads as a sign of an intermediate wallet. It says Ethereum is easier to follow than Bitcoin, and shows a Bitcoin transfer with 2 outputs and 45 inputs that is hard to link. It also says centralized exchanges require KYC, while a transfer to a decentralized exchange makes the person almost impossible to find.
Smart contracts, domains and NFTs
For smart contracts, the report shows that the wallet that created a contract is visible, and that bytecode can be decompiled when little is known about a contract. For decentralized domains, it lists the details an ENS record may hold, such as a Discord or Telegram username, and warns that this data is entered by the user and cannot be checked. For NFTs, it explains that the blockchain holds a content address, while the files are usually held in decentralized storage.
How actors avoid tracking
The third chapter covers coin mixers and privacy-focused cryptocurrencies. It describes the CoinJoin technique, a Wasabi round that runs at 100 transaction inputs or after a 1-hour wait, and Tornado Cash, which runs through smart contracts. It says attackers often try to convert stolen cryptocurrencies into privacy-oriented ones, and explains how Monero uses ring signatures and hidden amounts.
What the conclusion says
The report says it outlines the data within blockchain ledgers that intelligence analysts should examine to track threat actors. It also says it examines how cryptocurrencies are used for money laundering.
For a separate current exchange incident, see the Binance security investigation update.