1 Introduction

Quick Response (QR) codes are two-dimensional objects which act as a sort of barcode, and have become ubiquitous due to their convenience [16]. QR codes offer mobile device users an efficient way to perform many actions, including maneuvering to websites which may have long and difficult URLs, place orders and pay bills in restaurants [19]. They are also common in the cryptocurrency ecosystem, as an easy way for users to share their wallet addresses as opposed to long alphanumeric strings.

Originally developed in the 1990s for scanning automobile parts during manufacturing [16], QR codes transform input data into a matrix format consisting of several components. Finder patterns are larger square patterns located in three corners of the QR code, and enabling orientation detection. Smaller alignment patterns are used to correct distortions in perspective. Alternating black and white timing patterns help synchronize the reading process. Format and verification information encode error corrections and mask pattern metadata. Finally, data and error correction codewords encode information and corresponding error correction data.

QR code scanners [19] make use of image processing techniques including edge detection, perspective transformations, and other machine learning-based enhancements to improve scan reliability in low light or distorted conditions. The process of a QR code scan includes several steps. The QR code is captured using a camera or scanner. The scanned image is processed using image transformations such as binarization and geometric correction. Finder and alignment patterns are used to determine the QR code’s size and orientation. Finally, the binary grid is read, error correction is applied, and the data is reconstructed.

While QR codes are relatively secure in terms of data integrity due to error corrections, they do pose a number of security risks [7]. These risks include phishing attacks [13], malware distribution [6], and external tampering risks [2]. Moreover, there are limited options available for QR code verification, which make them an enticing attack vector for criminals. This article explores the criminal use of fraudulent or malicious QR codes, with a focus on their impact on cryptocurrency users. Section 2 will provide the reader with a background on the use of QR codes in the cryptocurrency ecosystem, along with a deeper explanation of the mentioned security risks. Case studies of malicious QR code-based attacks against cryptocurrency users will be given in Section 3. Finally, concluding remarks will be given in Section 4

2 Background

Cryptocurrency users utilize QR codes for numerous reasons [15], especially usability and security. By encoding wallet addresses, payment amounts, and other transaction details in a machine readable format, the use of QR codes simplifies the transfer of funds by minimizing the risk of human error while manually inputting long, complex wallet addresses. Beyond simplifying wallet-to-wallet transfers and merchant payments, QR Codes may also be used for multi-factor authentication [3], as well as for offline storage and backup in paper wallets. The cryptocurrency ecosystem is built upon foundational principles of decentralization and relative anonymity, which makes crypto a prime target for cybercriminals [4].

Malicious,” or fake, QR codes refer to QR codes which have been altered or designed by an adversary to deceive victims into performing unintended actions [10]. Examples of these unintended actions may include unknowingly transferring cryptocurrency to an adversary’s wallet, downloading malware, or visit a phishing website. These malicious QR codes are often printed onto stickers and deceptively placed on top of a legitimate QR code, and in many cases will direct victims to legitimate looking websites.

As a QR code’s primary function is to encode data, such as a URL or payment address, in a scannable format, an attacker can exploit this simplicity by replacing legitimate, authentic data with fraudulent information. For example, the victim could be directed to a phishing URL which mimics a legitimate website [13], such as a cryptocurrency exchange or wallet interface. Once the QR code is scanned, the victim is routed to the fraudulent site, where credentials are harvested or unauthorized transactions are initiated.

As mentioned previously, common malicious QR code attacks involve phishing, commonly referred to as “quishing,” malware distribution, and unauthorized transactions. Quishing [13] occurs when an attacker embeds QR codes in phishing campaigns via email, advertisements, flyers, or other media. Victims are directed to fraudulent websites which are designed to closely mimic the appearance of a legitimate service. In addition to directing victims to phishing websites, malicious QR codes can link to downloadable malware [6], such as trojans, botnets, or spyware which compromise the victim’s device. The attacker can then use the malware downloaded on the victim’s mobile device to further compromise other devices on networks that that device may connect to [14]. Finally, an attacker may encode a fraudulent cryptocurrency wallet address to trick the victim into transferring funds to the wrong recipient. Attackers frequently use this tactic in scams involving fake token swaps [5] and Bitcoin ATMs [12].

Malicious QR codes are a persistent threat for which cybersecurity researchers are developing countermeasures. While these proactive, defensive countermeasures are being developed, users can mitigate against the risks of falling for a malicious QR code by making a reasonable attempt to confirm the veracity of the embedded URL [8]. Is the QR code directing the user to a website that is spelled correctly? URLs can have a great deal of malicious code following the “?” and copying the URL to a link checker can help avoid known malicious URLs. Moreover, some security software products include QR code checkers; however, these services mostly guard against known malicious QR codes and may not catch newly deployed QR codes.

Deep learning and artificial intelligence show great potential in the fight against malicious QR codes. For instance, Pawar, et al. [11] studied the problem of malicious QR code detection as a binary classification problem, and tested several common machine learning algorithms to determine their efficacy at classifying QR codes as legitimate or malicious. Specifically, the authors trained K-Nearest Neighbors (KNN), Random Forest (RF), Support Vector Machine (SVM), and Bidirectional Long Short-Term Memory (Bi-LSTM) algorithms, and developed a prototype scanner for real time QR code analysis. They found that their Bi-LSTM, a deep learning architecture, outperformed other algorithms, achieving nearly 84% accuracy.

Similarly, Wahsheh and Al-Zahrani [17] examined two approaches to malicious QR code detection, conducting experimental evaluation of Fuzzy Logic and Multilayer Perceptron approaches. While both the fuzzy logic and multilayer perceptron approaches exceeded 82% accuracy, the Multilayer Perceptron achieved a marginally higher accuracy rate. The authors then developed a QR code scanner using the Multilayer Perceptron incorporating full URL visibility and validation, as well as with their deep learning-based detection capability.

More recently, Ford and Strohmier Berry [9] developed a Convolutional Neural Network (CNN) classifier-based scanner capable of differentiating between benign and malicious QR codes. Their scanner performed impressively over several training epochs, achieving better than 99% accuracy in classifying malignant and benign QR codes. However, accuracy eventually dropped below 74%, which suggests that the model was overfit to training data and less able to generalize. Overfitting is always a risk with machine learning models, essentially causing the models to recognize training data and leading to erroneous results. Potential liabilities due to erroneous results (e.g., incorrectly classifying a benign QR code as “malignant”) will limit the adoption of machine learning-based defenses against malicious QR codes, thus improved and consistent accuracy will be imperative before they are incorporated into commercially deployable cybersecurity tools.

3 Case Studies

The financial losses caused by cryptocurrency theft via malicious QR codes are staggering. Individual investors have lost significant portions of their portfolios and businesses can face serious damage to their reputations. Savy, technically sophisticated cryptocurrency enthusiasts may be better equipped to detect attempted theft. However, the rapid growth of the cryptocurrency ecosystem means that an influx of newcomers, not as technically literate as crypto veterans, are at risk of losing their funds to these attacks. Many feel betrayed by systems that they believed to be secure.

Cryptocurrency thieves are using malicious QR codes as an element of schemes to steal funds from people who use Bitcoin ATMs [18, 12]. Interestingly, while many investment schemes and similar scams target younger people, nearly all victims of scams involving Bitcoin ATMs are approaching or beyond retirement age. A typical scam will involve a victim being contacted by somebody purporting to be a customer service representative or law enforcement agent working on an account breach, identity theft, or other serious matter. They will provide the victim with a QR code connected to a digital wallet, with instructions to scan the code and deposit cash into a Bitcoin ATM. While the victim believes that they are protecting their money, they are in fact transferring funds to the scammer’s wallet. The United States Federal Trade Commission estimates that losses from these types of scams exceeded $110,000,000 in 2023.

Another class of scams targets over-the-counter swaps, where investors acquire cryptocurrencies via wallet-to-wallet transactions rather than through exchanges, which boast lower than market rate transaction fees [5]. Scammers will often offer victims tokens such at Tron’s TRX in exchange for longer term cooperation, and even make small USDT payments in order to gain the victim’s trust. The scammer then sends the victim a QR code under the guise of a “repayment test.” However, the QR code directs the victim to a website which instructs them to confirm the alleged test transaction; clicking on the “confirm” button allows the scammer to steal the user’s wallet authorization. The blockchain analysis firm Bitrace discovered 27 instances of this scam in a single week in July, 2024 with collective losses of approximately $120,000, all of which utilized the same wallet. The scammers then funneled the stolen cryptocurrency through multiple intermediary wallet addresses before laundering the funds through Huione, a Cambodian crypto exchange.

Fake QR code generators [1] are a long-time scam which purports to generate wallet QR codes and target merchants who are accepting Bitcoin in addition to fiat currency. Users who scan these codes to make a payment will receive a message stating that they can speed up their transaction for a small additional feed of, say 0.001 BTC. This tactic mimics legitimate gas fees on certain blockchains (e.g., Ethereum), but is not applicable to Bitcoin transactions. This scam is perplexing, because the ability to generate legitimate QR codes is built into virtually every cryptocurrency wallet and many exchange points.

4 Conclusions

QR code adoption is a component of broader technology adoptions, including mobile platforms and cryptocurrency. Their increasing usage has introduced both conveniences and vulnerabilities. QR codes streamline payments and improve usability; however, their susceptibility to malicious manipulation has made them an attractive target for cybercriminals. As highlighted in the case studies above, attacks leveraging malicious QR codes have led to significant financial losses, particularly for less experienced users, as well as businesses accepting Bitcoin. The anonymity and decentralization inherent in cryptocurrency transactions further complicate recovery efforts, which leaves victims with few options for recourse.

There are ongoing efforts to combat malicious QR codes, particularly utilizing machine learning classifiers which show promise in adapting as scammers and criminals refine and adapt their tactics. While these tools are not yet ready for broader, commercial deployment, they will eventually buttress existing available tools which are currently bundled into security software suites. In the meantime, vigilance and good cyber habits (e.g., not scanning random QR codes) are probably the most effective defense against falling victim to malicious QR code scams.

References

[1] Bitcoin thieves use malicious qr code readers to steal 45, 000thismonth.Bitdef enderBlog(M arch31, 2020).https : //www.bitdef ender.com/en − us/blog/hotf orsecurity

[2] Ahuja, S. Qr codes and security concerns. International Journal of Computer Science and Information Technologies 5, 3 (2014), 3878–3879.

[3] Ali, G., Dida, M. A., and Elikana Sam, A. A secure and efficient multi-factor authentication algorithm for mobile money applications. Future Internet 13, 12 (2021), 299.

[4] Averin, A., and Zyulyarkina, N. Malicious qr-code threats and vulnerability of blockchain. In 2020 Global Smart Industry Conference (GloSIC) (2020), IEEE, pp. 82–86.

[5] Bitrace. Beware of scanning unknown payment qr codes: Funds stolen instantly. Medium (August 8, 2024). https://medium.com/@bitracetech/beware-of-scanning-unknown-payment-qr-codes-funds-stolen-instantly-788cd

[6] Cargrill, K., Abegaz, T., Parra, L. C., and DaSouza, R. Scan me: Qr codes as emerging malware delivery mechanism. In Proceedings of the Future Technologies Conference (2023), Springer, pp. 611–617.

[7] Cerf, V. G. On qr codes and safety. Communications of the ACM 66, 2 (2023), 7–7.

[8] FBI El Paso Field Office. Fbi tech tuesday: Building a digital defense against qr code scams, September 19, 2023. https://www.fbi.gov/contact-us/field-offices/elpaso/news/fbi-tech-tuesday-building-a-digital-defense-against-qr-code-scam

[9] Ford, J., and Berry, H. S. Feasibility of machine learning-enhanced detection for qr code images in email-based threats. In 2024 Cyber Awareness and Research Symposium (CARS) (2024), IEEE, pp. 1–9.

[10] Kharraz, A., Kirda, E., Robertson, W., Balzarotti, D., and Francillon, A. Optical delusions: A study of malicious qr codes in the wild. In 2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (2014), IEEE, pp. 192–203.

[11] Pawar, A., Fatnani, C., Sonavane, R., Waghmare, R., and Saoji, S. Secure qr code scanner to detect malicious url using machine learning. In 2022 2nd Asian Conference on Innovation in Technology (ASIANCON) (2022), IEEE, pp. 1–8.

[12] Schram, L. E. Bitcoin atm fraudsters scam seniors out of $110m: report. New York Post (August 31, 2024). https://nypost.com/2024/08/31/us-news/bitcoin-atm-scammers-target-senior-citizens-as-overall-cases-surge-tenfold/.

[13] Sharevski, F., Devine, A., Pieroni, E., and Jachim, P. Phishing with malicious qr codes. In Proceedings of the 2022 European Symposium on Usable Security (2022), pp. 160–171.

[14] Sivaraman, V., Chan, D., Earl, D., and Boreli, R. Smart-phones attacking smart-homes. In Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks (2016), pp. 195–200.

[15] Suratkar, S., Shirole, M., and Bhirud, S. Cryptocurrency wallet: A review. In 2020 4th international conference on computer, communication and signal processing (ICCCSP) (2020), IEEE, pp. 1–7.

[16] Tiwari, S. An introduction to qr code technology. In 2016 international conference on information technology (ICIT) (2016), IEEE, pp. 39–44

[17] Wahsheh, H. A., and Al-Zahrani, M. S. Secure real-time computational intelligence system against malicious qr code links. International Journal of Computers Communications & Control 16, 3 (2021).

[18] Wile, R., and Romans, C. Bitcoin atm scams are soaring, and older adults are increasingly the victims. NBC News (August 30, 2024). https://www.nbcnews.com/business/business-news/bitcoin-atm-scams-surge disproportionately-duping-older-adults-rcna

[19] Yan, L.-Y., Tan, G. W.-H., Loh, X.-M., Hew, J.-J., and Ooi, K.-B. Qr code and mobile payment: The disruptive forces in retail. Journal of Retailing and Consumer Services 58 (2021), 102300.

1 Introduction

A late 2024 spate of articles in English language popular tech media (e.g., [18]) publicized what appeared to be a mortal blow to RSA cryptography, an asymmetric cryptographic protocol which underpins many information security schemes. These articles were reporting on a research paper, “Quantum Annealing Public Key Cryptographic Attack Algorithm Based on D-Wave Advantage,” [19] which was published in the Chinese Journal of Computers in May, 2024. This paper purports to use quantum computing-based approaches to attack against RSA cryptography, factoring larger numbers than has previously been accomplished via quantum computing.

This article will examine the claims and results of this research paper, as well as the popular media reporting on the article to determine whether the air of cryptography’s impending doom was overblown. We will introduce the reader to RSA cryptography and quantum cryptanalysis in Section 2.1, then briefly describe quantum computing and its use in cryptanalysis in Section 2.2. Section 3 presents a more detailed examination of the paper’s results attacking the RSA algorithm, as well as providing prudent skepticism on the results and popular reporting of the Chinese paper in Section 3.1. Finally, closing remarks are given in Section 4.

2 Background

2.1 The RSA Cryptographic Protocols

The RSA cryptographic protocol [9] is one of the most widely used public key cryptosystems, used to securely transmit information over potentially untrusted networks. The security of the protocol is rooted in number theory and modular arithmetic, relying on the difficulty of factoring large numbers. Moreover, the protocol offers a digital signature capability to ensure the integrity and authenticity of transmitted data.

RSA key generation takes two large prime numbers p and q, and generates a modulus value n = p × q. Euler’s totient function ϕ(n) = (p − 1)(q − 1) is computed, then a public exponent e is calculated such that 1 < e < ϕ(n) and gcd(e, ϕ(n)) = 1, and a private exponent d is calculated such that d×e(modϕ(n)) = 1. The public key is the pair (e,n) and the private key, which remains secret, is d. A message m is encrypted to generate a ciphertext c = m^e(modn) and the original message is recovered by a decryption function m = c^d(modn). Messages can be digitally signed with the private key, s = m^d(modn), and the signature verified with the public key, m = s^e(modn).

2.2 Quantum Computing and Quantum Cryptanalysis

Quantum computing [13] is an emerging theory and practice of computer science which is based on the principles of quantum mechanics, in particular superposition, entanglement, and quantum interference. Quantum computing operations are fundamentally different from operations utilized in classical computing. Qubits (quantum bits) are distinct from classical bits, which encode binary representations, either a 1 or 0. Qubits exist as a coherent superposition of states, simultaneously representing 1 and 0, which exponentially expands the representational capacity within the computational system. This increased capacity gives quantum computers the ability to theoretically compute certain classes of problems, such as factorization and unstructured search, with unparalleled efficiency when compared to classical computers. Quantum cryptanalysis [17] exploits this advantage in computational efficiency to target cryptographic protocols, particularly protocols which are reliant on the hardness of specific mathematical problems like integer factorization and discrete logarithms. Quantum computers are mostly theoretical, and true quantum computers may never be built at scale or widely available. (Indeed, the cryptographer Nigel Smart jokes that we’ve been ten years away from real world quantum computers for several decades [16].) However, the development of quantum algorithms, such as Shor’s algorithm [15] for factorization and Grover’s algorithm [7] for search, threaten widely deployed cryptographic standards, including RSA and elliptic curve cryptography.

2.2.1 Factorization as an Optimization Problem

Composite numbers are products of prime numbers and prime factorization, the decomposition of composite numbers into their constituent primes, is known to be a hard problem as numbers get larger. Burges’ seminal paper [4] recasts prime factorization, biprimes in particular, as an unconstrained optimization problem using quartic polynomials. The paper initially describes a factoring decomposition that maps prime factorization to a constrained optimization landscape and then introduces a novel ”Curvature Inversion Descent” (CID) algorithm, which efficiently escapes local minima. Experimental analysis showed that the CID algorithm escaped local minima nearly 90% of the time, a remarkable improvement over the roughly 30% successful escapes by other gradient descent approaches.

2.2.2 Quantum Hardware: Annealer vs Gates

The two most common paradigms for quantum computing are quantum gates [20] and quantum annealing [12]. Both of these approaches are based on principles from quantum mechanics; however, they differ significantly in models, mechanisms, and applications.

Gate-based quantum computing is analogous to classical computing, but operates on qubits rather than classical bits. Qubits can exist in superposition, representing both 0 and 1 simultaneously and can thus be entangled, enabling correlations between qubits that classical systems simply cannot replicate. These properties allow quantum computers to process information in ways that classical computers are unable to match. The computational process in gate-based quantum systems is structured around quantum circuits, consisting of a sequence of quantum gates. These gates are mathematical operations that manipulate qubits’ states.

These gates implement step-by-step processes to solve specific problems, such as factoring integers using Shor’s algorithm [15] or optimizing search processes using Grover’s algorithm [7]. Qubits are prone to noise and decoherence, and so this approach requires precise control over the quantum system and error correction mechanisms. Examples of quantum gate-based systems include IBM’s Quantum Processors and Google’s Sycamore.

Quantum annealing is used to solve optimization problems. Instead of discrete quantum gates, this approach uses the principles of adiabatic quantum computing. This process is based on evolving a quantum system from an initial simple state to the ground state (i.e. the lowest energy configuration) of a more complex problem Hamiltonian. This process begins by encoding the optimization problem into a cost function, represented as a quantum Hamiltonian (i.e. a mathematical description of the energy of a system). The system is initialized in the ground state of a simple, known Hamiltonian, which is slowly transformed into the problem Hamiltonian. If the evolution is slow enough, the system remains in its ground state throughout, providing the solution to the optimization problem when the process completes.

Quantum annealing is particularly effective for problems that can be represented as finding the global minimum of a function, including combinatorial optimization, integer factorization, and machine learning. However, quantum annealing approaches lack the versatility of gate-based quantum computers and face challenges such as noise sensitivity and embedding overhead. The most noteworthy implementations are D-Wave’s quantum annealers, which solve problems by mapping them onto Ising models [5] or quadratic unconstrained binary optimization (QUBO) [2] formulations.

2.2.3 The D-Wave Architecture

D-wave [1] is a quantum computing company which was the first to offer quantum-effect computing services to the marketplace. D-Wave systems minimize an energy function represented as either a QUBO problem or an equivalent Ising model, where variables correspond to qubits and their interactions represent problem constraints. By leveraging quantum superposition and tunneling, the annealer can escape local minima and find the global minimum more effectively than classical methods for certain problems. Physical qubits are made from superconducting loops operating at near absolute zero, and interact via programmable couplers, enabling precise encoding of optimization tasks.

D-wave’s hardware uses connectivity patterns to arrange qubits and their interactions. Compared to older topologies, their Pegasus design enhances connectivity and reduces overhead when mapping logical problem variables to physical qubits. D-Wave’s systems are purpose-built and excel primarily in optimization tasks like scheduling, resource allocation, integer factorization, and machine learning.

2.2.4 Quantum Attacks Against Cryptographic Protocols

Much of modern cryptography is built upon one-way functions, or mathematical operations that are easy to compute but with an inverse operation that is prohibitively difficult. Examples of one-way functions include factoring large integers and discrete logarithms over finite fields. However, we have seen that some quantum computers excel at these inverse operations. Shor’s algorithm [15] is theoretically capable of efficiently factoring large integers, though the largest integer that it has factored to date is 21 [10]. While Shor’s algorithm is probably the most well-known quantum factoring approach, quantum annealing has been far more successful at integer factorization, and thus for cryptanalysis.

Jiang, et al. [8] developed a quantum annealing framework for integer factorization using Ising models, direct optimization and modified multiplication table approaches. Both methods reduce integer factorization to optimization problems solvable via quantum annealing hardware like D-Wave’s 2000Q, and they were able to factorize numbers up to 376,289 during experimentation. More recently, Ding, et al. [6] encoded prime factorization into a modular multiplier circuit using the Pegasus QA architecture. They detailed several annealing strategies, including initialization techniques, chain strengths, and anneal offsets, culminating in the successful factorization of 8,219,999, the largest number factorized solely through quantum annealing at the time.

3 The Recent Chinese Attack on Cryptographic Protocols with D-Wave

We are now ready to analyze the paper, “Quantum annealing public key cryptographic attack algorithm based on d-wave advantage,” [19] in which the authors discuss two RSA public-key cryptographic attack algorithms leveraging D-Wave’s quantum annealing technology. The quantum annealing approach, using quantum tunneling, avoids local minima in optimization problems, which makes it suitable for integer factorization in RSA attacks.

The authors propose two methods for attacking the RSA protocol. In the first method, they frame their attack as combinatorial optimization problems using Ising and QUBO models and use dimensionality reduction formulas to reduce the qubit count and improve the model’s stability. Using this approach, the authors were able to factor a 22-bit integer and advance beyond prior benchmarks. Building on this, the authors went on to integrate quantum annealing with classical mathematical methods, specifically Babai’s algorithm [3], to attack the Closest Vector Problem (CVP) [11]. The CVP is a computationally difficult lattice problem where the goal is to find the nearest vector in a point lattice to another vector (which may not be in that lattice). The authors used quantum tunneling with Babai’s algorithm to improve vector precision and a quantum annealing adaptation of Schnorr’s algorithm [14] for faster CVP solutions to factor a 50-bit RSA integer.

3.1 To Quote Monty Python, “I’m not dead yet.”

Though alarmist headlines certainly grabbed readers’ attention, there are a number of reasons that this paper may not herald the imminent demise of widely used cryptographic protocols like RSA and why it should be taken with a grain of salt. These reasons are partially practical, but there are also several details about the paper and its publication process which invite skepticism.

Assuming that the authors’ results are legitimate and repeatable, 22-bit and 50-bit integers are far shorter than the integer size of real-world RSA implementations. The current RSA standard is 2048-bit, but 4096-bit integers are recommended for longer term security. It is unclear how well the authors’ methodologies will scale to factoring integers of these lengths. Further experimentation will determine whether the paper’s results are repeatable, and answer questions on the approach’s scalability.

There are also several non-technical reasons to view this paper with skepticism. At 10 pages in length, it is a relatively short paper which was published in a Chinese language journal rather than an English language venue (such as an IEEE or ACM journal). The paper provides an abstract in English, but the body is entirely in Chinese and no English translation is readily available; services such as Google Translate or ChatGPT can be used to translate the paper. The article only went through a single round of peer review, which is unusual as the refereeing process is meant to ensure that manuscripts don’t contain any glaring holes in reasoning or procedure and are sufficiently polished for publication. Reading through translations of this paper, it is evident that the authors glossed over details which top-tier publication venues would require before accepting the manuscript for publication. On top of these concerns, the authors have reportedly been loathe to answer queries from media or other academics, allegedly due to the sensitivity of the topic. Furthermore, the article lists a Digital Object Identifier (DOI) number which does not exist (Figure 1). This opacity casts some doubt on the paper’s methods and results, pending broader experimentation within the broader cryptanalysis and quantum computing communities to verify the authors’ original work.

4 Conclusion

The claims made in “Quantum annealing public key cryptographic attack algorithm based on d-wave advantage” warrant scrutiny. The authors claim several intriguing advancements using quantum annealing to factor small integers and integrate classical mathematical techniques; however, the practical implications for real-world cryptographic protocols remain speculative at best. To make the jump from factoring 50-bit integers to compromising standard RSA keys, which are orders of magnitude larger, is a monumental one, and fraught with computational and scalability challenges that this paper does not convincingly address. The methods described require rigorous validation and testing by the broader research communities to assess their true potential and limitations, particularly when applied to cryptographic key sizes used in modern security systems.

Beyond the technical considerations, the context of the paper’s publication also raises questions about its reliability. An apparent lack of extensive, rigorous peer review, the decision to publish in a regional rather than international venue, and the absence of detailed methodological transparency suggest the need for tempered enthusiasm. While the paper has certainly generated excitement and speculation, it should be seen as a prompt for further research rather than as evidence of an imminent cryptographic apocalypse.

References

[1] D-Wave Systems. https://www.dwavesys.com/.

[2] Alom, M. Z., Van Essen, B., Moody, A. T., Widemann, D. P., and Taha, T. M. Quadratic unconstrained binary optimization (qubo) on neuromorphic computing system. In 2017 International Joint Conference on Neural Networks (IJCNN) (2017), IEEE, pp. 3922–3929.

[3] Babai, L. On lov´asz’lattice reduction and the nearest lattice point problem. Combinatorica 6 (1986), 1–13.

[4] Burges, C. J. Factoring as optimization. Microsoft Research MSR-TR-200 (2002).

[5] Cipra, B. A. An introduction to the ising model. The American Mathematical Monthly 94, 10 (1987), 937–959.

[6] Ding, J., Spallitta, G., and Sebastiani, R. Experimenting with d-wave quantum annealers on prime factorization problems. Frontiers in Computer Science 6 (2024), 1335369.

[7] Grover, L. K. A fast quantum mechanical algorithm for database search. In Proceedings of the twenty-eighth annual ACM symposium on Theory of computing (1996), pp. 212–219.

[8] Jiang, S., Britt, K. A., McCaskey, A. J., Humble, T. S., and Kais, S. Quantum annealing for prime factorization. Scientific reports 8, 1 (2018), 17667.

[9] Katz, J., and Lindell, Y. Introduction to modern cryptography: principles and protocols. Chapman and hall/CRC, 2007.

[10] Martin-Lopez, E., Laing, A., Lawson, T., Alvarez, R., Zhou, X.-Q., and O’brien, J. L. Experimental realization of shor’s quantum factoring algorithm using qubit recycling. Nature photonics 6, 11 (2012), 773–776.

[11] Micciancio, D., Goldwasser, S., Micciancio, D., and Goldwasser, S. Closest vector problem. Complexity of Lattice Problems: A Cryptographic Perspective (2002), 45–68.

[12] Morita, S., and Nishimori, H. Mathematical foundation of quantum annealing. Journal of Mathematical Physics 49, 12 (2008).

[13] Rieffel, E., and Polak, W. An introduction to quantum computing for non-physicists. ACM Computing Surveys (CSUR) 32, 3 (2000), 300–335.

[14] Schnorr, C.-P. A more efficient algorithm for lattice basis reduction. Journal of algorithms 9, 1 (1988), 47–62.

[15] Shor, P. W. Algorithms for quantum computation: discrete logarithms and factoring. In Proceedings 35th annual symposium on foundations of computer science (1994), Ieee, pp. 124–134.

[16] Smart, N. Implications of the proposed quantum attack on lwe, 2024. https://nigelsmart.github.io/LWE.html.

[17] Suo, J., Wang, L., Yang, S., Zheng, W., and Zhang, J. Quantum algorithms for typical hard problems: a perspective of cryptanalysis. Quantum Information Processing 19 (2020), 1–26.

[18] Swain, G. Chinese researchers break rsa encryption with a quantum computer. CSO Online (October 14, 2024). https://www.csoonline.com/article/3562701/chinese-researchers-break-rsa-encryption-with-a-quantum-computer.html.

[19] Wang, C., Wang, Q.-D., Hing, C.-L., Hu, Q.-Y., and Zhi, P. Quantum annealing public key cryptographic attack algorithm based on d-wave advantage. Chinese Journal of Computers 47, 5 (2024). DOI: 10.11897/SP.J.1016.2024.01030 http://cjc.ict.ac.cn/online/onlinepaper/wc-202458160402.pdf.

[20] Williams, C. P., and Williams, C. P. Quantum gates. Explorations in Quantum Computing (2011), 51–122.

1 Introduction

The growth and adoption of blockchain technologies and cryptocurrency since Bitcoin’s public release in 2009 has seen many people “becoming their own banker,” as they utilize one or more cryptocurrency wallets to manage their digital assets. One of the most ubiquitous experiences for any cryptocurrency enthusiast is receiving and recording their wallet’s mnemonic seed phrase [10], a string of words which enables them to backup and recreate their wallets. Seed phrases are imperative to the entirety of the cryptocurrency and decentralized finance ecosystems.

However, for their importance, seed phrases face limitations and weaknesses. For instance, text-based seed phrases are seemingly random strings of words which are not likely memorable, and this had figured into many instances of lost Bitcoin [12]. Seed phrases may be susceptible to phishing attacks [8], enabling criminals to abscond with a user’s cryptocurrency. Visual seed phrases [6] use images, symbols, or abstract patterns rather than text to serve as the backup and security for digital assets held in cryptocurrency wallets.

In this article, we will introduce the reader to visual seed phrases. In particular, we will describe how text-based seed phrases are derived, and then connect them to visual seed phrases. We will explore the use of visual seed phrases in both the legitimate cryptocurrency economy, as well as the use of visual seed phrases by criminal actors and the challenge that this poses to law enforcement and digital forensic professionals.

2 Background

As has been pointed out in earlier articles [3], the “crypto” in cryptocurrency refers to the use of cryptographic building blocks in almost every aspect of the ecosystem. Cryptocurrency wallets rely on deterministic key generation protocols to provide secure, user-friendly mechanisms for managing digital assets [10]. Seed phrases are human readable strings which represent the entropy used to derive a wallet’s private key. These strings will typically consist of 12, 18, or 24 words selected from a standardized wordlist (e.g., BIP-39 [7]), and are meant to bridge the gap between human cognition and cryptographic precision.

The seed phrase selection process begins with a randomly generated entropy value which is passed through a key derivation protocol to generate the seed phrase. This value is then used as input to deterministic algorithms (e.g., BIP-32 [13]) to derive a hierarchical structure of private and public keys. While different wallets and blockchains will utilize specific derivation protocols, these processes enable users to access multiple cryptocurrency addresses without having to remember complex cryptographic details.

Text-based seed phrases are the de facto industry standard, however they are not without security vulnerabilities. Threats such as phishing [8], physical theft, and brute-force attacks against poorly chosen entropy have led researchers and enthusiasts to explore alternative representations, such as visual seed phrases.

Visual seed phrases encapsulate the entropy needed for private key generation with visual representations, images, patterns, or graphical elements, rather than text. This idea is not inherently new, as there are decades’ worth of research on graphical passwords [9] and visual cryptography [4]. However, the application of these ideas to cryptocurrency may prove to be the most successful real-world application of these ideas. There are also several considerations which must be accounted for.

The derivation process for visual seed phrases need to map the underlying entropy to graphical elements using protocols which ensure high entropy preservation. Entropy bits can encoded as color values, pixel intensities, or geometric arrangements using algorithms such as Perlin noise [11] or fractal generation [5] to encode the entropy value. Encoding methods must ensure that any changes in entropy (e.g., due to bit flips) result in significantly different visual outputs to resist forgery.

In order to reconstruct a private key from a visual seed phrase, it must be interpreted by a program or algorithm capable of reversing the encoding process. However, different systems may encode and decode visual seed phrases in non-compatible ways, which raises concerns about standardization and interoperability. (This is also an issue with text-based seed phrases. We have mentioned BIP-32 and BIT-39, however there are a multitude of derivation protocols used by different cryptocurrencies.)

Visual seed phrases use human visual memory and enable users to offload seed phrase storage to innocuous artifacts (for instance, an artistic poster print). This gives investors and enthusiasts a convenient way to backup and secure their digital assets, all the while reducing their reliance on easily misappropriated text-based mnemonics. While visual seed phrases offer legitimate benefits, they are also ripe for misuse by criminals seeking to conceal or obscure cryptocurrency holdings from law enforcement, or even other criminals.

The same properties that make visual seed phrases appealing to users also pose significant hurdles for forensic investigators. For instance, criminals can exploit visual seed phrases to embed cryptographic keys in inconspicuous media. Techniques such as image or multimedia steganography [2] allow cryptocurrency keys to be hidden within the metadata or pixel values of images without visibly altering the image. Unlike textual seed phrases, visual counterparts may not immediately reveal their function, especially when encoded in complex or abstract forms. There are no standardized protocols for visual seed phrase encoding and decoding, which means investigators cannot rely on universal tools to extract entropy from visual data.

3 Visual Seed Phrases and Digital Forensics

Visual seed phrases present unique challenges to law enforcement and digital forensics investigators, who need to adopt innovative strategies to discover and analyze visual seed phrases when they suspect that cryptocurrency may be a part of their investigation. Advanced imaging techniques, such as image entropy analysis [1], can help identify visual artifacts that may encode seed phrases. Similarly, machine learning models trained on known visual seed phrase patterns could flag suspect images for further scrutiny.

Investigators need tools capable of extracting and decoding entropy from visual data. Open-source libraries and custom scripts for steganalysis and image-to-data conversion may be applicable to meeting these challenges, or new tools may need to be developed. Contextual clues, such as the presence of cryptocurrency wallets or related software on a suspect’s devices, may indicate that visual seed phrases are in use. Correlating image metadata or file access timestamps with other digital evidence can provide leads to investigators as they search for evidence of visual seed phrases. Finally, forensic investigation teams must stay abreast of developments in visual cryptography and steganography to ensure their effectiveness against emerging techniques.

4 Conclusion

Visual seed phrases stand at the intersection of cryptographic security, usability, and artistic expression. Seed phrases are ubiquitous throughout the cryptocurrency ecosystem, but suffer from security shortcomings. Visual seed phrases help to address these shortcomings, though they do present new and unique challenges to law enforcement and forensic investigators. These challenges are not insurmountable, and further research in image analysis, steganalysis, and machine learning will undoubtedly see the development of tools which can be used to discover and extract visual seed phrases in seized evidence.

This article is meant to introduce the reader to visual seed phrases, as well as serve as a call to action to computer scientists with research interests digital forensics to investigate and engage with the complexities of visual seed phrases. In addition to introducing the reader to visual seed phrases, we covered textual seed phrase generation. We also discussed the intricacies of visual seed phrases in digital forensic investigations, as well as technological tools which may assist investigators as they search for, and discover, visual seed phrases.

References

[1] Delgado-Bonal, A., and Marshak, A. Approximate entropy and sample entropy: A comprehensive tutorial. Entropy 21, 6 (2019), 541.

[2] Fridrich, J. Steganography in digital media: principles, algorithms, and applications. Cambridge university press, 2009.

[3] Hallman, R. A. The intersection of modern cryptography and blockchan: How are fully homomorphic encryption, multiparty computation, and zero-knowledge proofs useful in the cryptocurrency ecosystem? CAT Labs Blog (August 27, 2024). https://catlabs.io/blog/the-intersection-of-modern-cryptography-and-blockchain-how-are-fully-homomorphic-encryption-multiparty-computation-and-zero-knowledge-proofs-useful-in-the-cryptocurrency-ecosystem

[4] Ibrahim, D. R., Teh, J. S., and Abdullah, R. An overview of visual cryptography techniques. Multimedia Tools and Applications 80 (2021), 31927–31952.

[5] Ivanovici, M., and Richard, N. Fractal dimension of color fractal images. IEEE Transactions on Image Processing 20, 1 (2010), 227–235.

[6] Martins, D. How to turn your seed phrase into images. Medium (June 21, 2024). https://medium.com/@martins87/how-to-turn-your-seed-phrase-into-images-14cf1ada062e.

[7] Palatinus, M., Rusnak, P., Voisine, A., and Bowe, S. Bip-39: Mnemonic code for generating deterministic keys, 2013. https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki.

[8] Scharfman, J. Crypto phishing and spoofing scams. In The Cryptocurrency and Digital Asset Fraud Casebook, Volume II: DeFi, NFTs, DAOs, Meme Coins, and Other Digital Asset Hacks. Springer, 2024, pp. 193–219.

[9] Suo, X., Zhu, Y., and Owen, G. S. Graphical passwords: A survey. In 21st Annual Computer Security Applications Conference (ACSAC’05) (2005), IEEE, pp. 10–pp.

[10] Suratkar, S., Shirole, M., and Bhirud, S. Cryptocurrency wallet: A review. In 2020 4^th international conference on computer, communication and signal processing (ICCCSP) (2020), IEEE, pp. 1–7.

[11] Tang, C., Zhang, K., Xing, C., Ding, Y., and Xu, Z. Perlin noise improve adversarial robustness. arXiv preprint arXiv:2112.13408 (2021).

[12] Voas, J., and Kshetri, N. Lost and never found. Computer 54, 07 (2021), 12–13.

[13] Wuille, P. Bip-32: Hierarchical deterministic wallets, 2012. https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki.

1 Introduction

The cryptocurrency ecosystem relies on trust and security [16], and key management is a perennial challenge for investors and enthusiasts alike. Key mismanagement exposes private cryptocurrency keys to potential attacks and unauthorized access, which poses a sever threat to billions of dollars’ worth of digital assets [6]. Compromised keys leads to stolen cryptocurrency often [1], and it is estimated that around 20% of existing Bitcoin are unrecoverable due to lost keys [17]. These losses have significant financial implications, and erode trust in the cryptocurrency economy [8, 10].

This blog article covers cryptocurrency key backup and recovery (KBR) options available to cryptocurrency users. There is a maxim among cryptocurrency enthusiasts, “not your keys, not your crypto.” It has traditionally been the user’s responsibility to protect their keys and other artifacts (e.g., wallet seed phrases) which could expose them to theft or loss. KBR products and services can offer investors peace of mind, in that they have an option to protect their keys beyond their own rudimentary efforts. There are KBR solutions available at various price points and levels of effort on the user’s part.

The remainder of this article is organized as follows: Section 2 gives the reader sufficient background on cryptocurrency keys, as well as a survey of KBR solutions. In Section 3, we will discuss CAT Labs’ work on a KBR service which has the potential to bring a level of assurance that was previously only available to elite investors to the broader marketplace. Concluding remarks will be given in Section 4.

2 Key Backup and Recovery: Background knowledge and a survey of current market solutions

A private key is a secret code that allows a user to access and control their cryptocurrency [11]. It is usually generated by a cryptocurrency wallet and is meant to be kept secret. A user’s private key is used to sign transactions, and it must be kept secure as anyone who has access to it can move or spend the associated cryptocurrency. On the other hand, a public key is a code that is derived from the private key and is used to receive cryptocurrency transactions. It is intended to be shared publicly, as it is used to generate the user’s cryptocurrency wallet address. The wallet address is a string of characters that identifies the user’s wallet on the blockchain network, allowing other users to send cryptocurrency to that wallet.

A cryptocurrency wallet address is a public key that is generated from the user’s private key [12]. When someone wants to send cryptocurrency to a user’s wallet, they use the wallet address, which is a hash of the user’s public key. The sender’s cryptocurrency is then transferred to that address on the blockchain network, and the user can access it using their private key.

Maintaining and securing a user’s keys is essential to holding and controlling crypto assets. Recounting the maxim above, whoever has access to a cryptocurrency account’s private keys has access to that cryptocurrency asset. Whether a private commercial holder, an institutional investor, or a government/law enforcement agency, the ability to securely store and recover private keys is critical.

There are a number of existing solutions to store and protect cryptocurrency keys [16], including:

Paper wallet: A paper wallet is a printed copy of your public and private keys. This is considered to be one of the safest options for storing your cryptocurrency keys. However, it’s important to keep the paper wallet in a secure location as anyone with access to the paper can potentially steal your funds. Furthermore, paper wallets are static and cannot be used to sign transactions.

Hardware wallet: A hardware wallet is a physical device that stores your cryptocurrency keys offline. Hardware wallets are generally considered to be one of the safest options for storing cryptocurrency keys, as they are not connected to the internet and therefore are less vulnerable to hacking.

Software wallet: A software wallet is a program that you can install on your computer or mobile device. Software wallets can be either hot wallets (connected to the internet) or cold wallets (offline). Cold wallets are generally considered to be safer than hot wallets.

Multisignature wallet: A multisignature wallet [2, 7] requires multiple parties to sign off on a transaction before it can be completed. This adds an extra layer of security as it prevents any single party from having complete control over the funds. Nevertheless, there are cases where private keys have been stolen during a brief window of vulnerability once the requisite parties have signed off on a transaction [4].

Key splitting: Key splitting involves breaking up your private key into multiple pieces [15] and storing them in different locations. This makes it more difficult for anyone to steal your funds as they would need to access all of the different locations where the key fragments are stored. This includes wallets which use Multi-Party Computation (MPC) schemes [5]. However, there are known key extraction schemes that can be leveraged against MPC wallets with as little as a single signature [14].

Cryptocurrency insurance: While not a key storage solution, some companies offer insurance policies that cover the loss of cryptocurrency due to theft or other events [13]. This can provide additional peace of mind for cryptocurrency holders. However, it is worth noting that companies offering these policies may require policy holders to utilize a KBR service.

Whether you are a retail crypto enthusiast or an elite cryptocurrency investor, there are practices and KBR services available to you. First and foremost, investors should write down their wallet’s mnemonic seed phrase, which can be thought of as a private master key that gives access to all the associated private and public cryptocurrency keys within that wallet. Specifically, investors are given instructions to write their seed phrase down in an analog, rather than digital, medium such as a piece of paper which is stored in a safe. The advice to avoid using digital mediums comes from the fact files on a computer may be exfiltrated by hackers. Nevertheless, users may act against this advice and store a picture of their seed phrase on their phone, or they may record seed phrases in a cloud-based document. Users doing this should at least password protect these files, though many fail to implement even this most rudimentary security practice.

At higher price points, the current commercially available KBR solutions available to more elite investors include solutions based on storing private keys in securely held physical storage. Examples include storing private keys on air-gapped computer hardware that are stored in Cold War-era bunkers in the Swiss Alps; sharding private keys via a secret sharing protocol and storing those shards in air-gapped computer hardware in separate secure locations. Maintaining secure physical storage facilities is unnecessarily expensive, and recovery processes can take as long as 48 hours. However, at least one prominent hardware wallet has partnered with a KBR service to make sharding-based KBR services more accessible to cryptocurrency investors. Moreover, many services which utilize threshold signature or key splitting schemes may be vulnerable to key composition or extraction attacks, where keys are exposed after recomposition or decryption.

3 How CAT Labs is Charting a Course to the Future of Key Backup and Recovery Services

CAT Labs recently received a Small Business Innovation Research grant from the National Science Foundation to develop a KBR capability, which we believe will provide the level of security that only elite institutional investors could afford at a much lower price point. Specifically, we are utilizing recent developments in cryptography, including quantum-resistant lattice cryptography, to protect private keys. Our method will obviate the need for physically secure storage facilities and allow KBR services to utilize a broader range of infrastructure, possibly including commercial cloud service providers.

We are using Threshold Fully Homomorphic Encryption (FHE) [3], along with other protocols, to securely store, shard, and distribute cryptocurrency keys among multiple data centers or cloud providers, with a reconstruction and recovery process that will seem almost instantaneous compared to KBR solutions available in today’s marketplace. Our use of FHE may be curious at first blush, but it allows us to shard, distribute, and reconstruct private keys with high confidence. Beyond basic KBR, there is exciting research on homomorphically encrypted elliptic curve digital signature algorithms [18], including threshold signatures [9], which will reduce the risk that private keys could be exposed as users sign transactions.

4 Conclusion

Security and trust are important for continued cryptocurrency adoption. Key mismanagement is a root cause for many instances of stolen funds and unrecoverable assets. Key backup and recovery services offer a bulwark against losses due to key mismanagement by recording and storing private keys that will allow investors to recover their wallets in the event of a catastrophic loss (for instance, a smart phone with a wallet getting dropped into water).

In this article, we discussed the marketplace for cryptocurrency key backup and recovery services at different price points and levels of effort for the user. These KBR practices and services range from the investor recording and storing private keys on their own, to more sophisticated options that include sharding and distributing keys to physically secure storage locations under armed guard. Finally, we discussed CAT Labs’ efforts to develop a KBR service which utilizes several cryptographic protocols, including quantum-resistant lattice cryptography, which shows promise at making sophisticated KBR capabilities accessible to more cryptocurrency investors. We are also incorporating recent breakthroughs in FHE and digital signatures to further protect private keys during transactions.

References

[1] Biggest crypto hacks & scams - defi rekt databas. https://de.fi/rekt-database, 2023. De.Fi.

[2] Bhushan, B., Sinha, P., Sagayam, K. M., and Andrew, J. Untangling blockchain technology: A survey on state of the art, security threats, privacy services, applications and future research directions. Computers & Electrical Engineering 90 (2021), 106897.

[3] Boneh, D., Gennaro, R., Goldfeder, S., Jain, A., Kim, S., Rasmussen, P. M., and Sahai, A. Threshold cryptosystems from threshold fully homomorphic encryption. In Advances in Cryptology–CRYPTO 2018: 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part I 38 (2018), Springer, pp. 565–596.

[4] Breidenbach, L., Daian, P., Juels, A., and Sirer, E. G. An in-depth look at the parity multisig bug. Hacking, Distributed (July 22, 2017). https://hackingdistributed.com/2017/07/22/deep-dive-parity-bug/.

[5] Cramer, R., Damg˚ard, I. B., et al. Secure multiparty computation. Cambridge University Press, 2015.

[6] Fr¨ohlich, M., Gutjahr, F., and Alt, F. Don’t lose your coin! investigating security practices of cryptocurrency users. In Proceedings of the 2020 ACM Designing Interactive Systems Conference (2020), pp. 1751–1763.

[7] Goel, A. K., Bisht, V. S., and Chaudhary, S. Multisignature crypto wallet paper. In 2023 8th International Conference on Communication and Electronics Systems (ICCES) (2023), IEEE, pp. 476–479.

[8] Grand View Research. Cryptocurrency market size, share & trends analysis report by component, by hardware, by software, by process (mining, transaction), by type, by end-use, by region, and segment forecasts, 2023 - 2030. https://www.grandviewresearch.com/industry-analysis/cryptocurrency-market-report, 2023.

[9] Gur, K. D., Katz, J., and Silde, T. Two-round threshold lattice-based signatures from threshold homomorphic encryption. In International Conference on Post-Quantum Cryptography (2024), Springer, pp. 266–300.

[10] Guri, M. Beatcoin: Leaking private keys from air-gapped cryptocurrency wallets. In 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) (2018), IEEE, pp. 1308–1316.

[11] Houy, S., Schmid, P., and Bartel, A. Security aspects of cryptocurrency wallets: a systematic literature review. ACM Computing Surveys 56, 1 (2023), 1–31.

[12] Karantias, K. Sok: A taxonomy of cryptocurrency wallets. Cryptology ePrint Archive (2020).

[13] Ko, H., Son, B., and Lee, J. Portfolio insurance strategy in the cryptocurrency market. Research in International Business and Finance (2023), 102135.

[14] Makriyannis, N., and Yomtov, O. Practical key-extraction attacks in leading mpc wallets. Cryptology ePrint Archive (2023).

[15] Selvi, S. S. D., Paul, A., Rangan, C. P., Dirisala, S., and Basu, S. Splitting and aggregating signatures in cryptocurrency protocols. In 2019 IEEE International Conference on Decentralized Applications and Infrastructures (DAPPCON) (2019), IEEE, pp. 100–108.

[16] Suratkar, S., Shirole, M., and Bhirud, S. Cryptocurrency wallet: A review. In 2020 4^th international conference on computer, communication and signal processing (ICCCSP) (2020), IEEE, pp. 1–7.

[17] Voas, J., and Kshetri, N. Lost and never found. Computer 54, 07 (2021), 12–13.

[18] Zama AI. Tfhecdsa (tfhe ecdsa), September 25, 2023. https://github.com/zama-ai/bounty-ecdsa-signature.

1 Introduction

As blockchain-based cryptocurrencies such as Bitcoin and Ethereum have gained popularity, criminal actors are constantly scheming new ways to steal assets from legitimate investors and users. Many of these schemes, such as ransomware and malware, are effective and well known, and therefore well studied by professional security researchers. However, criminals are innovative and always working to stay a step ahead of their targets. This blog post on cryptocurrency address poisoning is the first in a series on emerging threats to cryptocurrency users. These blog posts will have a different feel from recent entries, mainly due to the fact that these threats a fairly new and there is a dearth of information available; reputable sources may be limited to a few articles on popular websites because there is little refereed literature available.

Blockchains are decentralized ledgers where transactions are recorded across multiple independent nodes, and the cryptocurrencies that operate on those blockchains utilize cryptographic protocols (e.g., elliptic curve digital signatures, public key cryptography) to secure transactions and provide verifiable ownership of assets [8]. Every user on a blockchain has a public address which is derived from a public key value and which functions similarly to a bank account number. Transactions on a blockchain are public and immutable, thus maintaining public confidence in the ecosystem is essential to continued adoption.

Cryptocurrency addresses are typically alpha-numeric strings which are difficult to memorize or detect changes, and address poisoning is a relatively new attack which takes advantage of this fact. For example, Bitcoin addresses are strings which may be between 26 and 35 characters and Ethereum addresses are 42 characters. Users will often receive advice such as matching the first and last four characters of addresses. However, this means that users may miss subtle differences between an address that they intend to transact with and another address with the same leading and following characters. Cryptocurrency address poisoning attacks will target users and trick them into sending a transaction with an address which looks similar to an address which they have previously interacted with, assuming that the user will not detect the difference.

2 A Primer on Cryptocurrency Address Poisoning

Cryptocurrency addresses are long alphanumeric strings which are generated through hashing functions of public keys. A Bitcoin address may look like ”1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa,” and a user may wish to send Bitcoin to this address. Address poisoning [11, 14] takes advantage of the similarity of the hypothetical Bitcoin address above and a different address ”1A1zP1eP5QGefi2DmRTfTL5SLmv7DivfNa.”

An address poisoning attacker generated the latter address to mimic the former, maintaining the leading and trailing characters, which is what most users check. The attacker will send the targeted victim small amounts of cryptocurrency over multiple transactions, an attack known as “dusting” transactions [4]. These dusting transactions may utilize established cryptocurrencies, or fake tokens (such as a token which impersonates well-known cryptocurrencies, e.g., a fake Tether) [13] which have no value. Many cryptocurrency wallets offer an auto-fill feature which keeps track of recent transactions, and the victim is likely to use this feature without verifying the full address to which they are sending funds. The attacker’s dusting transactions infiltrate the wallet’s history tracking, which gives the attacker’s mimicked address an appearance of legitimacy.

Cryptocurrency addresses are usually derived from public keys, which are in turn derivative of private keys. An address poisoning attacker can generate cryptocurrency addresses that look like a target by several methods. A fraudulent address may be generated by brute force, with the attacker generating a multitude of addresses until they find one that is similar to their target. Other tools, such as vanity address generators [5] allow an attacker to create addresses that mimic their target. After the attacker sends dust transactions to the victim, the poisoned address will appear in their wallet history. When the victim makes future transactions, there is a chance that they will select the poisoned address without verifying its legitimacy.

Unlike many attacks which are labor intensive for the cybercriminal, such as conducting reconnaissance operations to find exploitable bugs in software, address poisoning is a relatively low-cost and low-effort attack. The attacker’s most likely goal is financial gain by absconding with unsuspecting users’ cryptocurrency, which gives address poisoning attacks an excellent return on investment [9]. Other motivations may be political or ideological. Many businesses, political organizations, or non-profits accept cryptocurrency, and hacktivists may use address poisoning to impact the organization’s income stream. Or some attackers may simply want to sow distrust in an exchange, wallet, or even an entire blockchain network.

3 Case Studies of Address Poisoning Attacks

Address poisoning victims include both major and minor investors, law enforcement agencies, financial institutions, and even criminal networks. We will now explore several incidents of address poisoning to demonstrate how valuable cryptocurrency assets can be lost to this type of attack.

Figure 1: The blockchain security firm CertiK announced that a cryptocurrency whale was the victim of an address poisoning attack. [3]

Figure 2: A blockchain tracker documents the victim’s legitimate and poisoned address transactions. The addresses outlined in green indicate a transaction from this account to a trusted address, while the addresses outlined in red are for a transaction from a phishing address to this account. [1]

One notable case of address poisoning was reported in early May, 2024 (Figure 1) [1]. The blockchain security firm Certik reported [3] a poisoning attack where a major investor transferred 1,155 Wrapped Bitcoin (WBTC) valued at more than $69M. The attacker sent a small, malicious transaction which had a value of 0 ETH and a gas fee of approximately $0.65 to put their poisoned address in the victim’s transaction history, and only had to wait for the victim to copy and paste the address (Figure 2). The attacker swapped the 1,155 WBTC for 22,955 ETH, and distributed those funds to hundreds of other addresses. The victim sent the following message to the attacker through Ethereum’s Input Data Messaging System [10]: “You won bro. Keep 10% to yourself and get 90% back. Then we’ll forget about that. We both know that 7m will definetely make your life better, but 70m won’t let you sleep well.” After the victim made further attempts to communicate with them, the attacker began to send funds back to the victim (Figure 3) [12].

Figure 3: The victim and attacker negotiated a return of stolen cryptocurrency funds [12].

The Denver, Colorado FBI Office issued a warning in April, 2024 to warn cryptocurrency users to be wary of address poisoning attacks using token impersonation scams [6]. Their warning references an incident where a Colorado-based investor lost more than $2M to a stable coin investment scam, for which address poisoning and token impersonation were critical elements. The Denver FBI did not provide further information on this particular case.

The US Drug Enforcement Agency (DEA) fell victim to an address poisoning attack during the summer of 2023, losing more than $50,000 of cryptocurrency that had been seized as the result of a 3-year money laundering investigation [2]. The DEA had seized approximately $500,000 of Tether from Binance accounts which were allegedly used for laundering illegal narcotics proceeds. Those funds were sent to DEA-controlled hardware wallets and placed into a secure facility. A scammer was monitoring the Tether network and observed the DEA sending a small amount of Tether to the US Marshals Service, per standard forfeiture processing. The scammer promptly set up an address which closely resembled the US Marshals address, and airdropped the fake address into the DEA’s account which looked like the test payment made to the US Marshals. The US Marshals eventually noticed what had happened and alerted DEA personnel, who contacted Tether in an effort to freeze the fake account. However, the funds had already been converted to other cryptocurrencies and moved to new wallets. The agents reportedly only checked the following digits of the poisoned address, which demonstrates how many of these attacks can be easily avoided.

The cryptocurrency wallet-draining group Pink Drainer lost 10 ETH, valued at approximately $30,000, to an address poisoning attack in June, 2024 [7]. The attacker sent funds from an address which matched the leading 6 and following 6 digits of Pink Drainer’s previous wallet address (Figure 4). This attack came only a few months after Pink Drainer announced their retirement. Further information on the incident is not readily available.

Figure 4: The real and poisoned cryptocurrency addresses used in the attack on wallet draining group Pink Drainer [7].

4 Defending Against Address Poisoning Attacks

The case studies above demonstrate how easily users can be duped by address poisoning attacks, as well as how simple cryptocurrency hygiene can guard against becoming a victim [14]. Address poisoning attacks count on user laziness and preference for quick conveniences. Users always verify the full addresses that they wish to transact with and never rely solely on matching the leading or following address characters. Users should also pass on the convenience of copying and pasting or auto filling addresses from their transaction history, as these short cuts increase the risk of falling victim to an address poisoning scam.

While individual users practicing good cryptocurrency hygiene will limit exposure to address poisoning, there are important technical solutions which wallet developers and exchanges can institute to minimize the risks of users sending funds to poisoned addresses. Wallets and exchanges could give users the option to save verified addresses, which would reduce the need to copy and paste from transaction histories. Wallets can also warn users about detected dusting transactions, as well as give them the ability to sandbox or isolate dusted or impersonated tokens. Wallets and exchanges can interface with blockchain analytics and intelligence services to detect and block addresses known to be associated with address poisoning scams.

5 Conclusion

This blog article is the first in a series on emerging threats within the cryptocurrency ecosystem, and introduces the reader to address poisoning attacks. We covered the basic processes of the attack including the creation of poisoned addresses and dusting transactions, which scammers will use to get into wallet transaction histories. We surveyed several notable address poisoning attacks, and discussed mitigation strategies which can help cryptocurrency users minimize their risk of becoming the victim of one of these attacks.

Address poisoning is a subtle but effective attack that takes advantage of the inherent trust cryptocurrency users place in their transaction histories. Attackers sending small dust transactions and generating similar looking addresses, deceive users into sending cryptocurrency to malicious addresses, causing financial loss and eroding trust in the ecosystem. These attacks have resulted in millions of dollars worth of stolen cryptocurrency in the past couple of years, with victims ranging from investors, to law enforcement agencies, to other criminals. Users can reduce their risk of falling victim to an address poisoning attack by practicing good cryptocurrency hygiene (for instance, verifying the full address to which funds are being sent, rather than only checking the leading and following characters). However, the attack offers a favorable return on investment for the attacker, and so it is expected that address poisoning will remain a persistent threat as blockchain technology and cryptocurrency adoption continues.

References

[1] Behnke, R. Massive $68m address poisoning hack underscores ongoing cyber threat. Halborn (May 8, 2024). https://www.halborn.com/blog/post/massive-68-million-address-poisoning-hack-underscores-ongoing-cyber-threat.

[2] Brewster, T. The DEA accidentally sent 50, 000of seized cryptocurrency to a scammer. Forbes(August24, 2023). https://www.forbes.com/sites/thomasbrewster/2023/08/24/dea-accidentally-sends-50000-in-drug-proceeds-to-crypto-scammer/

[3] CertiK. Certik alerts tweet, May 3, 2024. https://x.com/CertiKAlert/status/1786378165050306774.

[4] Froehlich, M., Hulm, P., and Alt, F. Under pressure. a user-centered threat model for cryptocurrency owners. In Proceedings of the 2021 4th International Conference on Blockchain Technology and Applications (2021), pp. 39–50.

[5] Islam, M. M., Islam, M. K., and Hammoudeh, M. High-speed secure vanity address generator for user convenience in blockchain networks. In 2023 Fifth International Conference on Blockchain Computing and Applications (BCCA) (2023), IEEE, pp. 97–103.

[6] Migoya, V. Fbi warns of cryptocurrency token impersonation scam, April 26, 2024. https://www.fbi.gov/contact-us/field-offices/denver/news/fbi-warns-of-cryptocurrency-token-impersonation-scam.

[7] Mitchel Hill, T. Karma served: Pink drainer gets hit with address poisoning scam. Cointelegraph (July 8, 2024). https://cointelegraph.com/news/pink-drainer-hit-with-address-poisoning-scam.

[8] Narayanan, A. Bitcoin and cryptocurrency technologies: a comprehensive introduction. Princeton University Press, 2016.

[9] Nolasco Braaten, C., and Vaughn, M. S. Convenience theory of cryptocurrency crime: A content analysis of us federal court decisions. Deviant Behavior 42, 8 (2021), 958–978.

[10] Protos Staff. Refund of $70m ‘address poisoning’ scam ongoing, over 50% returned. Protos (May 10, 2024). https://protos.com/refund-of-70m-address-poisoning-scam-ongoing-over-50-returned/.

[11] Scharfman, J. Wallet drainers, crypto stealers and cryptojacking. In The Cryptocurrency and Digital Asset Fraud Casebook, Volume II: DeFi, NFTs, DAOs, Meme Coins, and Other Digital Asset Hacks. Springer, 2024, pp. 271–306.

[12] SlowMist. The attackers behind the 1155 $wbtc phishing incident appear to be returning the funds., May 10, 2024. https://x.com/SlowMistT eam/status/1788847044632920238.

[13] Xia, P., Wang, H., Gao, B., Su, W., Yu, Z., Luo, X., Zhang, C., Xiao, X., and Xu, G. Trade or trick? detecting and characterizing scam tokens on uniswap decentralized exchange. Proceedings of the ACM on Measurement and Analysis of Computing Systems 5, 3 (2021), 1–26.

[14] Zubic, E. How a few characters could cost you your crypto: The address poisoning threat. Medium (May 11, 2024). https://medium.com/coinmonks/how-a-few-characters-could-cost-you-your-crypto-the-address-poisoning-threat-97b62b9

1 Introduction

Blockchain technology utilizes cryptographic protocols [46] such as hash functions and digital signature schemes to verify and record transactions in a distributed manner. These protocols are well-established within the field, so much so that most of any blockchain’s cryptographic fundamentals are sufficiently covered in most undergraduate introductory cryptography courses [34]. This use of cryptography for recording blockchain transactions has led to the misconception that users are anonymous, rather than pseudonymous, and this made the cryptocurrency ecosystem attractive to members of illicit economies. This belief that the use of cryptographic protocols and confusing pseudonymity for anonymity has enabled law enforcement agencies to shut down dark web markets, as well as identify, arrest, and prosecute criminals all over the world. However, as legal economic activities incorporate blockchain technology, there is increased interest in the privacy protections afforded by modern cryptography and how these newer cryptographic primitives may be integrated into blockchain protocols.

This blog article delves into modern cryptography, specifically Fully Homomorphic Encryption (FHE), Multiparty Computation (MPC), and Zero-knowledge Proofs (ZkPs), as well as how they are being used by blockchain developers within the cryptocurrency ecosystem. FHE is a cryptographic primitive which enables computations on encrypted data. MPC allows for collaborative computation while protecting the privacy of individual contributors. ZkPs give one party the ability to verify the validity of a statement by another party without leaking any further information. Each of these cryptographic primitives will be described in greater detail below. However, we will endeavor to avoid too much mathematical rigor, and will provide references for readers so inclined to pursue it.

The duration of this article is organized as follows: Section 2 will give background information on the cryptographic primitives above, along with information on leading software libraries. Section 3 will survey how these modern cryptographic protocols are being used by blockchain developers to improve data privacy within the cryptocurrency ecosystem. Finally, concluding remarks will be given in Section 4.

2 Modern Cryptography

Cryptography [34] is the ancient mathematical art and science of protecting information from adversarial attacks. In many cases, these protocols take structured data and make it appear as random noise [29]. We have covered cryptographic basics in a previous blog post [30], and so we refer readers there rather than rehash it here. However, before we introduce several modern cryptographic protocols, we must discuss general scenarios where cryptographic techniques are employed, as well as cover two cryptographic techniques which are critical to blockchain functionality: hash functions and digital signatures.

There are three general scenarios where we would like to employ cryptographic techniques for data protection [9]: data-at-rest, data-in-transit, and data-in-use. Data-at-rest protection refers to protecting data in storage, often using a symmetric encryption protocol. An example of this scenario is the full disk encryption capability that is available on many personal computers. Data-in-transit protection can be seen as encrypting a data object for the purposes of communication with another entity, utilizing asymmetric cryptographic or key exchange protocols. Any person ordering a product through an Internet-based marketplace is using data-in-transit protection.

The protection of data-in-use [55] is a scenario that falls very much within the broader scope of this article. Classic cryptography has largely solved the problems of protecting data-at-rest and data-in-transit; but if we wanted to actually use those data objects for any kind of work, then we were required to decrypt that data and operate on that as a plaintext object. A major focus on modern cryptography is enabling meaningful computation on encrypted data without compromising data protection.

Cryptographic hash functions [53] convert an input into a fixed-length output, usually compressing a larger input into a much smaller output. The key aspect of hash functions is the reliance of an “avalanche effect,” wherein miniscule changes in the input create significant differences in the output. This leads to a characteristic called collision resistance, which means that it is highly unlikely for two different input values to generate identical outputs. For this reason, hash functions are commonly used for software security. Many software companies will provide customers a hash value to ensure that they downloaded an officially sanctioned piece of software, rather than a counterfeit copy that is infected with malware. Hash functions are used in cryptocurrencies like Bitcoin to create tamper-evident log, which means that an adversary cannot alter data earlier in the chain without being detected by every other node on the network.

Digital signatures [4] are an asymmetric cryptographic primitive that are analogous to a person’s handwritten signature, and used to verify the authenticity of a message being sent. A message is signed with a secret key and verified with the corresponding public key. A desirable characteristic for a digital signature is unforgeability, which is to say that an adversary cannot learn the signer’s secret key, even with access to some large (but finite) number of signed messages. Cryptocurrency networks such as Bitcoin and Ethereum use the Elliptic Curve Digital Signature Algorithm (ECDSA) [22], a well-established and standardized digital signature scheme to sign transactions on their respective blockchains.

2.1 Fully Homomorphic Encryption

The first modern cryptographic primitive that we will discuss is Fully Homomorphic Encryption (FHE). Without getting bogged down in mathematical formalism, a homomorphism can be thought of as a structure-preserving relationship. Given a function f and an operation +, then f (a + b) = f (a) + f (b). In the context of cryptography [31], a homomorphism would enable ENC(a + b) = ENC(a) + ENC(b). In fact, Rivest, Adleman, and Dertouzos theorized in the late ‘70s that this should be possible based on the underlying mathematics of the RSA protocol [52]; they used the term “privacy homomorphisms.” The coming years saw the development of Partially Homomorphic Encryption protocols, which could be used for computation over encrypted data with a single operation (e.g., an operation corresponding to addition or multiplication, but not both). FHE, which would allow for an arbitrary number of encrypted additions and multiplications, was seen for decades as one of Cryptography’s “Holy Grails [42].”

Craig Gentry developed the working FHE scheme in 2009 [24], which led to a subsequent explosion of FHE schemes and software libraries. At the present time, all FHE schemes are built on variants of a hard lattice problem known as the Learning With Errors (LWE) problem [51], which can be thought of as a noisy least squares regression over a finite field. Because of the hardness of LWE, FHE schemes are believed to be resistant to quantum computer-based attacks. (It is worth noting that the LWE problem also underpins the CRYSTALS post-quantum cryptography schemes [2], which NIST has published as standards [47, 48].) There are three general classes of FHE schemes [31]:

• Boolean arithmetic schemes represent plaintext values as bits, and computations as Boolean circuits.
• Modular arithmetic schemes represent plaintext as integers modulo a plaintext modulus “t”, and express computations as integer arithmetic circuits mod t.
• Approximate arithmetic schemes represent plaintext data as real or complex numbers, and computations are similar to floating point arithmetic.

Each of these scheme classes have their strengths, as well as scenarios where they will perform optimally. For instance, approximate arithmetic schemes are popular for encrypted machine learning. On the other hand, Boolean arithmetic schemes perform certain operations such as comparison (i.e. less/greater than) efficiently, while these operations are much more difficult to perform with other schemes.

FHE’s early days were marred by incredibly slow computations, with even relatively simple computations being many orders of magnitude too slow for practical application [45]. These slower computation speeds are one of the major impediments to widespread adoption of FHE, and the United States Government has made considerable investments in improving FHE’s computational performance. This includes funding for major fundamental and applied research programs such as DARPA’s PROCEED [19] and DPRIVE [20] programs, as well as IARPA’s HECTOR [33] program. As a result of these efforts, homomorphically encrypted computations have gone from taking days to compute, to often taking minutes. While these improvements are still too slow for many real-world applications [27], FHE now performs at a level where it can be a significant value add to many commercial applications.

There are two professional organizations organized by FHE researchers, the Homomorphic Encryption Standardization Consortium [32], and FHE.org [23]. Participants in the Standardization Consortium include leading researchers from academia, industry R&D firms, and relevant government agencies and standardization organizations. They have produced a security standard document and are spearheading standardization through international organizations such as ISO/IEC. FHE.org, loosely associated with the Swiss company Zama, is based in Europe and hosts monthly symposiums which are open to any interested person. They also host an annual conference which is affiliated with IACR conferences; however, they do not focus on standards documentation.

Software libraries have been developed by teams in the United States, Europe, and the Republic of Korea. Most of these libraries are written in C++, though there are other languages used as well. Microsoft SEAL [54], OpenFHE [5], HElib [28], TFHE [15], HEEAN [18] are all written in C++, and many of these libraries have sanctioned Python or Rust wrappers. Lattigo [1] is written in Go, while Zama has developed many libraries, including a Boolean Arithmetic library in Rust [62]. Some of these libraries are actively maintained open source projects, while others have been transitioned into proprietary enterprises. Support for developers wishing to use these libraries in their projects will find that available documentation and community assistance is variable, but OpenFHE and Zama certainly have active development communities with forums where people can ask for help, as well as share their project successes.

FHE enables companies to outsource computationally expensive data processing services such as commercial cloud computing platforms while protecting sensitive data. There are cases where machine learning models are trained to run on encrypted data [59]; similarly, there are also instances where a machine learning model may itself be encrypted to protect proprietary information. FHE can be used by law enforcement investigators to make certain encrypted queries against databases [35], minimizing the risk that the database owner will know about the query subject or what result was rendered. Researchers have also shown that FHE is viable for defending data flows in cyber-physical systems [13]. As FHE is believed to be resistant to quantum attacks, use cases will likely emerge that don’t inherently require computation, but will benefit from the added security provided by a lattice-based cryptography scheme.

As FHE is a very recent achievement, accessible literature is somewhat limited. The topic is briefly mentioned in Katz’s textbook [34], but otherwise the majority of available literature comes from journal articles and refereed conferences. However, the Standardization Consortium has published a relatively accessible book [38] which includes an introduction to FHE schemes, the security standard document, along with many chapters on use case scenarios.

2.2 Multiparty Computation

Multiparty Computation (MPC) [17] is another cryptographic primitive which enables several different parties to collaboratively compute a function over their inputs, while keeping the value of their individual inputs secret. This class of cryptographic protocols was first introduced as a two-party protocol by Andrew Yao [60, 61], dubbed the “Garbled Circuit.” The garbled circuit treats computations as Boolean circuits with AND and XOR operations, in combination with other cryptographic protocols such as AES. Yao’s original protocol was limited to two parties, with later research expanding it to multiparty settings, as well as to arithmetic circuits [7].

The fundamental building [16] blocks for MPC schemes include commitments, which make it difficult for an adversary to tell the difference between two messages, and secret sharing schemes, which distribute a secret s and distribute it among n parties. Linear secret sharing schemes allow parties to compute linear functions on secret values, and there are a number of such schemes based on a desired security model (e.g., a semi-honest vs. a malicious adversary). A final cryptographic primitive for MPC is oblivious transfer, wherein a sender transfers information to a receiver; but, as the name indicates, the receiver does not know what information they have received.

Several mature MPC frameworks are widely available, including SCALE-MAMBA [37] and MP-SPDZ [36]. MAMBA is a Python-like frontend language which compiles into bytecode, while SCALE is the runtime where those bytecodes are executed. MP-SPDZ supports more than 30 MPC variants with a programming interface that is very similar to Python. Underlying protocols supported include garbled circuits, secret sharing, oblivious transfer, and some homomorphic encryption. MP-SPDZ is heavily used in machine learning cases where sensitive information must be protected.

MPC protocols are far more mature than FHE, and there are a wealth of resources that are publicly available. These range from refereed literature in the form of journal articles and refereed conference papers, textbooks, and software libraries. In terms of instructional textbooks, Cramer, et al.’s Secure Multiparty Computation and Secret Sharing [17] is well organized and relatively accessible to somebody who has taken an undergraduate-level cryptography course. Both SCALE-MAMBA and MP-SPDZ are available in publicly accessible repositories. Moreover, there is at least one professional organization that focuses on MPC, the MPC Alliance [44]. The Alliance consists of academic researchers and industry practitioners from around the world.

2.3 Zero-knowledge Proofs

Zero-knowledge Proofs [39] (ZkPs) are a cryptographic primitive which enables one party to prove the veracity of a computational statement to another party, without revealing any further information about that statement. ZkPs were introduced by Goldwasser, Micali, and Rackoff [26] in the late ‘80s, where they introduced an interactive proof system, by which a prover convinces (with high probability) a verifier as to the correctness of a mathematical statement. This may involve multiple rounds of interaction between the prover and verifier. More recent research has led to advances to make these proofs more computationally efficient, non-interactive proofs [3] such as SNARKS [12], STARKS [8], and BulletProofs [10], to name a few. Non-interactive in this context means that the prover sends only one message, and there is no possibility of interaction between the prover and verifier.

There are several prominent non-interactive proof protocols, such as:

• The Fiat-Shamir Heuristic [11] uses digital signatures or hash functions to make interactive proofs non-interactive. The prover sends a commitment to the verifier and computes a challenge of the hash of the commitment, then sends the challenge response and the original commitment to the verifier.
• zk-SNARKs give a prover the ability to prove to the verifier that they know the solution to a mathematical problem without revealing the solution itself. zk-SNARKs offer succinct, efficient proofs, often less than a kilobyte irrespective of the complexity of the statement being proven. These proofs require complicated mathematical techniques such as pairing-based cryptography, quadratic arithmetic programs, and require trusted setup phase.
• zk-STARKs make several improvements on zk-SNARKs by not requiring a trusted setup phase and allowing the simultaneous verification of multiple statements, thus greatly improving upon the efficiency of zk-SNARKs.

There is a professional organization comprised of academics and industry practitioners, ZK Proof [64], which is focused on developing formal standards in collaboration with organizations like NIST. They host an annual workshop where recent advances in the field are reviewed, and strategic moves are planned as they pursue the further development of standardization documentation. Additionally, they serve as a repository for a curated body of knowledge on ZkPs, including textbooks [57, 14], refereed literature, and software tools.

3 Modern Cryptography and its Integration into the Cryptocurrency Ecosystem

Now that we have given introductions to FHE, MPC, and ZkPs, we are now ready to survey how various cryptocurrency projects and blockchain platforms are utilizing these cryptographic protocols. ZkPs and MPC, being more mature protocols, have seen wider use than FHE. However, the excitement over FHE’s capabilities has led to R&D efforts that show great promise, including here at CAT Labs.

ZkPs see widespread use within the cryptocurrency ecosystem [56]. Perhaps the most high profile example of this is the use of zk-Rollups on Ethereum and other smart contract platforms [25]. zk-Rollups aggregate multiple transactions into a single proof, which improves network scalability by reducing the amount of information which must be stored on-chain, while ensuring that the underlying transaction data is valid. ZkPs are also prominent within privacy-focused cryptocurrencies like ZCash [6]. ZCash uses zk-SNARKS to hide transaction details, including the identities of the sender and receiver, as well as the transaction amounts, from public view, while confirming the transaction validity on the network.

Cryptocurrencies are popular among criminals for their ability to transfer funds almost globally, enabling illicit economic activities like money laundering. ZkPs are an important tool in combating money laundering operations while protecting the privacy of legitimate blockchain network users. Financial institutions are bound to regulatory compliance regimes via anti-money laundering (AML) and know your customer (KYC) laws. There is a sense of tension between AML/KYC compliance and other data privacy requirements (e.g., GDPR) [50], and ZkPs offer a technically sound methodology to balance these regulations [41]. ZkPs enable financial institutions to confirm that transactions have been vetted according to AML requirements, even though customer information and transaction details are kept hidden. Similarly, financial institutions can utilize ZkPs to allow customers to prove KYC details such as age or citizenship without revealing any underlying data.

Key generation and key management are a perennial challenge for asymmetric cryptographic systems, and this carries over to the cryptocurrency ecosystem. As the maxim goes, “not your keys, not your crypto.” Private keys are used to sign transactions, and so there it is prudent for financial institutions, which control millions or billions of dollars’ worth of cryptocurrency assets, to require multiple signatories for transactions. MPC [21] offers institutions the ability to split private keys into n pieces and share portions of those keys among a set of authorized signers. Those institutions then require multi-signature protocols such as a threshold signature scheme, which require a minimum number t of n of signatures to allow a transaction. This has proven to be an effective defense against hackers gaining access to and absconding with institutions’ cryptocurrency assets, though it is worth noting that even cryptographically sophisticated MPC wallets may have vulnerabilities under certain conditions [40].

FHE emerged at roughly the same time as blockchain technology, and so it makes sense that cryptocurrency projects are interested in how to incorporate this technology. For instance, the cryptocurrency project NuCypher (now merged with the Threshold Network [58]) has experimented with FHE, even developing a Python-based Boolean arithmetic FHE library [49]. Threshold focuses on privacy-enhancing DAOs and integrating end-to-end encryption into dApps.

Zama has put a major focus on opportunities to employ FHE on the blockchain. They developed a homomorphically encrypted Ethereum Virtual Machine (fhEVM) [43], which supports running smart contracts on encrypted data. This supports confidentiality in transactions and other applications, including token/real-world asset swaps, private transfers, blind auctions, and e-voting. The company also hosted a bug bounty challenge to explore the possibility of homomorphically encrypted transaction signatures. This is important because there is research showing that even cryptographically sophisticated multi-signature wallets may be vulnerable to key reconstruction attacks, and a homomorphically encrypted ECDSA would make for an excellent safeguard against this risk. This challenge of a homomorphically encrypted ECDSA was successfully accomplished in 2023 [63], though with an extremely slow runtime, taking as long as two days on a 64-core machine.

While we cannot discuss it in-depth at this moment, CAT Labs is working to integrate FHE into cryptocurrency security. In this effort, we are interested in key management, with a focus on key backup and recovery. Additionally, we are designing tools to improve the robustness of cryptocurrency investigations by integrating FHE into tools which can protect cryptocurrency artifacts and other digital assets which are recovered from seized devices.

4 Conclusion

Blockchains and cryptocurrency rely heavily on various cryptographic protocols, and blockchain developers are constantly exploring how to integrate recent cryptographic advances into their projects and services. In this blog article, we introduced the reader to three of these modern cryptographic primitives: FHE, MPC, and ZkPs. With a goal of avoiding too much mathematical rigor, we briefly described cryptographic schemes and developed protocols. Finally, we briefly described how each primitive is used within the blockchain ecosystem.

While we have described three modern cryptographic primitives, it is important to remember that cryptography is a dynamic science, and advances occur every year. The primitives discussed in this article are hardly the only recent cryptographic advances to catch the eyes of blockchain developers, and many projects are experimenting with other protocols.

References

[1] Lattigo v5. Online: https://github.com/tuneinsight/lattigo, Nov. 2023. EPFL-LDS, Tune Insight SA.

[2] Crystals: Cryptographic suite for algebraic lattices, 2024. https://pq-crystals.org/.

[3] Aad, I. Zero-knowledge proof. Trends in Data Protection and Encryption Technologies (2023), 25–30.

[4] Aggarwal, S., and Kumar, N. Digital signatures. In Advances in Computers, vol. 121. Elsevier, 2021, pp. 95–107.

[5] Badawi, A. A., Alexandru, A., Bates, J., Bergamaschi, F., Cousins, D. B., Erabelli, S., Genise, N., Halevi, S., Hunt, H., Kim, A., Lee, Y., Liu, Z., Micciancio, D., Pascoe, C., Polyakov, Y., Quah, I., R.V., S., Rohloff, K., Saylor, J., Suponitsky, D., Triplett, M., Vaikuntanathan, V., and Zucca, V. OpenFHE: Open-source fully homomorphic encryption library. Cryptology ePrint Archive, Paper 2022/915, 2022. https://eprint.iacr.org/2022/915.

[6] Banerjee, A., Clear, M., and Tewari, H. Demystifying the role of zk-snarks in zcash. In 2020 IEEE conference on application, information and network security (AINS) (2020), IEEE, pp. 12–19.

[7] Bayatbabolghani, F., and Blanton, M. Secure multi-party computation. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security (2018), pp. 2157–2159.

[8] Ben-Sasson, E., Bentov, I., Horesh, Y., and Riabzev, M. Scalable, transparent, and post-quantum secure computational integrity. Cryptology ePrint Archive (2018).

[9] Bhatia, T., and Verma, A. Data security in mobile cloud computing paradigm: a survey, taxonomy and open research issues. The Journal of Supercomputing 73 (2017), 2558–2631.

[10] B¨unz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., and Maxwell, G. Bulletproofs: Short proofs for confidential transactions and more. In 2018 IEEE symposium on security and privacy (SP) (2018), IEEE, pp. 315–334.

[11] Canetti, R., Chen, Y., Holmgren, J., Lombardi, A., Rothblum, G. N., Rothblum, R. D., and Wichs, D. Fiat-shamir: from practice to theory. In Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing (2019), pp. 1082–1090.

[12] Chen, T., Lu, H., Kunpittaya, T., and Luo, A. A review of zk-snarks. arXiv preprint arXiv:2202.06877 (2022).

[13] Cheon, J. H., Han, K., Hong, S.-M., Kim, H. J., Kim, J., Kim, S., Seo, H., Shim, H., and Song, Y. Toward a secure drone system: Flying with real-time homomorphic authenticated encryption. IEEE access 6 (2018), 24325–24339.

[14] Chiesa, A., and Yogev, E. Building cryptographic proofs from hash functions, 2024. https://snargsbook.org/.

[15] Chillotti, I., Gama, N., Georgieva, M., and Izabach`ene, M. TFHE: Fast fully homomorphic encryption library, August 2016. https://tfhe.github.io/tfhe/.

[16] Cramer, R., Damg˚ard, I., and Nielsen, J. B. Multiparty computation, an introduction.

[17] Cramer, R., Damg˚ard, I. B., and Nielsen, J. B. Secure Multiparty Computation and Secret Sharing. Cambridge University Press, 2015.

[18] CryptoLab. Heaan private ai: Homomorphic encryption library, 2024. https://heaan.it/.

[19] Defense Advanced Research Projects Agency (DARPA). Programming computation on encrypted data (proceed), 2014.

[20] Defense Advanced Research Projects Agency (DARPA). Data protection in virtual environments (dprive), 2022.

[21] Eyal, I. On cryptocurrency wallet design. In 3rd International Conference on Blockchain Economics, Security and Protocols (Tokenomics 2021) (2022), Schloss-Dagstuhl-Leibniz Zentrum f¨ur Informatik.

[22] Fang, W., Chen, W., Zhang, W., Pei, J., Gao, W., and Wang, G. Digital signature scheme for information non-repudiation in blockchain: a state of the art review. EURASIP Journal on Wireless Communications and Networking 2020 (2020), 1–15.

[23] FHE.org. Fhe.org, 2024. https://fhe.org/.

[24] Gentry, C. A fully homomorphic encryption scheme. Stanford university, 2009.

[25] Gogol, K., Messias, J., Miori, D., Tessone, C., and Livshits, B. Quantifying arbitrage in automated market makers: An empirical study of ethereum zk rollups. arXiv preprint arXiv:2403.16083 (2024).

[26] Goldwasser, S., Micali, S., and Rackoff, C. The knowledge complexity of interactive proof-systems. In Proceedings of the seventeenth annual ACM symposium on Theory of computing (1985), pp. 291–304.

[27] Gong, Y., Chang, X., Miˇsi´c, J., Miˇsi´c, V. B., Wang, J., and Zhu, H. Practical solutions in fully homomorphic encryption: a survey analyzing existing acceleration methods. Cybersecurity 7, 1 (2024), 5.

[28] Halevi, S., and Shoup, V. Helib: an open-source software library that implements homomorphic encryption, 2023. https://github.com/shaih/HElib.

[29] Hallman, R. A. Poster evegan: Using generative deep learning for cryptanalysis. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (2022), pp. 3355–3357.

[30] Hallman, R. A. Neural cryptanalysis – an introduction to attacking cryptography with deep learning. CAT Labs Blog (February 9, 2024). https://catlabs.io/blog/neural-cryptanalysis-an-introduction-to-attacking-cryptography-with-deep-learning.

[31] Hallman, R. A., Laine, K., Dai, W., Gama, N., Malozemoff, A. J., Polyakov, Y., and Carpov, S. Building applications with homomorphic encryption. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (2018), pp. 2160–2162. http://homomorphicencryption.org/wp-content/uploads/2018/10/CCS-HE-Tutorial-Slides.pdf.

[32] Homomorphic Encryption Standardization Consortium. Homomorphic encryption standardization: An open industry / government / academic consortium to advance secure computation, 2024. https://homomorphicencryption.org/.

[33] Intelligence Advanced Research Projects Activity. Hector: Homomorphic encryption computing techniques with overhead reduction, 2019.

[34] Katz, J., and Lindell, Y. Introduction to modern cryptography: principles and protocols. Chapman and hall/CRC, 2007.

[35] Kaushik, A. R. Enhancing Privacy and Security in AI using Fully Homomorphic Encryption. PhD thesis, Faculty of the Graduate School of the University at Buffalo, The State . . . , 2024.

[36] Keller, M. MP-SPDZ: A versatile framework for multi-party computation. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (2020). https://github.com/data61/MP-SPDZ.

[37] KU Leuven-COSIC. Repository for the scale-mamba mpc system, 2022. https://github.com/KULeuven-COSIC/SCALE-MAMBA.

[38] Lauter, K. E., Dai, W., and Laine, K. Protecting privacy through homomorphic encryption. Springer, 2022.

[39] Li, F., and McMillin, B. A survey on zero-knowledge proofs. In Advances in computers, vol. 94. Elsevier, 2014, pp. 25–69.

[40] Makriyannis, N., Yomtov, O., and Galansky, A. Practical key-extraction attacks in leading mpc wallets. Cryptology ePrint Archive (2023).

[41] Malhotra, D., Saini, P., and Singh, A. K. How blockchain can automate kyc: Systematic review. Wireless Personal Communications 122, 2 (2022), 1987–2021.

[42] Micciancio, D. A first glimpse of cryptography’s holy grail. Communications of the ACM 53, 3 (2010), 96–96.

[43] Morten Dahl, Cl´ement Danjou, D. D. T. F. P. I. M. J. D. R. N. S. L. T. T. Confidential evm smart contracts using fully homomorphic encryption. Tech. rep., Zama, 2023.

[44] MPC Alliance. Mpc alliance, 2024. https://www.mpcalliance.org/.

[45] Naehrig, M., Lauter, K., and Vaikuntanathan, V. Can homomorphic encryption be practical? In Proceedings of the 3rd ACM workshop on Cloud computing security workshop (2011), pp. 113–124.

[46] Narayanan, A., Bonneau, J., Felten, E., Miller, A., and Goldfeder, S. Bitcoin and Cryptocurrency Technologies: A Comprehensive Introduction. Princeton University Press, 2016.

[47] National Institute of Standards and Technology. Fips 203: Module-lattice-based key-encapsulation mechanism standard, August 13, 2024.

[48] National Institute of Standards and Technology. Fips 204: Module-lattice-based digital signature standard, August 13, 2024.

[49] NuCypher. Nufhe, a gpu-powered torus fhe implementation, 2018. https://nufhe.readthedocs.io/.

[50] Poskriakov, F., Chiriaeva, M., and Cavin, C. Cryptocurrency compliance and risks: A european kyc/aml perspective. Blockchain & Cryptocurrency Regulation 2020 (2020).

[51] Regev, O. The learning with errors problem. Invited survey in CCC 7, 30 (2010), 11.

[52] Rivest, R. L., Adleman, L., Dertouzos, M. L., et al. On data banks and privacy homomorphisms. Foundations of secure computation 4, 11 (1978), 169–180.

[53] Rogaway, P., and Shrimpton, T. Cryptographic hash-function basics: Definitions, implications, and separations for preimage resistance, second-preimage resistance, and collision resistance. In Fast Software Encryption: 11th International Workshop, FSE 2004, Delhi, India, February 5-7, 2004. Revised Papers 11 (2004), Springer, pp. 371–388.

[54] Microsoft SEAL (release 4.1). https://github.com/Microsoft/SEAL, Jan. 2023. Microsoft Research, Redmond, WA.

[55] Sidorov, V., and Ng, W. K. Transparent data encryption for data-in-use and data-at-rest in a cloud-based database-as-a-service solution. In 2015 IEEE world congress on services (2015), IEEE, pp. 221–228.

[56] Sun, X., Yu, F. R., Zhang, P., Sun, Z., Xie, W., and Peng, X. A survey on zero-knowledge proof in blockchain. IEEE network 35, 4 (2021), 198–205.

[57] Thaler, J. Proofs, arguments, and zero-knowledge, 2023. https://people.cs.georgetown.edu/jthaler/ProofsArgsAndZK.pdf.

[58] Threshold Network. Threshold, 2024. https://threshold.network/.

[59] Xie, Q., Jiang, S., Jiang, L., Huang, Y., Zhao, Z., Khan, S., Dai, W., Liu, Z., and Wu, K. Efficiency optimization techniques in privacy-preserving federated learning with homomorphic encryption: A brief survey. IEEE Internet of Things Journal 11, 14 (2024), 24569–24580.

[60] Yao, A. C. Protocols for secure computations. In 23rd annual symposium on foundations of computer science (sfcs 1982) (1982), IEEE, pp. 160–164.

[61] Yao, A. C.-C. How to generate and exchange secrets. In 27th annual symposium on foundations of computer science (Sfcs 1986) (1986), IEEE, pp. 162–167.

[62] Zama. TFHE-rs: A Pure Rust Implementation of the TFHE Scheme for Boolean and Integer Arithmetics Over Encrypted Data, 2022. https://github.com/zama-ai/tfhe-rs.

[63] Zama. zama-ai/bounty-ecdsa-signature, 2023. https://github.com/zama-ai/bounty-ecdsa-signature.

[64] ZKProof. Zkproof standards: A global movement to standardize and mainstream advanced cryptography by building a community-driven trust ecosystem, 2024. https://zkproof.org/.

Decentralized Finance (DeFi) [32] is a financial paradigm built on blockchain technologies, which facilitates peer-to-peer transactions without centralized, institutional intermediary authority. DeFi services exist on most major blockchains that support smart contracts [31], and offer a wide range of services, including lending, borrowing, trading, and asset management. Due to the breadth and flexibility of financial services offered, DeFi platforms have grown in popularity for retail cryptocurrency investors, as well as with institutional investors who are exploring cryptocurrency-related business opportunities [21]. Irrespective of which blockchain a DeFi platform is located on, all DeFi protocols rely on smart contracts. Smart contracts are self-executing programs which automate transactions based on predefined rules. However, DeFi is a relatively new world which has been populated by early adopters, and whose priorities revolve around making timely and profitable transactions; it is to be expected that bad actors would be attracted to these platforms [41].

This article explores the use of game theoretic cyber deception [23] as a cybersecurity strategy for the DeFi ecosystem. Cyber deception refers to creating false information to mislead attackers, either wasting their time or manipulating their behavior; it is a promising approach to network security. Deception strategies have famously been deployed against adversaries in military operations throughout history, and these successes give hope that cyber deception strategies will prove effective in mitigating the risks posed by malicious actors in the DeFi space. Game theory [19] is a branch of mathematics which models and quantifies strategic decision making, focusing on maximizing rewards and minimizing losses.

The remainder of this article is organized as follows: Section 2 presents background information, including on the DeFi ecosystem, a terse introduction to game theory, and a brief survey of cyber deception. Section 3 discusses cyber deception in the DeFi space, and concluding remarks are given in Section 4.

2 Background

2.1 Decentralized Finance

Traditional financial [24] systems rely on gatekeeping and trusted, centralized authorities to oversee all aspects of transactions, valued on the order of trillions of Dollars each day. DeFi [31] on the other hand, is designed for transactions which take place on blockchain networks which support smart contracts (e.g., Ethereum, Cardano, Algorand, etc.). DeFi platforms are designed to operate on trustless networks, and exhibit almost no gatekeeping. DeFi services process daily transactions valued at more than hundreds of billions of Dollars–a substantial amount of money, but dwarfed by the traditional financial ecosystem.

Just as there are malicious actors within traditional finance, DeFi has attracted a criminal element who blend in with legitimate users [41]. Criminal actors [38] in the DeFi space may be attempting to launder ill gotten crypto from elsewhere, but many bad actors are actively trying to steal funds from honest users. Examples of attackers attempting to steal funds from others on the DeFi platform may include:

• Flash loans [7], where an attacker exploits the protocol by borrowing large, uncollateralized loans in order to manipulate asset values and drain liquidity pools;
• Rug pulls [35] and honeypot traps [10], where an adversarial actor creates a fraudulent DeFi project which artificially inflates the value of native tokens, and then promptly abandons the project leaving victims with worthless tokens (“Honeypot” is a term with multiple meanings, depending on the context. Within DeFi the security literature, a honeypot usually refers to a type of scam that is similar to a rug pull. Henceforth, we use the term exclusively to refer to a cyber deception technology.);
• Vulnerable smart contract code exploitation [30], where bugs and errors are discovered within smart contract code, and an adversary uses these vulnerabilities to steal funds, manipulate the protocol, or otherwise disrupt the platform’s standard functions.

2.2 Game Theory

Game theory [19] is a branch of mathematics which formalizes and quantifies strategic decision making. It was developed by John Nash and others in the mid Twentieth Century, and has heavily influenced many other fields, including computer science [28], economics [29], logic [5], and even the biological sciences [11]. Players in such a game seek an equilibrium [15], that is, a scenario where each player has chosen an optimal strategy and no player would benefit from changing their gameplay strategy.

Game theorists have developed many classes of games; however, we will cover three classes of games which are relevant to cyber deception.

• Stackelberg games [4] involve a leader and a follower, with each player taking an action in sequence (i.e. the leader makes their move, then the follower responds, and so on).;
• Nash games [13] occur when players make their moves simultaneously, implying that each player is committed to their strategy without prior knowledge of their opponent’s move;
• Signaling games [34] have a sender and a receiver, with the sender having access to information that the receiver does not. The sender may be benign or malicious, and the receiver’s goal is to determine whether the sender is benign or malicious. 

There are many real world or logical games which can be mapped directly to these classifications. For instance, chess or checkers are plainly instances of Stackelberg games, while logic games like the prisoners’ dilemma [26] and knights and knaves [27] are instances of Nash games and Signal games, respectively.

2.3 Cyber Deception

One of the fundamental assumptions of communication is that of truthfulness [18]. Deceptions are instances where a sender intentionally passes a false message to a receiver, with the given purpose of the receiver developing a false belief state. Poker players will ‘bluff’ in order to intimidate an opponent into not playing a stronger hand [22]. In higher stakes circumstances, the Allied Forces staged elaborate deceptions in order to lure the NAZI forces away from Omaha Beach [33], and to lure Axis forces away from Sicily [20].

Cyber deception strategies could be classified as active security (as opposed to traditional, passive security strategies) [6]. A cyber deception strategy seeks to manipulate what an adversary learns during the reconnaissance phase of an attack. Common deception methodologies include [23]:

• Moving target defenses reconfigure network assets, including defensive tools, in order to hamstring what an adversary can learn during attack reconnaissance;
• Mixing involves utilizing exchange systems in order to prevent an adversary from learning direct linkages between systems;
• Perturbation defenses insert noise in order to limit the leakage of sensitive network information;
• Honey-X defenses use technologies such as honeypots, honeynets, and honey patches which appear to the attacker as legitimate network assets, but include advanced monitoring capabilities that allow defenders to observe and learn information about the attacker;
• Obfuscation wastes an attacker’s time by directing them to decoys, as opposed to legitimate network assets, or intermixing fraudulent information with legitimate files;
• Attacker engagement defenses use active feedback to waste an attacker’s time and allow network administrators an opportunity to conduct defensive operations.

3 Game Theoretic Cyber Deception

Cyber deception strategies have not been deployed in the DeFi sector at any notable scale. In fact, searching through services like Google Scholar with search terms like “cyber deception, decentralized finance” turn up refereed research papers on common schemes that attackers may use to steal funds from legitimate users. Refining search terms to “blockchain honeypot” return a few articles describing honeypots used for blockchain security; however, the overwhelming majority of search results relate to scams targeting legitimate users. The use of cyber deception strategies as a tool to fight scammers and other criminals who target DeFi users will be fertile ground for research and development for the foreseeable future. We will therefore primarily discuss several possible possibilities for integrating cyber deception capabilities into DeFi security.

3.1 Honeypots

Honeypots [16] are relatively mature technologies, and “high interaction” honeypots which could be used to create fake smart contracts and DeFi protocols which look attractive to an attacker. High interaction honeypots provide attackers with real, live systems to attack, as opposed to “low interaction” honeypots. High interaction honeypots have seen real world deployment across a variety of sectors, including enterprise networks [17], as well as Internet of Things [9], and even within more fragile networks as would be found in industrial control systems [8].

Hara, et al. [12] developed honeypots to mimic vulnerable nodes on the Ethereum blockchain in order to understand the behavior of malicious users on the network. They created vulnerable GETH nodes on an Ethereum Testnet with an open port that is used on both the Mainnet and Testnet. They were able to correlate certain network traffic with known malicious IP addresses. Moreover, the authors were able to trace some network traffic to IP addresses which communicate with dark web entities for attacks on the Ethereum blockchain. More recently, Uchibori, et al. [36] demonstrated a remote procedure call (RPC) honeypot, which associated itself with Ethereum wallets of variable values. This experimentation led the authors to develop new RPC responses to reduce the risk of cryptocurrency theft by the attacks that they observed.

As honeypot technology has matured and seen real world deployment, the science of honeypot detection has matured as well. Companies like Shodan [1] market capabilities to score the likelihood that an IP address belongs to a honeypot versus a legitimate network asset. This has led to a great deal of research in making it more difficult to discern between the two, whether that involves making a honeypot look more like a legitimate asset or making a legitimate asset look more like a honeypot [3, 2].

For a game theoretic analysis of honeypots in this scenario, consider a simplified two-player game where the defender deploys a honeypot (H) alongside a legitimate asset (NH), and the attacker chooses whether to attack the legitimate asset (LA), the honeypot (HA) (not knowing that it is a honeypot), or not attack either. These interactions can be modeled with a payoff matrix (Figure 1) where DL represents the defender’s loss if a legitimate asset is attacked, AG represents the attacker’s gain by attacking a legitimate asset, DG represents the defender’s gain by learning information about the attacker through the honeypot, info denotes a loss for the attacker due to wasted time attacking the honeypot, DN represents a loss value for both parties if no attack occurs.

Figure 1: A profit matrix for honeypot deployment.

3.2 Misinformation

Defenders can use strategic misinformation campaigns [42] (for instance, spreading fraudulent information in dark web forums where malicious actors are known to congregate) which will lead attackers into false belief states about the DeFi protocol. This might lead an attacker to deploy an ineffective attack, or even discourage them from attacking altogether.

This game can be modeled with a payoff matrix where the defender chooses to spread misinformation (M) or not (NM), and the attacker decides whether to attack a vulnerable protocol (V) or a non-vulnerable protocol. DM denotes the defender’s cost of deploying misinformation, cost refers to the attacker’s wasted time and resources after being led to attack a non-vulnerable protocol by the misinformation campaign. DV denotes the defender’s loss if the attacker targets a vulnerable protocol, and AG represents the attacker’s gain from attacking the vulnerable protocol. As above, DN denotes a loss value for both parties if there is no attack. Game theoretic analysis will inform defenders as to the effectiveness of misinformation campaigns based on the cost of the campaign and its potential for deterring attacks.

Figure 2: A profit matrix for deployment of a misinformation campaign.

3.3 Obfuscation

Blockchains and distributed ledger technology are renowned for the transparency and immutability of transaction records, so it is an open question whether obfuscation is a legitimate strategy for defending against bad actors on DeFi platforms. For instance, could a defender create misleading or fake transaction data onto a blockchain network in order to obscure legitimate activity within a DeFi exchange. Such a strategy would make it more difficult for attackers to manipulate markets or find and exploit vulnerable protocols. However, the deployment of obfuscation strategies on a blockchain runs the risk of reducing trust in the DeFi platform among legitimate traders, and so this approach might end up being counterproductive.

3.4 Attacker Engagement

Recent advances in artificial intelligence, in particular the explosion of chatbots thanks to large language models (LLMs) [39], present defenders with new opportunities for attacker engagement. LLM-based chatbots are trained to generate realistic and truthful looking outputs; however, these technologies do not have any actual concern with ground truth [14]. Often called “hallucinations,” these realistic looking generations have led to embarrassing episodes. Several lawyers have been sanctioned for using LLMs to write legal briefs that included erroneous case law ([37]for example). In another incident, an article from a refereed journal was lampooned and retracted when it became apparent that the authors used a LLM chatbot to write a convincing introductory section of their article [40].

There is a growing body of research on how well LLM-based chatbots can mimic network assets to waste an attacker’s time. For instance, Ragsdale and Boppana [25] propose a GPT-based honeypot which can more realistically mimic a legitimate network asset to engage with an attacker over a longer period, without increasing risk to the overall network. They conducted experimentation to compare their GPT honeypot against another, established honeypot that is available on the market. While their GPT honeypot generally was generally superior to the commercially available honeypot, they did note several limitations which require more research and development before LLM-based honeypots are ready for large scale deployment. These limitations include response timing, as well as non-deterministic and unverifiable response outputs (i.e. hallucinations) which could lead an attacker to believe that they are not interacting with a legitimate asset.

4 Conclusion

Decentralized ledger technologies such as blockchain networks and smart contract platforms are revolutionizing business operations across multiple sectors, bringing in new financial paradigms like DeFi. These new financial systems are built on smart contracts and mostly open, trustless networks are opening up an ecosystem for financial transactions to users who were previously shut out from many traditional financial systems. However, DeFi and blockchain networks have also attracted bad actors who seek financial benefits by stealing assets from legitimate, but often unsophisticated users. Despite the presence of these malicious users, DeFi platforms are booming, even attracting users from traditional financial institutions. However, developers must create robust defenses against bad actors to reduce the risks of cryptocurrency theft, as these thefts reduce trust in individual platforms, as well as the broader DeFi ecosystem.

In this article, we introduced the reader to game theoretic cyber deception, an active cybersecurity strategy which seeks to protect legitimate network assets and users by creating fake information that wastes an attacker’s time. We gave the user a high-level summary of cyber deception technologies, and explored the use of deception technologies in DeFi. This discussion included instances where deception tools have been deployed within real world blockchain networks, as well as several more speculative scenarios. This article demonstrates the potential that cyber deception technologies have to reduce risk within the DeFi ecosystem. However, the paucity of literature makes it clear that a great deal of research and development remains to be done on the capabilities, limitations, and risks of deploying cyber deception strategies within DeFi.

References

[1] Honeypot or not? https://honeyscore.shodan.io/.

[2] Bilinski, M., DiVita, J., Ferguson-Walter, K., Fugate, S., Gabrys, R., Mauger, J., and Souza, B. Lie another day: demonstrating bias in a multi-round cyber deception game of questionable veracity. In International Conference on Decision and Game Theory for Security (2020), Springer, pp. 80–100.

[3] Bilinski, M., Ferguson-Walter, K., Fugate, S., Gabrys, R., Mauger, J., and Souza, B. You only lie twice: A multi-round cyber deception game of questionable veracity. In International Conference on Decision and Game Theory for Security (2019), Springer, pp. 65–84.

[4] Bruckner, M., and Scheffer, T. Stackelberg games for adversarial prediction problems. In Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining (2011), pp. 547–555.

[5] Bruin, B. d. Game theory in philosophy. Topoi 24, 2 (2005), 197–208.

[6] Bushby, A. How deception can change cyber security defences. Computer Fraud & Security 2019, 1 (2019), 12–14.

[7] Cao, Y., Zou, C., and Cheng, X. Flashot: a snapshot of flash loan attack on defi ecosystem. arXiv preprint arXiv:2102.00626 (2021).

[8] Cifranic, N., Hallman, R. A., Romero-Mariona, J., Souza, B., Calton, T., and Coca, G. Decepti-scada: A cyber deception framework for active defense of networked critical infrastructures. Internet of Things 12 (2020), 100320.

[9] Franco, J., Aris, A., Canberk, B., and Uluagac, A. S. A survey of honeypots and honeynets for internet of things, industrial internet of things, and cyber-physical systems. IEEE Communications Surveys & Tutorials 23, 4 (2021), 2351–2383.

[10] Gan, R., Wang, L., and Lin, X. Why trick me: The honeypot traps on decentralized exchanges. In Proceedings of the 2023 Workshop on Decentralized Finance and Security (2023), pp. 17–23.

[11] Hammerstein, P., and Selten, R. Game theory and evolutionary biology. Handbook of game theory with economic applications 2 (1994), 929–993.

[12] Hara, K., Sato, T., Imamura, M., and Omote, K. Profiling of malicious users using simple honeypots on the ethereum blockchain network. In 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC) (2020), IEEE, pp. 1–3.

[13] Harker, P. T. Generalized nash games and quasi-variational inequalities. European journal of Operational research 54, 1 (1991), 81–94.

[14] Hicks, M. T., Humphries, J., and Slater, J. Chatgpt is bullshit. Ethics and Information Technology 26, 2 (2024), 38.

[15] Hirshleifer, J. Equilibrium Concepts in Game Theory: The Need for Dynamics. UCLA, Department of Economics, 1983.

[16] Ilg, N., Duplys, P., Sisejkovic, D., and Menth, M. Survey of contemporary open-source honeypots, frameworks, and tools. Journal of Network and Computer Applications (2023), 103737.

[17] Jafarian, J. H., and Niakanlahiji, A. Delivering honeypots as a service. In HICSS (2020), pp. 1–10.

[18] Levine, T. R. Truth-default theory (tdt) a theory of human deception and deception detection. Journal of Language and Social Psychology 33, 4 (2014), 378–392.

[19] Leyton-Brown, K., and Shoham, Y. Essentials of game theory: A concise multidisciplinary introduction. Springer Nature, 2022.

[20] Macintyre, B. Operation mincemeat: how a dead man and a bizarre plan fooled the nazis and assured an allied victory. Crown, 2011.

[21] Mordor Intelligence. Decentralized finance (defi) market size share analysis - growth trends forecast (2024-2029), 2024. https://www.mordorintelligence.com/industry-reports/decentralized-finance-defi-market.

[22] Palom ̈aki, J., Yan, J., and Laakasuo, M. Machiavelli as a poker mate: a naturalistic behavioural study on strategic deception. Personality and Individual Differences 98 (2016), 266–271.

[23] Pawlick, J., Colbert, E., and Zhu, Q. A game-theoretic taxonomy and survey of defensive deception for cybersecurity and privacy. ACM Computing Surveys (CSUR) 52, 4 (2019), 1–28.

[24] Qin, K., Zhou, L., Afonin, Y., Lazzaretti, L., and Gervais, A. Cefi vs. defi–comparing centralized to decentralized finance. arXiv preprint arXiv:2106.08157 (2021).

[25] Ragsdale, J., and Boppana, R. V. On designing low-risk honeypots using generative pre-trained transformer models with curated inputs. IEEE Access 11 (2023), 117528–117545.

[26] Rapoport, A., and Chammah, A. M. Prisoner’s dilemma: A study in conflict and cooperation, vol. 165. University of Michigan press, 1965.

[27] Rips, L. J. The psychology of knights and knaves. Cognition 31, 2 (1989), 85–116.

[28] Roughgarden, T. Algorithmic game theory. Communications of the ACM 53, 7 (2010), 78–86.

[29] Samuelson, L. Game theory in economics and beyond. Journal of Economic Perspectives 30, 4 (2016), 107–130.

[30] Sayeed, S., Marco-Gisbert, H., and Caira, T. Smart contract: Attacks and protections. Ieee Access 8 (2020), 24416–24427.

[31] Schar, F. Decentralized finance: On blockchain-and smart contract-based financial markets. FRB of St. Louis Review (2021).

[32] Schueffel, P. Defi: Decentralized finance-an introduction and overview. Journal of Innovation Management 9, 3 (2021), I–XI.

[33] Smith, T. J. Overlord/bodyguard: Intelligence failure through adversary deception. International Journal of Intelligence and CounterIntelligence 27, 3 (2014), 550–568.

[34] Sobel, J. Signaling games. Complex social and behavioral systems: Game theory and agent-based models (2020), 251–268.

[35] Sun, D., Ma, W., Nie, L., and Liu, Y. Sok: Comprehensive analysis of rug pull causes, datasets, and detection tools in defi. arXiv preprint arXiv:2403.16082 (2024).

[36] Uchibori, H., Yoshioka, K., and Omote, K. Honeypot method to lure attackers without holding crypto-assets. IEEE Access (2024).

[37] Weiser, B., and Schweber, N. The chatgpt lawyer explains himself. The New York Times (June 8, 2023). https://www.nytimes.com/2023/06/08/nyregion/lawyer-chatgpt-sanctions.html.

[38] Wronka, C. Financial crime in the decentralized finance ecosystem: new challenges for compliance. Journal of Financial Crime 30, 1 (2023), 97–113.

[39] Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., and Zhang, Y. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing (2024), 100211.

[40] Zhang, M., Wu, L., Yang, T., Zhu, B., and Liu, Y. Retracted: The three-dimensional porous mesh structure of cu-based metal-organic-framework - aramid cellulose separator enhances the electrochemical performance of lithium metal anode batteries. Surfaces and Interfaces 46 (2024), 104081.

[41] Zhou, L., Xiong, X., Ernstberger, J., Chaliasos, S., Wang, Z., Wang, Y., Qin, K., Wattenhofer, R., Song, D., and Gervais, A. Sok: Decentralized finance (defi) attacks. In 2023 IEEE Symposium on Security and Privacy (SP) (2023), IEEE, pp. 2444–2461.

[42] Zhu, M., Anwar, A. H., Wan, Z., Cho, J.-H., Kamhoua, C. A., and Singh, M. P. A survey of defensive deception: Approaches using game theory and machine learning. IEEE Communications Surveys & Tutorials 23, 4 (2021), 2460–2493.

1 Introduction

Smart contracts are one of the foundational technologies in the decentralized finance (DeFi) ecosystem. These self-executing programs, where the terms of the contract are written directly into the code, allow for millions of automated, trustless daily transactions–at a value of billions of dollars. However, the amount of money moving through DeFi exchanges has attracted malign actors in addition to honest users conducting legitimate business. Smart contracts with malicious code are one of the primary means that malicious DeFi participants use to defraud honest traders.

These malicious smart contracts are attractive attack vectors for crime on DeFi platforms because they are difficult to detect a priori. Detecting malicious code through static or dynamic analysis takes time, and cryptocurrency traders often operate on timescales that are incompatible with vetting the smart contract’s code. Moreover, many traders lack the technical knowledge to properly evaluate whether malicious code is present in a DeFi liquidity pool’s smart contract. While financial institutions are known to make it a priority to hire computer scientists and engineers, it is unlikely that these initiatives can satisfy the technical knowledge gap and bring the necessary expertise to the trading floor.

Recent developments in artificial intelligence (AI) offer DeFi traders a cost-effective defense against malicious smart contracts. Large Language Models (LLMs) from OpenAI, Google, and other companies can read through smart contract code much more efficiently than any human analyst, enabling the detection of malicious code before traders have committed funds to a liquidity pool governed by a malicious contract. Tools such as GitHub Co-pilot1 are already demonstrating the potential boon that LLMs can provide for augmenting the technical workforce.

This article explores the potential use of LLMs for detecting malicious smart contracts in the DeFi ecosystem. As such, detailed background information for Decentralized finance, malicious smart contracts, and LLMs will be given in Section 2. Section 3 will survey the use of LLMs for cybersecurity, with a focus on code analysis. Finally, concluding remarks will be given in Section 4.

2 Background Information

2.1 Decentralized Finance and DeFi Security

Traditional centralized finance is populated by institutions (e.g., banks, insurance companies) that can control access to markets and other financial systems [10]. The controlled access that centralized finance institutions provide is meant to minimize the risk of malfeasance–though a substantial amount of illicit monies flow through these institutions. These risks are minimized by the application of Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations mandated by national or regional governments, as well as internal structures (e.g., fraud detection) meant to prevent or ferret out malignant behavior by people using these institutions and systems.

In contrast, decentralized finance (DeFi) utilizes distributed ledger technology and blockchain networks, along with smart contracts to facilitate transactions [11]. DeFi takes place on decentralized exchanges, often utilizing cryptocurrency wallets as an interface. While certain institutions within the blockchain and cryptocurrency space will incorporate some level of safeguard to prevent illicit activities on their platform, many cryptocurrency wallets that support DeFi transactions are not subject to KYC or AML regulations.

The key element of the DeFi ecosystem is the decentralized exchange (DEX), based on automatic market maker (AMM) mechanisms. The AMM allows for the development of liquidity pools where providers will deposit a pair of tokens consisting of an established blockchain token (e.g., an ERC20 token for DEXs on the Ethereum blockchain) and another token for swapping. The established token is in the pool for the purposes of providing liquidity and building trust in that pool; trust in that pool is essential for engaging traders. Swaps are made via smart contract. However, there are many ways that scammers and other malignant actors can insert malicious code into liquidity pool smart contracts, and those malicious smart contracts are a major pain point in the field of DeFi security.

2.2 Malicious Smart Contracts

Smart contracts are programmed transaction protocols which automatically execute and control events based on predetermined conditions in the agreement or contract [5]. The transactions governed by smart contracts can range from trivially simple to intricate multiparty transactions.

Malicious smart contracts are smart contracts with malicious code; that is, the smart contract was programmed to deceive potential traders and enable the contract’s author(s) to steal more valuable cryptocurrency tokens that traders deposited into the liquidity pool [16]. There are many types of malicious smart contracts, which may impact different blockchain use cases. However, this article is concerned with the DeFi space, and so we will focus on DeFi honeypots [3]. Honeypot traps in DeFi are deceptively designed smart contracts which lure honest traders into the pool, but then making it all but impossible for the trader to withdraw their funds. This may be accomplished by obfuscating a high tax rate or hidden fees on transactions within the pool. Other tactics may include enabling blacklisting or whitelisting of certain traders within the pool; malicious code may be embedded and active from the opening of the pool, or may be triggered at a later time once certain conditions are met.

In order to build trust in a DEX, the exchange will require pools to meet a minimum compliance with blockchain industry standards (e.g., ERC20). This compliance requires a standardized interface; however, malignant programmers can still incorporate malicious code within the smart contract. This malicious code is often not detected until it is too late for the trader because most cryptocurrency traders do not possess the deep computer science and engineering knowledge that would enable them to discern a trap encoded within the smart contract.

2.3 Large Language Models

Large language models (LLMs) are modern deep learning architectures which are responsible for most of the recent and high profile advances in the field of artificial intelligence [14]. Earlier language models were based on sequential learning models such as recurrent neural networks (RNNs), long-short term memory (LSTMs), and gated recurrent units (GRUs). These previous models could have 10s of millions of parameters and achieved impressive results. Transformer-based LLMs with billions of parameters are surpassing the results of the earlier models, excelling at various tasks including text generation, language translation, etc.

These transformer-based LLMs, particularly generative pretrained transformer (GPT) models, are increasingly finding utility in code generation for software engineering. GitHub’s Co-Pilot capability, which is built on OpenAI’s ChatGPT, is probably the most visible example of this. These LLMs interact with a programmer, and are able to generate code snippets–or even entire programs–based upon their stated intent and requirements. Alternatively, these models can be used for completing a programmer’s preliminary code, going so far as ensuring that a finished program adheres to industry standards and best practices. Other uses for LLMs in software engineering include debugging, refactoring, and documentation. (Debugging is a particularly useful capability, as novice programmers routinely struggle to understand and correct error notifications that they may encounter during their work.) This code generation capability can prove to be a cybersecurity threat, and there are LLMs which have been trained by hackers to generate malware or perform other penetration testing operations. Commercially available LLMs, such as OpenAI’s ChatGPT or Google’s Gemini, have ethical guard rails built in to mitigate against misuse; however, many users have demonstrated the ability to “jailbreak” and manipulate the LLM into performing illegal operations [7].

3 The Role of Large Language Models in Smart Contract and Software Security

Static analysis methods such as formal verification, pattern or symbolic analysis, and fuzzing have proven to be the work horses for detecting vulnerabilities in smart contracts. For instance, Tanskov, et al. [13] developed a smart contract security tool which defines sets of both “safe” and “violation” patterns. Nikoli ́c, et al. [8] developed a static analysis capability to detect certain smart contract behaviors that are common in honeypot traps, as well as other malicious smart contracts. The impressive results from these and similar smart contract security verification systems demonstrate that the detection of malicious smart contracts is possible and scalable. However, these methods are limited in that they are reliant on previously known and documented malicious code, and may not detect newly designed attacks. Moreover, these methods are known to produce false positives and false negatives–a well-known shortcoming of static analysis methods.

Deep and machine learning-based methods have made significant progress in malicious smart contract detection, as well as in other areas of security engineering and software verification. Most relevant to the detection of honeypot smart contracts, Chen and Li [1] developed a system that integrates formal verification with a series of hybrid deep learning architectures (combining a convolutional neural network with other sequential architectures). Their system was trained exclusively on discovering ponzi scheme smart contracts, and is therefore not a reliable tool for discovering other types of malicious contracts. Zheng, et al. [15] developed a cascade ensemble model that utilizes XGBoost, a flexible and efficient gradient boosting library, in order to extract and identify features of ponzi scam smart contracts.

LLMs using pre-trained transformers excel at transferring knowledge downstream. Unlike earlier, less sophisticated language models, LLMs have context-dependent word embeddings, which allows the same word to have unique representations as the context changes. This ability for dynamic contextual understanding enables these models to achieve a more complete understanding of word meanings and complex usages, which explains remarkable results in natural language processing (NLP) tasks. Given that these LLMs have been trained on vast codexes–including massive amounts of source code–it seems intuitive that LLMs can be trained not only to detect software vulnerabilities and re-used malicious methodologies, but also to discover zero-day vulnerabilities and novel scams.

Thapa, et al. [12] conducted an exhaustive analysis comparing transformer-based LLMs to older RNN-based language models in a series of vulnerability detection tasks. They examined several transformer-based models including GPT-2 and variants of the Bi-directional Encoder Representations from Transformers (BERT) models, comparing their performance with Bi-directional LSTM (BiLSTM) and GRU (BiGRU) models. Specifically, they tested both binary and multi-class vulnerability detection capabilities on datasets with up to 126 distinct vulnerability types. Experimental results showed that transformer-based LLMs significantly outperformed both BiLSTM and BiGRU models at vulnerability detection, with GPT-2-based models.

A recent example of LLM-based smart contract vulnerability detection comes from He, et al. [4], built a model that leverages the contextual prowess of the BERT architecture and integrates it with a BiLSTM, and additional attention mechanism, and a fully-connected feed forward network. The transformer-based BERT learns semantic context of smart contract source code, while the BiLSTM layer extracts high-level features from the BERT layer output. The additional attention layer assigns weights to the features extracted by the BiLSTM layer to complete a holistic contextual representation of the code under examination, and the feed forward layer determines whether a vulnerability exists in that portion of the smart contract. They compared their system to [15] in order to test their ability to detect scam contracts, and exceeded the state-of-the-art performance in accuracy, recall, and F-1 score.

While the aforementioned results show great promise at software code analysis for vulnerability detection, it is important to remember that there are limitations which must be accounted for. Training dataset quality is a major factor in model performance, and there are arguably significant pain points when it comes to training LLMs for detecting and correcting vulnerabilities. For instance, Ding, et al. [2] created a software vulnerability dataset in order to test both code language models, as well as larger and well-known LLMs (e.g., GPT-3.5/4). Their dataset was developed to correct for numerous shortcomings including noisy or inaccurate labels, and data duplication. Their experimental results suggest that vulnerability detection LLMs are not yet ready for real world deployment. Specifically, one state-of-the-art code language model achieved an F-1 score of 68.26% against a widely used vulnerability dataset, but an F-1 score of 3.09% against their newly developed dataset.

Furthermore, there is a question of how well LLMs can remediate the vulnerabilities that they may detect. Pierce, et al. [9] examined LLM performance at repairing insecure code with mixed results. While the LLMs that they tested were able to generate patches to vulnerabilities. However, these patches were limited to a single function within individual files, with no consideration given to how those files interact with others within larger and more intricate software products. Another concern which must be foremost on the security engineer’s mind when using LLMs for vulnerability detection and repair are hallucinations [6], where the model essentially creates fraudulent information. In such a case, the LLM might erroneously determine that a secure segment of source code presents a vulnerability, or it might remedy a vulnerability by calling a library or function that doesn’t actually exist. Thus, while LLMs show great potential in the area of software security, human expertise is still necessary for oversight.

4 Conclusion

There has been an explosion of interest in the financial opportunities in the cryptocurrency sector and the DeFi ecosystem, where software-based smart contracts are a fundamental tool for transactions. Smart contracts are self-enforcing agreements where contract terms are written into the contract source code. While smart contracts in the DeFi ecosystem must conform to certain engineering standards, there is still ample room for vulnerabilities–both inadvertent and intentionally designed–to persist.

This blog post introduced the topic of using LLMs for software vulnerability detection, with a focus on smart contracts in DeFi. LLMs are becoming popular in society at large, but are showing promise in the software engineering realm as they are a tremendous productivity booster. It is only natural that researchers are exploring LLM capabilities for vulnerability detection and repair. We gave a brief survey to acquaint the reader with the state-of-the-art work, as well as present a few of the current limitations and pain points with this approach. LLM-based vulnerability detection for the identification of malicious smart contracts is a goal which is within reach, and which will undoubtedly be leveraged by professional DeFi traders in the future.

References

[1] Chen, S., and Li, F. Ponzi scheme detection in smart contracts using the integration of deep learning and formal verification. IET Blockchain (2023).

[2] Ding, Y., Fu, Y., Ibrahim, O., Sitawarin, C., Chen, X., Alomair, B., Wagner, D., Ray, B., and Chen, Y. Vulnerability detection with code language models: How far are we? arXiv preprint arXiv:2403.18624 (2024).

[3] Gan, R., Wang, L., and Lin, X. Why trick me: The honeypot traps on decentralized exchanges. In Proceedings of the 2023 Workshop on Decentralized Finance and Security (2023), pp. 17–23.

[4] He, F., Li, F., and Liang, P. Enhancing smart contract security: Leveraging pre-trained language models for advanced vulnerability detection. IET Blockchain (2024).

[5] Hu, B., Zhang, Z., Liu, J., Liu, Y., Yin, J., Lu, R., and Lin, X. A comprehensive survey on smart contract construction and execution: paradigms, tools, and systems. Patterns 2, 2 (2021).

[6] Liu, F., Liu, Y., Shi, L., Huang, H., Wang, R., Yang, Z., and Zhang, L. Exploring and evaluating hallucinations in llm-powered code generation. arXiv preprint arXiv:2404.00971 (2024).

[7] Monje, A., Monje, A., Hallman, R. A., and Cybenko, G. Being a bad influence on the kids: Malware generation in less than five minutes using chatgpt.

[8] Nikoli ́c, I., Kolluri, A., Sergey, I., Saxena, P., and Hobor, A. Finding the greedy, prodigal, and suicidal contracts at scale. In Proceedings of the 34th annual computer security applications conference (2018), pp. 653–663.

[9] Pearce, H., Tan, B., Ahmad, B., Karri, R., and Dolan-Gavitt, B. Examining zero-shot vulnerability repair with large language models. In 2023 IEEE Symposium on Security and Privacy (SP) (2023), IEEE, pp. 2339–2356.

[10] Qin, K., Zhou, L., Afonin, Y., Lazzaretti, L., and Gervais, A. Cefi vs. defi–comparing centralized to decentralized finance. arXiv preprint arXiv:2106.08157 (2021).

[11] Scharfman, J., and Scharfman, J. Decentralized finance (defi) compliance and operations. Cryptocurrency Compliance and Operations: Digital Assets, Blockchain and DeFi (2022), 171–186.

[12] Thapa, C., Jang, S. I., Ahmed, M. E., Camtepe, S., Pieprzyk, J., and Nepal, S. Transformer-based language models for software vulnerability detection. In Proceedings of the 38th Annual Computer Security Applications Conference (2022), pp. 481–496.

[13] Tsankov, P., Dan, A., Drachsler-Cohen, D., Gervais, A., Buenzli, F., and Vechev, M. Securify: Practical security analysis of smart contracts. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security (2018), pp. 67–82.

[14] Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., and Zhang, Y. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing (2024), 100211.

[15] Zheng, Z., Chen, W., Zhong, Z., Chen, Z., and Lu, Y. Securing the ethereum from smart ponzi schemes: Identification using static features. ACM Transactions on Software Engineering and Methodology 32, 5 (2023), 1–28.

[16] Zhou, L., Xiong, X., Ernstberger, J., Chaliasos, S., Wang, Z., Wang, Y., Qin, K., Wattenhofer, R., Song, D., and Gervais, A. Sok: Decentralized finance (defi) attacks. In 2023 IEEE Symposium on Security and Privacy (SP) (2023), IEEE, pp. 2444–2461.

1 Introduction

Machine learning and cryptography are two fields of technology that are fundamental to many of the fabric of modern life. In fact, we interact almost unknowingly with both of these technologies throughout our daily life. Given this ubiquity, the average person who hasn’t had taken a deep dive into computer science and mathematics might be surprised to learn that these fields have largely evolved in isolation of one another. Cryptographers and machine learning researchers are members of your local university’s computer science department; and while they know each other, they have been unlikely to collaborate. The disciplines have separate journals and conferences (e.g., Cryptology and Eurocrypt for cryptographers, ICML and ICLR for machine learning researchers). In spite of surface level differences between these fields of mathematics and computer science, the two have interesting similarities and relationships (noted by no less than Ron Rivest [18]). 

In fact, cryptography and machine learning are increasingly coming together thanks to recent advances in encrypted computation. Refereed literature detailing the results of research on encrypted learning are becoming much more commonplace, appearing in top-tier conferences and journals. Moreover, there are now open source software libraries available that support encrypted learning, and there are even a few for-profit businesses offering privacy preserving machine learning services. However, the explosive growth of interest in encrypted learning is focused primarily on protecting private data, and is worlds away from another intuitive intersection of machine learning and cryptography: cryptanalysis, the science of breaking cryptographic systems. 

Cryptography is used for making ordered data resemble random noise, while machine learning excels at discerning patterns and order from seemingly random data. There is a small-but-growing body of literature delving into this topic, and this article serves to introduce the reader to the field of neural cryptanalysis. The duration of the article is organized as follows: Background information is provided in Section 2, neural cryptanalysis is defined in Section 3 with selected results presented in Section 4, and concluding remarks are given in Section 5.

2 Background

Cryptography, cryptanalysis, machine and deep learning are complicated topics for which I cannot possibly do justice in an article section. Readers wishing to take a deeper dive into these topics (that is, to the depth of an advanced undergraduate or early graduate student) are encouraged to read through the following recommended sources (from which this background section is drawn): 

• There are quite a few textbooks on cryptography, the most widely used in academia is probably Katz and Lindell’s Introduction to Modern Cryptography [10].
• There are far fewer textbooks available on cryptanalysis, however Stamp and Low’s Applied Cryptanalysis [20] is the best resource that I am aware of. 
• As with the topic of cryptography, there are a multitude of excellent textbooks on statistical machine learning; I might direct the reader to Mohri, et al.’s Foundations of Machine Learning [16]. Quality texts on the subset of machine learning called deep learning are becoming more commonplace, and my favorite introductory work is Aggarwal’s Neural Networks and Deep Learning [1]. However, for the reader who is particularly courageous in the face of daunting mathematics, I would include Roberts, et al.’s Principles of Deep Learning Theory [19]. 

2.1 Cryptography & Cryptanalysis 

We will begin our background section by covering cryptography and cryptanalysis. Cryptography is the study of mathematical techniques that can secure digital information, systems, and distributed computations against adversarial attacks. Cryptography has been practiced since ancient times, indeed the first cryptographic cipher that students are exposed to is known as the “Caesar Cipher.” The Caesar Cipher is representative of a class of ciphers known as a shift (or substitution) cipher, where letters are shifted forwards or backwards according to some predetermined value referred to as a key. That key value k is important, and there is a maxim among cryptographers known as Kerckhoffs’ Principle that a cipher’s security relies solely on the secrecy of k. An encryption algorithm ENC_k(m) = c takes a plaintext message m and produces a ciphertext c, while a corresponding decryption algorithm DEC_k(c) = m takes the ciphertext c and produces the original message m. Symmetric cryptographic ciphers use the same key value k for both encryption and decryption, while asymmetric ciphers use a public key k_pub for encryption and a secret key k_sec for decryption. 

Different ciphers are used in different scenarios. For instance, data-at-rest will typically be encrypted via a symmetric scheme, while data-in-transit will be encrypted with an asymmetric scheme. Encrypted computation is a recent field where data-in-use can enable operations on encrypted data; the main cryptographic primitives that make this possible are multiparty computation [6] and homomorphic encryption [5]. 

Cryptographic ciphers are used to keep information secret, so it makes sense that there are attacks on these systems. Cryptanalysis is the formal study of attacking and defeating cryptographic ciphers, thus revealing their weaknesses. Successfully (or unsuccessfully) attacking ciphers gives cryptographers important insights to strengthen their designed systems. Common attacks include brute force, frequency and statistical analysis, side channel analysis, as well as the discovery and exploitation of vulnerabilities in software or engineered systems. (We will not be dealing with the latter two methods in this article, as the fall within the purview of other disciplines, e.g., Reverse Engineering and Cybersecurity Testing.) 

Different cryptanalysis attacks exist to test ciphers. Symmetric ciphers are often attacked by a method known as differential cryptanalysis, where differences are observed in how the plaintext propagates through the cipher to produce different ciphertexts. Once enough (plaintext, ciphertext) pairs have been observed, a cryptanalyst can deduce information about the cipher, possibly even recovering the key value k. Asymmetric ciphers rely on hardness assumptions of certain mathematical problems (e.g., factoring large numbers or computing discrete logarithms over finite fields). For example, the key values k_pub, k_sec are functions of a composite number N = p × q where p, q are prime numbers. This kind of integer factorization is believed to be hard and cannot be performed efficiently; however, it is expected that the ascendance of quantum computing will bring algorithms that can solve these hard problems in polynomial time (a measure of computational complexity). There is a race to develop cryptographic schemes that will remain resilient against quantum attacks; the National Institute for Standards and Technology (NIST)¹is one of many organizations driving the development of such schemes. Post-quantum cryptanalysis is an active and evolving field of research. 

2.2 Machine Learning 

Machine learning (ML) is a subfield of artificial intelligence which seeks to enable computer programs to improve task performance with experience (i.e. exposure to data). Classical ML algorithms utilize a great deal of statistical methods, which makes results very explainable. Deep learning (DL) is a subset of ML which uses architecture models inspired by human neurological systems. DL systems are often opaque in their operation and consequently will reach conclusions by processes which are not easily explainable or understandable, even for knowledgeable computer scientists. This article will focus on DL and neural networks, rather than classical ML. 

Simple feed-forward neural networks, where each neuron in a layer is connected to every neuron in the next layer, are known as universal approximators [7, 13]. Convolutional neural networks (CNNs) apply convolution operations on data with grid-like structure to learn patterns and extract features; these networks are often used in image classification tasks. Recurrent neural networks (RNNs) use hidden layers to discover temporal dependencies, and consequently excel at sequential data processing tasks (e.g. sequential analysis and natural language processing). Finally, attention mechanisms and large language models (LLMs) have been taking the world by storm. These state-of-the-art architectures allow for improved flexibility and more context aware information extraction, and thus are key to most recent advancements in artificial intelligence. 

3 Defining Neural Cryptanalysis

We are now in a position to discuss the use of DL for cryptanalysis tasks. Neural cryptanalysis is an approach that leverages DL to measure cryptographic cipher strength. Formally, a neural cryptanalysis system [24] a tuple (M₁, M₂, N, S) where M₁ and M₂ are mutually exclusive, finite sets of plaintext-ciphertext pair (p, c) that satisfy
ENC_k(p) = c, p ∈ Z^m₂ and c ∈ Zⁿ₂. Z₂ denotes the binary value space {0, 1} and Z^t₂ represents a binary stream of length t. N is a set of neural networks trained by M₁ and tested by M₂, and S is a measure of cipher strength generated by training and testing the neural networks in N. 

We can further define neural cryptanalysis into subclassifications, based on how much of a role DL plays in the attack. Indirect neural cryptanalysis refers to attacks where DL capabilities serve in more of a supporting role. Cryptanalysis attacks where DL models are trained to directly recover cryptographic secrets are referred to as direct neural cryptanalysis. Finally, large language model cryptanalysis refers to attacks that utilize LLMs to attack a hard mathematical problem which underpin some current post-quantum cryptography schemes. Examples of each of these subclassifications will be given in Section 4, and GitHub repositories will be linked where public code bases are available. Neural cryptanalysis has been successfully used in attacks on classical and symmetric ciphers; however, there are well-known results [11] which demonstrate that neural cryptanalysis is not an efficient attack against common asymmetric cryptography schemes. 

4 Selected Results in Neural Cryptanalysis Literature

Having provided a sufficient background and given a formal introduction to neural cryptanalysis, we are now ready to dive into some results. We will first acquaint ourselves with a few proofs of concept neural cryptanalysis attacks against classic ciphers that aren’t mathematically sophisticated (at least in comparison to modern ciphers). After these introductory case studies, we will turn our attention to attacks against modern cryptographic ciphers. First, we will cover two attacks against block ciphers and an attack against a stream cipher. We will then study LLM-based cryptanalysis against the Learning With Errors (LWE) Problem, on which several post-quantum cryptography schemes are built. 

4.1 Classical Cipher Neural Cryptanalysis 

Classical ciphers, whether shift or substitution ciphers, deterministically transform a plaintext according to some key value. A shift cipher might uniformly add 3 mod 26 so that the plaintext CAT LABS becomes ciphertext FDW ODEV. A Vigenere cipher uses shifts that vary as plaintext elements through the key value. Given a key value of “CATLabs”, the plaintext Neural Cryptanalysis maps to the ciphertext Pencam Utyieaosnylts. 

In some sense, we can think of neural cryptanalysis against these classical ciphers as a language translation problem. Gomez, et al.²[9] used this approach to determine whether a neural network could be trained to deduce withheld ciphers from unaligned text, and without supplementation of preexisting human knowledge. The authors used a generative deep learning [21], specifically modifying the CycleGAN [25] architecture to make it stable over discrete data sets, a technique dubbed “reliable fooling via relaxation.” Using this approach, they were able to successfully decrypt shift and Vigenere ciphers with about 75% accuracy. Another interesting result coming out of machine translation research where Aldarrab and May [3] used a transformer-based [22] Seq2Seq model combined with a “frequency encoder” to decipher 700 historical substitution ciphers in 14 languages. 

4.2 Attacking Block Ciphers with Neural Distinguishers 

Block ciphers use pseudorandom permutations to encrypt blocks of plaintext and are one of the most commonly cryptographic technologies in use today. These symmetric ciphers provide fast and computationally efficient performance, and are often used for protecting data at rest; however, key exchange protocols can make the use of block ciphers a feasible option for protecting data in transit. 

Gohr [8] used CNNs augmented with a Bayesian optimizer to construct a neural distinguisher³, a classifier that can distinguish real ciphertexts from randomly generated data. Gohr ran this attack against the Speck32/64 cipher, a lightweight block cipher with 32−bit blocks and a 64−bit key. The Speck/m cipher was designed for use in Internet of Things devices, and can support various block and key sizes. Even in a scenario where perfect knowledge of the differential distribution didn’t allow an attacker to perform better than random guessing, Gohr was able to derive sets of candidate keys after a 9-round distinguisher attack. Only two additional rounds of distinguisher attacks were necessary to recover keys. These neural distinguisher attacks successfully recovered the key value at about 3-times the rate of classical distinguisher attacks. 

4.3 Neural Cryptanalysis Against Stream Ciphers 

In addition to the block cipher in Section 4.2, there is another class of symmetric cipher known as a stream cipher. Stream ciphers encrypt one bit (or byte) at a time, producing a stream of bits. These ciphers are lightweight and efficient for wireless communications, streaming media, and real-time encryption tasks. 

Xiao, et al. [24] developed the neural cryptanalysis system described in Section 3, and attempted to mimic the output from the Hitag2 cipher. Hitag2 is a proprietary cipher, which means that its inner workings are somewhat opaque; however, there is an understanding that it implements a 48-bit Linear Feedback Shift Register (LFSR) and nonlinear Boolean functions. The cipher was used in automotive scenarios, particularly for keyless entry mechanisms. They used a fully-connected, feed forward network with four hidden layers and of bounded width to mimic the Hitag2 cipher with approximately 67% success. (The authors also used a fully-connected, feed forward network with a single hidden layer to mimic a reduced round Data Encryption Standard block cipher with 99.7% accuracy.) 

4.4 Large Language Model-based Neural Cryptanalysis 

LLMs are proving to be versatile architectures which excel in a multitude of diverse tasks. We will now explore a fascinating application of LLMs against a hard mathematical problem upon which several quantum-resistant cryptography schemes are built. 

4.4.1 The Learning With Errors Problem 

The Learning With Errors (LWE) Problem [17] seeks to recover a secret value
s ∈ Zⁿ_q given a sequence of ‘approximate’ random linear equations on s. There are samples (a, b) where a is a random vector of n integers modq, and b is a noisy modular inner product of a and s, and ⟨a, s⟩ + e = b, where e is an error value drawn from some distribution. LWE or its variants are underpin all of the current Fully Homomorphic Encryption (FHE) schemes, as well as the CRYSTALS-Kyber and CRYSTALS-Dilithium post-quantum cryptography schemes that NIST is currently standardizing. There is no known, polynomial time classical or quantum attack against LWE. (In other words, LWE is as computationally hard in the average case as in the worst case.) As an illustrative example, consider the following [17]: 

14s₁ + 15s₂ + 5s₃ + 2s4 ≈ 8 mod 17 
13s₁ + 14s₂ + 13s₃ + 6s₄ ≈ 16 mod 17 
6s₁ + 10s₂ + 13s₃ + 1s₄ ≈ 3 mod 17 
10s₁ + 4s₂ + 12s₃ + 16s₄ ≈ 12 mod 17 
9s₁ + 5s₂ + 9s₃ + 6s₄ ≈ 9 mod 17 
3s₁ + 6s₂ + 4s₃ + 5s₄ ≈ 16 mod 17 
^… 
6s₁ + 7s₂ + 16s₃ + 2s₄ ≈ 3 mod 17 

The answer in this case is s = (0, 13, 9, 11). In essence, the LWE problem hides a secret value in noisy inner products and solving can be thought of as solving a modular least squares regression. 

The LWE problem is sometimes referred to as Search LWE. There are couple of additional LWE variants, including: 

• Ring LWE [14], where LWE is applied to rings over finite fields; 
• Decision LWE [15], the task is to distinguish the LWE distribution from the uniform distribution {(a, b) : a, b are chosen uniformly at random}. 

The secret vector s can be samples from many distributions, however many schemes (FHE schemes in particular) use binary distributions (i.e. sampling in {0, 1}ⁿ) or ternary distributions (i.e. sampling in {−1, 0, 1}ⁿ). It is common to see sparse secrets with Hamming weight h. 

4.4.2 Attacking LWE with LLMs 

The factor that makes attacking LWE particularly hard is the use of modular arithmetic. Recovering s would be trivial without this feature, as machine learning models are robust to noise in training data. Modular arithmetic is known to be a hard problem for machine learning, and transformers initially struggled to compute simple arithmetic operations. However, Charton [4] recently demonstrated that transformers could compute matrix-vector products–the primary mathematical operation in LWE. 

Wenger, et al. [23] utilized this advance to train a transformer to compute modular inner products. They began with a one-dimensional case with the goal of predicting b = a · s mod q with at least 95% accuracy, where s is unknown and a · s ∈ Z_q. They achieved this goal, though the required number of training samples was between 10q and 50q and the efficacy of the training process was dependent on q. Having achieved this base result, they moved onto experimentation of multi-dimensional cases: predicting b = ⟨a, s⟩ mod q where a ∈ Zⁿ_q and s ∈ Zⁿ_q or {0, 1}ⁿ (i.e. a binary secret). These experiments were able to achieve 90% accuracy with n = 2 and relatively small moduli values of q ≤ 967, but accuracy fell to approximately 30% when the modulus value was raised to q = 1471. Simply stated, learning the modular inner product between a ∈ Zⁿ_q and s ∈ Zⁿ_q is a significantly more difficult task. 

This attack, dubbed Secret Recovery Attacks on LWE via Seq2Seq Models (SALSA)⁴, demonstrates the potential of this approach to testing the strength of lattice-based, post-quantum cryptography schemes. Assuming that they have access to a sufficient number of LWE pairs in n dimensions and using the same secret value s, the attack has three distinct components: 

1. a transformer model M that is trained to predict b from a;
2. a secret recovery algorithm which feeds special values of a into M, and uses ˜b = M(a) to predict the secret value ˜s;
3. a secret verification procedure which checks that the residual value r = b − ⟨a, ˜s⟩ mod q has a small standard deviation σ.

The model M predicts b from a by minimizing cross-entropy between a predicted value b^′ and the ground truth value b. There are two secret recovery algorithms, so the attack can either utilize (i) a direct secret recovery that is akin to a chosen plaintext attack, or (ii) a distinguisher secret recovery which is based on the Decision LWE problem. Finally, the attack must verify whether the secret prediction ˜s = s. When ˜s = s, then the residual value is equal to the noise and r = b − ⟨a, ˜s⟩ = b − ⟨a, s⟩ = e mod q with a small σ. When ˜s ̸= s, then r shows an approximately uniform distribution in Z_q. 

The SALSA attack was able to recover the secret s up to dimension n = 128, an impressive result for a proof-of-concept attack. However, it is important to understand that lattice-based cryptographic schemes use much larger dimensions (for example, the FHE Security Standard [2] recommends dimension n ≥ 1024 and gives parameter recommendations up to n = 32768). Follow on work⁵ expanded on these results [12], successfully recovering s up to dimension n = 512, as well as a number other improvements. 

5 Conclusion

This article is meant to have given the reader an introduction to the topic of neural cryptanalysis, the attacking and testing of cryptographic ciphers utilizing deep learning. We have covered attacks against classical ciphers, as well as more current symmetric ciphers and Learning With Errors, a hard lattice problem that is important in the context of secure computation and post-quantum cryptography. Moreover, Git repositories are shared where the referenced authors have made their research publicly available, and so the reader is able to explore the advancements in this field as deeply as they like. 

Nevertheless, this line of work raises numerous questions. One is tempted to ask whether we are on the cusp of a viable deep learning-based attack against already deployed cryptographic systems. Are certain cryptographic schemes more vulnerable to these types of neural cryptanalysis attacks? Are cryptographic use cases (e.g. cryptocurrencies) safe from neural cryptanalysis attacks? Can these capabilities be weaponized? 

The good news is that the publicly available information suggests that deep learning is not yet a threat to currently deployed cryptographic systems. (However, deep learning-based side channel attacks, not covered in this article, may well circumvent cryptographic protections and infer sensitive information). Moreover, the attacks described in this paper were against symmetric, rather than asymmetric, ciphers. Kearns and Valiant [11] demonstrated the difficulty of learning Boolean functions, specifically working with the RSA cipher and the infeasibility of learning cryptographic operations; this suggests that asymmetric cryptography is safe for the foreseeable future (including the cryptocurrency ecosystem). Moreover, the cryptographic ciphers that are in real-world service are sophisticated systems which often have additional protections than the raw cipher. In other words, deep learning is not currently a threat to cryptography, but that may change. 

¹https://csrc.nist.gov/projects/post-quantum-cryptography
²https://github.com/for-ai/CipherGAN 
³https://github.com/agohr/deep_speck
⁴https://github.com/facebookresearch/SALSA 
⁵https://github.com/facebookresearch/verde 

References

[1] Aggarwal, C. Neural networks and deep learning: a textbook. Springer, 2018. 

[2] Albrecht, M., Chase, M., Chen, H., Ding, J., Goldwasser, S., Gorbunov, S., Halevi, S., Hoffstein, J., Laine, K., Lauter, K., et al. Homomorphic encryption standard. Protecting privacy through homomorphic encryption (2021), 31–62. 

[3] Aldarrab, N., and May, J. Can sequence-to-sequence models crack substitution ciphers? In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) (2021), pp. 7226–7235. 

[4] Charton, F. Linear algebra with transformers. Transactions on Machine Learning Research (2022). 

[5] Cheon, J. H., Costache, A., Moreno, R. C., Dai, W., Gama, N., Georgieva, M., Halevi, S., Kim, M., Kim, S., Laine, K., et al. Introduction to homomorphic encryption and schemes. Protecting Privacy through Homomorphic Encryption (2021), 3–28. 

[6] Cramer, R., Damg˚ard, I. B., et al. Secure multiparty computation and secret sharing. Cambridge University Press, 2015. 

[7] Cybenko, G. Approximation by superpositions of a sigmoidal function. Mathematics of control, signals and systems 2, 4 (1989), 303–314. 

[8] Gohr, A. Improving attacks on round-reduced speck32/64 using deep learning. In Annual International Cryptology Conference (2019), Springer, pp. 150–179. 

[9] Gomez, A. N., Huang, S., Zhang, I., Li, B. M., Osama, M., and Kaiser, L. Unsupervised cipher cracking using discrete GANs. In International Conference on Learning Representations (2018). 

[10] Katz, J., and Lindell, Y. Introduction to modern cryptography. CRC press, 2020. 

[11] Kearns, M., and Valiant, L. Cryptographic limitations on learning boolean formulae and finite automata. Journal of the ACM (JACM) 41, 1 (1994), 67–95. 

[12] Li, C., Sotakova, J., Wenger, E., Allen-Zhu, Z., Charton, F., and Lauter, K. Salsa verde: a machine learning attack on learning with errors with sparse small secrets. arXiv preprint arXiv:2306.11641 (2023). 

[13] Lu, Z., Pu, H., Wang, F., Hu, Z., and Wang, L. The expressive power of neural networks: A view from the width. Advances in neural information processing systems 30 (2017). 

[14] Lyubashevsky, V., Peikert, C., and Regev, O. A toolkit for ring-lwe cryptography. In Advances in Cryptology–EUROCRYPT 2013: 32nd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Athens, Greece, May 26-30, 2013. Proceedings 32 (2013), Springer, pp. 35–54. 

[15] Micciancio, D., and Mol, P. Pseudorandom knapsacks and the sample complexity of lwe search-to-decision reductions. In Annual cryptology conference (2011), Springer, pp. 465–484. 

[16] Mohri, M., Rostamizadeh, A., and Talwalkar, A. Foundations of machine learning. MIT press, 2018. 

[17] Regev, O. The learning with errors problem. Invited survey in CCC 7, 30 (2010), 11. 

[18] Rivest, R. L. Cryptography and machine learning. In International Conference on the Theory and Application of Cryptology (1991), Springer, pp. 427–439. 

[19] Roberts, D. A., Yaida, S., and Hanin, B. The principles of deep learning theory. Cambridge University Press Cambridge, MA, USA, 2022. 

[20] Stamp, M., and Low, R. M. Applied cryptanalysis: breaking ciphers in the real world. John Wiley & Sons, 2007. 

[21] Tomczak, J. M. Deep Generative Modeling. Springer Cham, 2021. 

[22] Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., and Polosukhin, I. Attention is all you need. Advances in neural information processing systems 30 (2017). 

[23] Wenger, E., Chen, M., Charton, F., and Lauter, K. E. Salsa: Attacking lattice cryptography with transformers. Advances in Neural Information Processing Systems 35 (2022), 34981–34994. 

[24] Xiao, Y., Hao, Q., and Yao, D. D. Neural cryptanalysis: metrics, methodology, and applications in cps ciphers. In 2019 IEEE conference on dependable and secure computing (DSC) (2019), IEEE, pp. 1–8. 

[25] Zhu, J.-Y., Park, T., Isola, P., and Efros, A. A. Unpaired image-to-image translation using cycle-consistent adversarial networks. In Proceedings of the IEEE international conference on computer vision (2017), pp. 2223–2232. 

1 Introduction

The ever increasing use of mobile phones in society, particularly the prevalence of applications (apps) to facilitate financial transactions, presents an enticing attack surface for criminals. Many of these vulnerabilities (e.g., malware) are well-studied in refereed and popular literature; however, other vulnerabilities have received relatively scant attention from professional cybersecurity researchers. SIM Swap attacks, where a malicious actor illegally copies a victim’s Subscriber Identification Module (SIM) chip, are surging in popularity with cyber criminals [8]. Though these attacks are responsible for many millions of U.S. Dollars-worth of theft and are being reported on in news media, there is a paucity of refereed literature.

Mobile computing continues to become more ubiquitous, often serving as a significant component to identity confirmation as we interact with and utilize various service providers. In addition to the risks that SIM Swap attacks present for financial theft, the role that mobile technology plays in our digital identity makes them an attack vector in other areas. For instance, personal mobile computing devices will be increasingly used in enterprise networks as companies experiment with and adopt so-called “bring your own device” (BYOD) policies [7]. One can easily imagine a state-level actor attempting to target personnel from an adversarial state and attempting to use a SIM Swap attack to gain access to sensitive networks. In fact, the significant role that our mobile devices play in our digital identity (and therefore our identity in broader society) justify classifying SIM Swaps as an advanced persistent threat (APT) that deserves more attention from professional security researchers.

The purpose of this paper is primarily to provide a reasonably thorough introduction to SIM Swap attacks, with a focus on their role in financial and cryptocurrency theft. Additionally, it looks at the risk that these attacks may present to the emerging BYOD paradigm. Finally, it examines the current mitigation practices to guard against SIM Swap attacks. As such, the remainder of this paper is as follows: SIM Swap attacks are explained in Section 2, with case studies that are specific to financial and cryptocurrency theft presented in Sections 2.1 and 2.2, respectively. Current practices in combating SIM Swaps are presented in Section 3, and concluding remarks are given in Section 4.

2 Understanding SIM Swap Attacks

The Subscriber Identity Module [10], or SIM, card is historically a small, physical component of every mobile device that provides a unique identity on mobile devices. While initially limited to solely identifying devices on a mobile network, SIM cards are now an essential component of our digital identities due to the centrality of mobile computing devices in much of everyday life. The digital identity, which a SIM card connects to a real-world identity, may be used for authentication and access to financial applications, as well as access to email and other information and communication technology (ICT) services.

SIM Swap attacks [16] occur when a criminal actor copies or replaces the SIM card from a victim’s mobile device. This may require the criminal gaining physical custody of the phone for a time, or involve dishonest mobile service employees. However, attackers may gain sufficient information to perform a SIM Swap on a potential victim by classic social engineering tactics.

SIM Swaps have evolved over time and can be sorted into the following classifications:

• The Classic SIM Swap Attack occurs when an adversary gains physical access to a phone, and is able to physically remove and replace the phone’s SIM card;

• Insider SIM Swap Attacks are orchestrated with the assistance of complicit employees within the victim’s mobile service provider;

• and Socially Engineered SIM Swap Attacks wherein an adversary uses social engineering tactics to manipulate customer service representatives into swapping the victim’s SIM card.

2.1 SIM Swap Attacks in Financial Crime

Traditional financial institutions such as banks and credit card companies took advantage of the advances in mobile computing capabilities to introduce apps that provide user interfaces to access various services. Banks apps may allow users to access accounts to monitor their balances, initiate bill payment services, or even transfer funds; credit card company apps commonly allow users to monitor their accounts and initiate payments from connected bank accounts. Many financial apps rely on information held within the SIM card for streamlined authentication, which may be by sending a one-time passcode connected to the phone number (i.e., SMS two-factor authentication - 2FA), or even keeping the financial app logged into the institution’s system.

SIM Swap attacks are an increasing vector for financial crimes, leading to many millions of customer losses, along with institutional resources expended on insurance and investigations. Classical SIM Swaps require that criminals gain physical access to a victim’s phone, and this is usually a trivial matter for pickpockets, especially in crowded environments or where people have been consuming alcohol (as alcohol generally dulls the victim’s senses). However, there is enough personally identifiable information easily available on the Internet to make Socially Engineered SIM Swaps are becoming an increasing risk. Money stolen from traditional financial institutions will usually be transferred into a money laundering network to protect the criminal from prosecution.

One recent report in New Orleans [13] detailed how the victim’s phone was stolen during a ride share after a night of partying. The victim’s party ordered transportation through a ride shareapp , and accepted a ride in a car with another passenger in the back seat (in spite of being admittedly uncomfortable with the situation). The criminal was able to abscond with the victim’s phone, and steal $7,000.00 from the victim’s bank account. Another report [12] is typical of Socially Engineered SIM Swaps. A victim in Colorado received an email from his bank alerting him to a transfer of $24,500.00. The criminal(s) acquired enough information about the victim to impersonate him to a phone company employee and get a new, cloned SIM card. This enabled them to reset bank account passwords, and transfer funds into a money laundering network.

Investigating and prosecuting the criminals who perpetrate SIM Swaps in financial crime is difficult due to the use of money laundering networks. Nonetheless, there have been notable prosecutions against SIM Swappers. Insider SIM Swap attackers are often the easiest to disrupt and prosecute. For instance, the U.S. Attorney for the Eastern District of Louisiana announced the guilt and sentencing of a former phone company employee who had taken bribes to clone at least 19 SIM cards for criminal associates [22]. In February 2023 [23], the U.S. Attorney for the Southern District of New York announced the disruption and prosecution of a gang that was responsible for at least $1,000,000 stolen from victim bank accounts.

2.2 Threat to Cryptocurrency Holders

Cryptocurrencies have grown wildly in popularity since Bitcoin was released in 2008, and have created a dynamic economic system that can serve as an alternative to traditional financial institutions. While some institutions within the traditional finance space (e.g., banks, hedge funds) are examining how to incorporate cryptocurrencies into their service portfolio, cryptocurrency holders largely serve as their own bankers. Cryptocurrencies are “held” in cryptocurrency wallets [15] which are mechanisms that hold private and public keys. Cryptocurrency wallets create and broadcast valid transactions, and maintain account balances and transaction histories. Cryptocurrency wallets may be “cold” (e.g., paper wallets or hardware wallets that are not directly connected to the Internet), or “hot” software-based wallets (e.g., a smart phone app). Cryptocurrency exchanges, which provide an “on/off-ramp” for users to navigate between fiat currencies and the cryptocurrency ecosystem; many users interact with their exchange accounts through smart phone apps, and treat them as de facto wallets.

SIM Swaps play a significant role in cryptocurrency crime, becoming an attack vector in cryptocurrency theft and fraud around the world [16, 19]. Many cryptocurrency exchanges utilize SMS 2FA, or other MFA authentication means which relies on the user’s SIM card [14, 3]; once the attacker has cloned or swapped the SIM card, they have easy access to any service that uses the SIM card for authentication. Additionally, SIM swaps can enable identity theft of high-profile individuals, which gives the attacker an opportunity to scam users through social media. Former United States President Barack Obama and then-former Vice President Joe Biden, among others, were the victims of SIM Swaps in 2020 that led to them temporarily losing control of their Twitter accounts [9]. Posing as the former President and Vice President, the scammer promised to send $2,000.00 worth of Bitcoin to any address that $1,000.00 worth of Bitcoin to the scammer’s wallet; victims lost more than $100,000.00. Ethereum Co-Founder Vitalik Buterin was the victim of a SIM Swap attack in September 2023 [25]. Scammers were able to deceive his mobile network provider, and then take over his Twitter account in order to lure victims with a NFT scam with a malicious URL (Figure 1). Victims lost more than $690,000.00. Beyond the fraud perpetrated on social media after Buterin lost control of his phone, 2023 has seen a series of subsequent and notable cases of SIM Swaps used for cryptocurrency theft.

An employee at the financial advisory firm Kroll, which serves as the claims agent for multiple bankrupt cryptocurrency firms, was the victim of an August 2023 Socially Engineered SIM Swap attack [21]. The attacker was then able to gain access to files that contained confidential information on bankruptcy claimants in the FTX case. The attacker used this information to send claimants a phishing email that was meant to convince them to link a cryptocurrency wallet and expose private keys, which would enable further cryptocurrency theft [18].

Figure 1: Ethereum Co-Founder Vatlik Buterin discloses that he was the victim of a SIM Swap attack on the Warpcast social network (September 12, 2023) [4].

A Co-Founder of Blockchain Capital [2], a blockchain and cryptocurrency focused venture capital firm, lost approximately $6,300,000.00 worth of Bitcoin, Ether, and other digital assets. The attacker utilized information available via darkweb markets to conduct a socially engineered SIM Swap, then transferred assets out of a hot wallet, and attempted to transfer approximately $14,000,000.00 of digital assets out of an associated cold wallet. In a particularly brazen move, the attacker sent the victim a message claiming to be able to SIM Swap any phone in the Mainland United States of America. Other notable victims of cryptocurrency theft by SIM Swap include executives at OpenAI, Bored Ape, and the Atpos Foundation, with losses totalling more than $13,000,000.00 [1].

Prosecutions of SIM Swap-based cryptocurrency crimes are relatively rare, due in part to the fact that many criminals are operating outside of the United States. Joseph O’Connor, the hacker who SIM Swapped the former President and Vice President in 2020, was extradited to the United States from Spain and sentenced to 5 years in prison. The United States Attorney’s Office for the Southern District of New York achieved a conviction and 18-month prison sentence against a member of a criminal gang that stole more than $20,000,000.00 worth of cryptocurrency and digital assets. The victim in the Blockchain Capital case above has filed a lawsuit against his as-yet unnamed attacker. Victims of SIM Swap-based cryptocurrency theft have ongoing litigation against the Coinbase cryptocurrency exchange, though analysts suggest that the plaintiffs have a difficult case to make[3]. Litigation against mobile network providers face similar challenges [20].

3 Mitigation Strategies and Countermeasures

Defending against SIM Swap attacks requires a multi-pronged approach, with responsibilities falling on individual users, mobile network operators, and service providers. Moreover, technologies and practices are evolving to mitigate the threat against current SIM Swap attack methodologies; however, this leads criminals to evolve their attack methodologies as well. For instance, innovations in smartphone hardware are making Classic SIM Swap attacks far less prevalent, thus criminals are increasingly using Socially Engineered SIM Swap attacks.

Individual users can best protect themselves from becoming the victim of a SIM Swap attack (as well as most other cybersecurity vulnerabilities) by practicing good cyber hygiene [17]. It is always prudent not to broadcast one’s wealth or position on social media, as this can assist criminals in their target selection. Smart phone-based apps provide users considerable convenience, but often at the cost of security. Individual users can reduce their attack surface by intentionally making a choice in favor of increased inconvenience. For example, users exercising greater physical security (e.g., keeping their phone in a secured, interior pocket) will limit opportunities for a Classic SIM Swap attack. Users should utilize hardware token MFA devices when they are supported, rather than SMS 2FA or MFA apps that are associated with their SIM card.

Mobile network operators (i.e., phone companies) are a vector for both Insider and Socially Engineered SIM Swap attacks. Several of the incidents covered in Sections 2.1 and 2.2 were enabled by explicit actions or oversights by phone company employees, and the U.S. Department of Homeland Security has encouraged phone companies to improve their defenses against SIM Swaps [5]. Insider SIM Swap attacks require a complicit phone company employee to authorize a new SIM card issuance. A relatively effective strategy to mitigate against this attack is to require greater employee oversight. For instance, requiring management to approve SIM card issuance or replacement will distribute liability, which should act as a disincentive to the corrupted employee.

Service providers such as cryptocurrency exchanges and financial institutions often utilize a user’s smartphone SIM card for authentication purposes; however, methods such as SMS 2FA and MFA are useless once a SIM Swap attack has occurred. Moreover, support for hardware token MFA devices is not as widespread as SIM-associated authentication methods; broadening support for hardware token MFA devices from service providers would significantly lessen the impact of SIM Swap-based cyber crime. Kim, et al. [16] document a cross-industry check system between service providers and mobile network operators. In this system, customer fund transfers placed from smartphone apps are flagged, and the bank then sends the phone company a query as to whether the associated SIM has been recently changed; if so, then the bank would perform further due diligence on the transaction.

Looking forward, phone companies and service providers are able to fund research and development of new technologies that can make Classic SIM Swap attacks more difficult. An example of this is the development of the embedded SIM (e-SIM), where the SIM card is not removable from the phone, and multi-SIM devices [24]. AI-based behavioral analysis [19, 11] has shown great success in fraud detection, so it stands to reason that this work can be matured for the purpose of detecting and preventing SIM Swap attacks. The details and fallout of the Kroll SIM Swap attack [21] should be particularly chilling for enterprises where employees can use their mobile devices to access critical enterprise systems, and further research and development is necessary to address this gap in identity and access management. Given the increased difficulty of Classic SIM Swaps and the documented impact of Socially Engineered SIM Swap attacks, it stands to reason that criminals will use every available tool, including improved deepfake technologies [6], to victimize their targets. The detection of deepfake social engineering attacks is imperative to combat what will certainly become a common cyber criminal tactic.

4 Conclusion

Mobile technology enables users to interact with a host of services, including financial services, from any location and without verifying their real world identities, relying instead on a digital identity. The SIM card in the user’s mobile device serves as a bridge between the user’s digital and real world identities; however, that bridge is an enticing target for cyber criminals. “SIM Swap” attacks are a term for any cyber attack where a criminal is able to take over a victim’s mobile phone number, which enables them to authenticate into any service with which that phone number was associated. SIM Swaps attacks are a recently emerging cyber crime tactic that have led to hundreds of millions of U.S. Dollars worth of financial losses across both traditional finance and cryptocurrency; moreover, these attacks have been successfully used to gain access into enterprise systems in order to extract sensitive information.

Despite the growing threat of SIM Swaps, there is a dearth of literature on the topic from academic or professional cybersecurity researchers. This paper introduced the reader to SIM Swap attacks, providing a nomenclature of attack methodologies. Several SIM Swap attacks were detailed to give the reader a clear idea of the impact that such an incident can have on a victimized individual or organization. Finally, mitigation strategies were discussed, along with potential research directions which may contribute to combatting this cyber crime tactic.

References

[1] Almada Lopez, D. “Bored ape ceo & openai cto among victims of sim swap scams.” Crypto Briefing News (August 24 2023). https://cryptobriefing.com/victims-of-sim-swap-scams-54-bored-ape-openai/.

[2] Baird, K. “Crypto ceo loses $6.3 million in daring sim-swap heist.” be(in)crypto News (August22 2023). https://beincrypto.com/crypto-ceo-loses-6-3-million-swap-heist/.

[3] Buntinx, J. “Sim swapping victim sues coinbase over sms 2fa hack but may fight a losing battle.” Cryptomode News (March 8 2023). https://cryptomode.com/sim-swapping-victim-sues-coinbase-over-sms-2fa-hack-but-may-fight-a-losing-battle/.

[4] Buterin, V. “Buterin sim swap announcement, September 12 2023.” https://warpcast.com/vitalik.eth/0x8ea2d0.

[5] Cyber Safety Review Board. “Review of the attacks associated with lapsus$ and related threat groups report,” July 24 2023. https://www.cisa.gov/resources-tools/resources/review-attacks-associated-lapsus-and-related-threat-groups-report.

[6] de Rancourt-Raymond, A., and Smaili, N. “The unethical use of deepfakes.” Journal of Financial Crime 30, 4 (2023), 1066–1077.

[7] Disterer, G., and Kleiner, C. “Byod bring your own device.” Procedia Technology 9 (2013), 43–53.

[8] FBI Internet Crime Complaint Center. “Criminals increasing sim swap schemes to steal millions of dollars from us public (public service announcement: Alert number i-020822-psa),”February 8 2022. https://www.ic3.gov/Media/Y2022/PSA220208.

[9] Frenkel, S., Popper, N., Conger, K., and Sanger, D. E. “A brazen online attack targets v.i.p. twitter users in a bitcoin scam.” The New York Times (July 15 2020). Updated on May 5, 2021.

[10] Gu, G., and Peng, G. “The survey of gsm wireless communication system.” In 2010 international conference on computer and information application (2010), IEEE, pp. 121–124.

[11] Hu, X., Chen, H., Liu, S., Jiang, H., Chu, G., and Li, R. “Btg: A bridge to graph machine learning in telecommunications fraud detection.” Future Generation Computer Systems 137 (2022), 274–287.

[12] Jajola, J. “Hacker steals man’s $24,500 in savings using ’sim swapper’ attack.” 9 News Denver (March 2 2023). https://www.9news.com/article/news/crime/hacker-sim-card-swap-scam/73-c7f0d7a1-5c90-46f6-b316-7eb2814fe485.

[13] Jones, D. “Hackers steal thousands of dollars through victims’ cell phones using sim swap fraud.” Fox 8 New Orleans (March 17 2023). https://www.fox8live.com/2023/03/18/hackers-steal-thousands-dollars-through-victims-cell-phones-using-sim-swap-

[14] Kan, M. “95% of coinbase users rely on sms-based 2fa, account takeover stats reveal.” PC Magazine (January 20 2023). https://www.pcmag.com/news/95-of-coinbase-users-rely-on-sms-based-2fa-account-takeover-stats-reveal.

[15] Karantias, K. “Sok: A taxonomy of cryptocurrency wallets.” Cryptology ePrint Archive (2020).

[16] Kim, M., Suh, J., and Kwon, H. “A study of the emerging trends in sim swapping crime and effective countermeasures.” In 2022 IEEE/ACIS 7th International Conference on Big Data, Cloud Computing, and Data Science (BCD) (2022), IEEE, pp. 240–245.

[17] Maennel, K., M ̈ases, S., and Maennel, O. “Cyber hygiene: The big picture.” In Secure IT Systems: 23rd Nordic Conference, NordSec 2018, Oslo, Norway, November 28-30, 2018, Proceedings 23 (2018), Springer, pp. 291–305.

[18] Malwa, S. “Ftx customers hit by ’withdrawal’ phishing mails after sim swap attack.” Coin Desk (August 29 2023). https://www.coindesk.com/business/2023/08/29/ftx-customers-hit-by-withdrawal-phishing-mails-after-sim-swap-at

[19] Nicholls, J., Kuppa, A., and Le-Khac, N.-A. “Financial cybercrime: A comprehensive survey of deep learning approaches to tackle the evolving financial crime landscape.” Ieee Access 9 (2021), 163965–163986.

[20] Sinclair, S. “At&t off the hook in $24m crypto sim swap case.” Blockworks (April 4 2023). https://blockworks.co/news/att-crypto-sim-swap-lawsuit.

[21] The Hacker News. “Kroll suffers data breach: Employee falls victim to sim swapping attack.” The Hacker News (August 26 2023). https://thehackernews.com/2023/08/kroll-suffers-data-breach-employee.html.

[22] U.S. Attorney’s Office, Eastern District of Louisiana. “Former phone company employee sentenced to three months probation for role in sim swap scam conspiracy that targeted at least 19 customers, including new orleans resident,” October 20 2021. https://www.justice.gov/usao-edla/pr/former-phone-company-employee-sentenced-three-months-probation-role-sim

[23] U.S. Attorney’s Office, Southern District of New York. “Seven defendants charged with million-dollar identity theft and fraud scheme,” February 16 2023. https://www.justice.gov/usao-sdny/pr/seven-defendants-charged-million-dollar-identity-theft-and-fraud-scheme.

[24] Vikhrova, O., Pizzi, S., Terzani, A., Araujo, L., Orsino, A., and Araniti, G. “Multi-sim support in 5g evolution: Challenges and opportunities.” IEEE Communications Standards Magazine 6, 2 (2022), 64–70.

[25] Young, M. “Vitalik buterin reveals x account hack was caused by sim-swap attack.” CoinTelegraph (September 12 2023). https://cointelegraph.com/news/vitalik-buterin-reveals-x-account-hack-was-caused-by-sim-swap-attack

Despite being the proud bearer of the SOC 2 Type 2 certification, FPG fell victim in June 2023 to a hack that resulted in staggering losses. In the wake of this disaster, one thing has become painfully clear: SOC 2 Type 2 certification, a beacon of trust and reliability for traditional companies, now falls short in the face of the sophisticated threats that crypto companies face. It's time to shift gears, to move towards supplementing existing SOC and ISO standards with more specialized requirements for crypto companies.

The answer? Cryptocurrency Security Standard (CCSS).

CCSS is a globally recognized standard of security that addresses the unique threats facing the crypto industry. It's not just a simple patch to an existing framework but a comprehensive and specific solution designed to safeguard digital assets. It is the only standard that is laser-focused on private key management, which is not covered by legacy standards.

In a groundbreaking initiative, crypto crime fighting company CAT Labs is joining forces with the non-profit organization C4 (CryptoCurrency Certification Consortium) to champion the adoption of CCSS in the crypto industry. This strategic partnership aims to accelerate the implementation of the CCSS security standard via educational programs, certifications and political outreach, fostering a robust shield of protection for digital asset custodians, crypto hedge funds and other businesses dealing in digital assets.

The first initiative emerging from this partnership is a basic training course on mastering the CCSS Level 1 standard designed for crypto asset managers, hedge funds, insurance companies, family offices and executives at crypto companies. This course will provide a firm understanding of what is needed to obtain CCSS Level 1 Certification. Interested parties can pre-register HERE.

"C4 has been a trailblazer in open blockchain education and crypto cybersecurity standard setting. Their mission perfectly aligns with our goal to bolster cybersecurity within the crypto industry, " said Lili Infante, CEO of CAT Labs. "Together, we are set to make the CCSS standard the industry norm, paving the way for a safer Web3 ecosystem."

“CAT Labs is dedicated to protecting users of crypto and mitigating vulnerabilities associated with holding digital assets and C4’s CryptoCurrency Security Standard (CCSS) is a way to hold organizations accountable for the way in which they manage private keys,” said Jessica Levesque, Executive Director of C4. “Our shared mission will make the Web3 ecosystem safer, increasing protection from bad actors and overall key mismanagement, thus driving crypto adoption.”

This strategic initiative is supported by major crypto industry leaders including crypto infrastructure providers, investors and cybersecurity auditors to ensure a safer and more prosperous future for the cryptocurrency industry.

"Digital assets and the cryptocurrency rails are actively transforming the financial industry. As the first company to achieve Level 3 CCSS certification, we at Fireblocks understand the importance of robust cybersecurity measures required to safeguard cryptocurrency assets. We applaud the efforts of CAT Labs and C4 in their partnership to drive the wider adoption of the CCSS security standard. It is initiatives like these that will solidify the security infrastructure necessary for digital asset custodians, crypto hedge funds, and other businesses in our industry. Now is the time to embrace the future of finance and ensure its safety for all participants," says Michael Shaulov, CEO of Fireblocks - the leading enterprise crypto management platform in the industry.

"At Halborn, we recognize the unparalleled importance of safeguarding digital assets in this rapidly evolving crypto landscape. With our team of dedicated CCSS-certified auditors, we have seen firsthand the efficacy of the CCSS framework. It's more than just a security standard; it's a testament to the maturation and sophistication of the crypto industry. We wholeheartedly endorse the CCSS standard initiative and believe it represents the future of crypto security," said David Schwed, COO at Halborn - an elite cybersecurity company for blockchain organizations.

"As a leader in crypto hedge fund investments, Amphibian Capital recognizes that the legacy cybersecurity standards are not enough to protect crypto asset managers from cyber exploits. We stand firmly with CAT Labs and C4's initiative to implement the CCSS security standard across the industry. It's high time we fortify the infrastructure of digital finance to safeguard our future," asserts James Hodges, General Partner and Co-Founder of Amphibian Capital - a leading fund of funds focusing on investing in crypto hedge funds.

“Cybersecurity and overall risk management are of the utmost importance to the continued development of the digital asset ecosystem. Lockton believes that consistent and attainable industry standards are key to bridging the gap between growing companies looking to build comprehensive risk management frameworks and the insurers they need to support them. Standards like the CCSS and the efforts of companies like CAT Labs and C4 provide companies looking for insurance with an opportunity to credential themselves and insurance markets with a measurable benchmark to aid their underwriting processes. We are excited to see what the future holds as the CCSS initiative continues to gain traction,” said Sarah Downey, Blockchain & Digital Assets Advisory Leader at Lockton - the world’s largest insurance brokerage.

“Insurers of digital assets would greatly welcome an industry wide adoption of an appropriate certification specifically designed for the assessment and qualification of digital asset systems. Insurers can underwrite more traditional, physical asset classes in a fraction of the time it takes to underwrite a digital asset risk and the disproportionate time cost of underwriting has to be accounted for as part of the insurance premium calculation. The creation and adoption of a digital asset system specific set of standards would potentially significantly improve the efficiency of our underwriting and this time cost saving can be passed onto the insureds in the form of a premium cost saving,” said James Croome, Underwriter at Arch Insurance Group - a market-leading specialty insurer.

About CAT Labs:

CAT Labs is building digital asset recovery and cybersecurity tools to enable the public and private sectors to fight crypto-enabled crime. CAT Labs team is the “Special Forces” protectors of the crypto industry with unparalleled blockchain security experts, cryptographers, former U.S. Department of Defense computer scientists, ethical hackers and U.S. Department of Justice investigators, who spent the past decade taking down some of the most prolific crypto criminals. CAT Labs is developing cutting edge encryption technology for key management, insider threat management, ML-powered anti-phishing solutions, and digital asset recovery tools.

About C4:

C4 is a non-profit organization dedicated to fostering education, certification, and standards in the fast-evolving blockchain technology space. C4 offers certifications for professionals to validate their knowledge of open blockchain technology and standards, as well as educational programs for those new to the industry. C4 is also the developer of the first-ever CryptoCurrency Security Standard, which provides a clear security rating for private key management.

On this special occasion of 4th of July, we proudly pay tribute to Roger Hallman, our esteemed Head of R&D, for his exceptional contributions to cybersecurity and national defense. As an American patriot, Roger epitomizes dedication, innovation, and a profound commitment to serving our great nation.

Roger's impressive background includes being a Dartmouth PhD Candidate and U.S. Department of Defense SMART Scholar. Having served as a computer security researcher at the Naval Information Warfare Center, he spearheaded groundbreaking DARPA R&D projects and played a pivotal role in advancing cyber defense applications. His visionary expertise in fully homomorphic encryption, secure computation, and blockchain technology has been instrumental in shaping the future of cybersecurity.

Roger believes that the fusion of blockchain technology with resilient cyber defense strategies has the potential to transform the U.S. national security landscape.

In 2022, Roger's exceptional work earned him well-deserved recognition from the Navy for his chapter contribution in "Game Theory and Machine Learning for Cyber Security." His chapter, entitled "Resilient Distributed Adaptive Cyber‐Defense Using Blockchain," highlights his groundbreaking research and expertise in leveraging blockchain technology for resilient cyber defense strategies.

Furthermore, Roger's impact transcends academic contributions. As a co-inventor of a Navy patent, he has made tangible contributions to the field. This patent showcases his innovation and dedication to securing our nation's digital infrastructure.

Prior to his role at CAT Labs, Roger served as a cybersecurity researcher at the Naval Information Warfare Center. His unwavering commitment to duty and service, as a Marine Corps veteran and a civilian employee, exemplifies his dedication to protecting our nation's cybersecurity.

At CAT Labs, we are privileged to have Roger as a valued member of our team. His remarkable expertise, visionary leadership, and unwavering commitment to innovation have greatly contributed to our mission of advancing cybersecurity technologies. We applaud his outstanding achievements and his unwavering dedication to our nation's defense.

Join us in celebrating Roger Hallman's exceptional journey and his profound impact on the world of cybersecurity.

#HonoringAmericanPatriots #CybersecurityInnovation #4thofJuly #CatLabs #NationalDefense #BlockchainTechnology #ResilientCyberDefense #AmericanPatriot #Veteran #Dedication #Service

1. Brand Identity: Consider how the name aligns with our desired brand identity and the emotional appeal it evokes. CAT Labs is building tools to fight crime and protect the Web3 industry from malicious bad actors. CAT, besides being an acronym for our chosen domain in Cryptographic Asset Technology, also carries symbolic significance in its association with the feline spirit. Cats have been seen as a symbol of protection in various cultures throughout history. Cats were seen as natural protectors because of their hunting abilities, keen senses, agility, and their ability to see in the dark. They were also believed to have magical powers and the ability to ward off evil spirits. Because of these beliefs, cats were often depicted as guardians of the underworld in ancient Egyptian art and mythology. They were sometimes even buried with their owners in tombs as a symbol of protection in the afterlife. In addition to ancient Egypt, cats were also regarded as protectors in ancient Greece and Rome, where they were associated with the goddesses Artemis and Diana, respectively. In Japan, the "maneki-neko" or "beckoning cat" is a common symbol of good luck and protection. In the modern world, besides being avid pest hunters, cats are often prescribed by mental health professionals as emotional support animals, helping humans to ward off depression and anxiety (often more effective than Big Pharma solutions). Overall, cats have been seen as protectors in various cultural contexts and continue to play a role in providing both physical and emotional protection to humans today. Just like cats hunt literal pests and reduce overall anxiety levels in their human companions, CAT Labs is hunting the proverbial pests of the crypto industry (hackers, scammers and fraudsters) and reducing anxiety around participating in the revolutionary digital asset space.
2. Relevance: Ensure the name is relevant to our business and target audience. It should convey a sense of what our business does or the products/services it offers. "CAT" is an acronym for Cryptographic Asset Technology. "Labs" implies an emphasis on research and development, which is an integral part of our business strategy, as we develop cutting edge technologies that are largely based on state-of-the-art academic research in cryptography which in some cases hasn't even had the chance to break out into the commercial space.
3. Scalability: Consider the long-term potential of the name. Will it still be relevant and appropriate as our business grows or expands into new markets? Cryptographic Asset Technology is broad enough to allow us the flexibility in building a range of products in the field of cryptography and digital assets utilizing cryptographic encryption. It doesn't box us into a particular product or service, but is specific enough to give us enough focus so we don't venture out into irrelevant fields.
4. Uniqueness and Memorability: Choose a name that stands out and is easy to remember. The name CAT is not necessarily unique on its own, but it is certainly memorable and unique to the tech and cybersecurity industry. Besides, cats are awesome! 😺
5. Simplicity and Clarity: A simple and clear name is easier to remember and communicate. Avoid complex or hard-to-spell words that could lead to confusion. CAT Labs meets this criteria in that it is easy to spell and pronounce in multiple languages.
6. Domain and Trademark Availability: Check the availability of domain names associated with our chosen business name. Having a corresponding domain name that matches our business name helps with online branding and marketing efforts. Conduct a thorough trademark search to ensure that the name we choose is not already trademarked or in use by another business in the same industry. This step helps protect your business from legal issues and potential conflicts.

Solutionism is an increasingly prevalent mindset in the fast-paced world of SaaS. Companies are eager to innovate, create, and deliver. While this enthusiasm is commendable, it can lead to developing solutions without clearly understanding or defining the problems they aim to solve. The result is a mismatch between the product offerings and the actual needs of the customers, resulting in low adoption rates, poor customer satisfaction, and ultimately, business failure.

Adopting a problem-centric approach, on the other hand, focuses on identifying and understanding the customers' pain points before developing a solution. This approach ensures that the product is tailored to the market's needs, thereby increasing the likelihood of its success. This is where design partners become an invaluable asset. These are potential customers who are integrated into the product development process, providing constant feedback and suggestions. Engaging design partners allows companies to avoid solutionism by ensuring that product development is driven by genuine customer needs.

Design partners provide real-world perspectives that guide the development of features, interfaces, and overall user experience. They help ensure that the product solves real problems, improves workflow efficiencies, and adds tangible value for the end-user. Involving design partners in the design process creates an environment of co-creation that results in products that are not only innovative but also practical and market-ready.

Collaborating with design partners also cultivates strong relationships, leading to long-term customer loyalty and advocacy. These design partners often become early adopters and champions, helping drive its adoption in the wider market. However, to derive the maximum benefit from this approach, the selection of design partners should be a strategic process. They should represent a cross-section of the intended target market and possess a deep understanding of the industry's challenges and requirements.

By adopting the outlined approach of building with the right design partners from the very beginning, SaaS companies can ensure their products are valuable, relevant, and successful in the market.