Ubiquitous and Creative Fraud is Regular Feature of DeFi

In the final episode in our Saturday Series on cybersecurity, we explore cryptocurrency and what risks you take when your money enters an unregulated platform.

Read the full article.

About the author:
Theodore F. Claypoole

Transcript

Welcome to Womble Perspectives, where we explore a wide range of topics, from the latest legal updates to industry trends to the business of law. Our team of lawyers, professionals and occasional outside guests will take you through the most pressing issues facing businesses today and provide practical and actionable advice to help you navigate the ever changing legal landscape.
 
 With a focus on innovation, collaboration and client service. We are committed to delivering exceptional value to our clients and to the communities we serve. And now our latest episode.

 Welcome to the final episode in our Saturday Series on data privacy and cybersecurity. We’ve covered a lot of ground this month on what you can do to prevent cyberattacks, as a reminder, some of the top tips from this month include the following:

Use a password management tool to keep track of all your passwords and make sure all your information is in one, secure spot.

Avoid using public wifi hotspots in order to keep your computer secure. In addition, you should avoid using public charging cords or USB ports. 

Be aware of how phishing scams work – are there typos in the email address, an urgent call to action in the email, an unexpected attachment? If so, there’s a good possibility it’s a cybercriminal trying to gain access to your data.

Keep your devices updated to the latest operating system as software updates often patch security issues in previous versions.

And an often overlooked tool in your cybersecurity arsenal: talk to your kids. Make sure they’re familiar with all the steps outlined above and that they’re also on the lookout for suspicious activities online.

And if you do become the victim of a cyber attack, immediately secure your device, change all your passwords and, if you’ve been compromised through your work computer or email, notify your company of the breach immediately.

And now, a look into a different kind of data protection issue: fraud in the cryptocurrency world. 

If you read the hype, then you’ve probably read that lack of regulation, speed of transactions, irreversibility of trades, and hidden identities are positive features of the crypto world. Crypto enthusiasts say that finance can only be improved by avoiding banks, regulators, and rules. But faster and looser isn’t always better when we are talking about your investments. In fact, it’s a recipe for you to be defrauded out of your money.

Moving money quickly is the essence of crypto.  It’s also the essence of any organized fraud scheme.  And once taken, cryptocurrency can be moved quickly and laundered to avoid detection.

CNBC reports that fraud and scams in crypto took $14 billion in 2021 “thanks in a large part to the rise of decentralized finance (DeFi) platforms. More than $2.8 billion of this [fraud] total came from a very popular type of scheme known as a “rug pull,” in which developers build what appear to be legitimate cryptocurrency projects before ultimately taking investors’ money and disappearing.” This “relatively new” scam sounds like one of the oldest frauds in the book – the fake investment scheme. CNBC also notes that many of the new DeFi protocols have code vulnerabilities that hackers are able to exploit.

So who’s taking your cryptocurrency and what are they doing with it? North Korean hackers stole almost $400 million in cryptocurrency in 2021 alone from crypto exchanges and investment funds, according to the BBC. A United Nations panel that monitors sanctions on North Korea has accused Pyongyang of using stolen funds to support its nuclear and ballistic missile programs as a way to avoid international sanctions. The Secret Service has noted Romanian crypto scams last year targeted nearly 1000 U.S. victims, taking crypto payments for non-existent luxury goods. And NBC News reported that Russian cybercrime syndicates use crypto to launder their funds, transferring stolen Bitcoin to stablecoins to avoid volatility in their stolen prize. 

I guess fortune favors the brave.

Much of the crypto fraud is classic old-school scam based on selling to investors’ “fear of missing out, though some scams can be fairly creative. 

For example, a DeFi cryptocurrency project called Beanstalk held hundreds of millions of dollars’ worth of stablecoins that were advertised as being worth $1 apiece. They aren’t worth anything now. Who would have expected an investment disaster from an enterprise whose business model is described in the press as an “honest Ponzi,” relying on the promise of future investment to assure the claimed value of today’s coins? Disaster may have been predictable, but not the quite-possibly-legal scam that led to the losses.

DeFi and crypto enable a financial tool called flash loans, borrowing large sums to complete a purchase, then selling at a profit and paying the loan back very quickly. Flash loans can allow immediate access to large sums to take advantage of a short-lived investment opportunity. In this case, the loan was used to buy up at least a supermajority of the voting rights in the “decentralized autonomous organization” that controls Beanstalk. Once in control, the new controller of Beanstalk submitted a proposal for a vote, voted the controlling shares in favor of the proposal, and then when the proposal’s work was quickly completed, according to the Guardian “it sold the rights, retuned the loan, and began the process of laundering the proceeds.” 

And what did the proposal do? On its face it seemed like the proposed program would simply donate $250,000 to Ukrainian relief, but once passed, the program quickly moved nearly all the Beanstalk investor funds, $180 million, into the personal account for the person who just bought the shares. 

The shareholder took control of the company for a moment, successfully proposed and passed an action to pay himself all the money held to repay crypto investors, and then sold the shares and paid back the money borrowed to buy control of the enterprise. Nifty trick. This is effectively the same as buying a community bank for $5 million, removing $30 million in accountholder deposits to pay yourself, and then selling your shares in the bank once all its accounts were reduced to zero balance by you. This would be against banking rules because banks are highly regulated. But crypto is not, so maybe running this scam here won’t violate laws. 

That doesn’t make it OK.

On the day of the attack, the Beanstalk founders wrote, “Honestly not sure what to type. It is highly unlikely there is any sort of bailout coming.”  The Guardian wrote, “By the rules of the real world, there is almost certainly a crime here, although it’s not easy to identify which one. Maybe fraud? Probably you cannot hand someone computer code that says in quite clear English that it is a proposal to donate $250,000 to Ukraine but which actually donates $180m to you, and then when they run it, say “haha suckers” and not get in some sort of legal trouble. But the deeper you get into the crypto sector, the less the rules of the real world apply. In the real world, you also cannot start a wildcat bank that mints its own currency to pay double digit interest rates out of customer funds.”

And that’s the core problem. Games without rules can work for you or against you. People looking to defraud others love a world like the crypto-verse because it moves fast and has fewer rules, just like people who want to cheat at basketball or soccer would prefer to play without referees. The less real authorities exist, the more you can get away with. But what happens when someone bigger, meaner, and more willing to cheat takes advantage of you? 

If there is one thing we can count on in the world, it is that bad people will use an absence of rules or non-enforcement of norms to invade their neighbors, enrich themselves, and prey on others. Crypto investors may not set out to finance North Korea’s nuclear program or the Beanstalk bandits, but the scarcity of rules and enforcement allows this to happen, and makes a significant amount of fraud and theft predictable.

The Biden Administration has called for explicit regulations of cryptocurrencies and the blockchain-based economy. The EU has voted to remove anonymity from crypto transactions so that law enforcement has a better shot at following criminal and fraudulent transactions back to their source. There is reason to believe these policies will improve the crypt-sphere, rather than degrade it. A land without rules is a placed ruled by the lawless, and that leaves less space for the rest of us.

Thank you for listening to Womble Perspectives. If you want to learn more about the topics discussed in this episode, please visit The Show Notes, where you can find links to related resources mentioned today. The Show Notes also have more information about our attorneys who provided today's insights, including ways to reach out to them.
 
 Don't forget to subscribe via your podcast player of choice so that you never miss an episode. Thank you again for listening.