The Most Damaging Hacking Campaigns in 2022: Hackers steal $620M from Axie / Costa Rica declares state of emergency / Hackers steal $400M from FTX

Plus: Wormhole Bridge gets breached, $325M stolen

Inside.com Part of   Network December 30, 2022

This year, we saw cybersecurity become more important than ever. The war in Ukraine led to what many consider to be the first cyberwar in history, while hackers used more tools than ever before against an ever-increasing scope of targets. Governments, companies, charities, universities, and hospitals around the world were all victims of cyberattacks. To summarize these events, in this special edition, we have listed The Most Damaging Hacking Campaigns in 2022. Thank you for supporting our Security newsletter and Inside.com, and have a Happy New Year! Arbër

1) Hackers steal $620M from Axie Infinity North Korean hacker group Lazarus Group shocked the cryptocurrency industry when news broke of a $620M theft. The government-backed threat actor managed to hack the blockchain-based game by convincing an employee to click on a fake job offer. The Axie Infinity employee conducted several fake interview rounds before being sent a PDF file that was infected with malware. The successful hacking campaign became the largest breach in the history of blockchain-based games. 2) Costa Rica declared a state of emergency as a Russian hacker group paralyzed the country's healthcare and administration What started a series of localized ransomware attacks on April 17, 2022, became arguably the worst hacking incident in Costa Rica's history. Conti, a pro-Russia hacker group, launched 10 Cobalt-strike attacks to initially bring down the servers of Costa Rica's Ministry of Finance. After a successful breach, the hacker group moved laterally to gain access to servers belonging to several other institutions, including the national healthcare system. The hacker group was able to shut down essentially all digital operations in the country, with patients having to wait to see their doctors because they couldn't access their patients' MRIs. Costa Rica's president claimed that the country was "at war" and refused to pay a $20M ransom that the hackers reportedly demanded. The country was forced to ask the U.S. government for help, resulting in the direct involvement of the FBI.

3) Hackers steal $400M from FTX wallets After crypto exchange FTX filed for bankruptcy in November, it was revealed that the exchange's wallets were losing funds that amounted to $400M. Sam Bankman-Fried, the former CEO of FTX, said in an interview that a former employee or bad actor had likely stolen private keys and was stealing funds from FTX users. Later on, security researchers and new FTX staff confirmed that the company had stored private keys without encryption, presenting an easy opportunity for hackers to take advantage of consumer funds. 4) Hackers steal $325M from Wormhole Bridge In February, hackers stole over $320M in wETH, or wrapped Ether, which allows Ether to be exchanged for other tokens. The Wormhole team offered a $10M bounty for returning the funds but didn't retrieve any portion of it. At the time, the breach was the second largest in the history of cryptocurrency companies.

5) The $190M Nomad Bridge hack On Aug. 1, users discovered a software bug that allowed them to withdraw more funds than they had deposited. Once this flaw was made public, thousands of users and hackers took advantage. The flaw resulted in a $190M loss for the bridge blockchain solution that took pride in its safety. Hackers only returned $9M out of the total amount. 6) Wintermute hackers steal $160M In September, crypto company Wintermute was hacked out of $160M in its DeFi operations. The hack likely originated with a service called Profanity, which generates "vanity addresses" for accounts to make them easier to access. The company claims that a security vulnerability with Profanity's code  may have allowed a hacker with enough computing power to hack possible keys and passwords.

7) The Wintermute hack Wintermute was breached earlier this year, resulting in approximately $160M across 70 tokens being hacked out of the wallet. Similar to the FTX case, Profanity's key generation tool was mentioned as a key liability factor in this breach, while others alluded to potential abuse of authority from actors within the company. 8) Hackers steal $100M from BNB Chain The BNB Chain was paused on Oct. 6 due to "irregular activity" on the network, which later was found to be a breach that resulted in a $100M hack from its cross-chain bridge, the BSC Token Hub. The threat actor had over $100M worth of digital assets frozen on the BNB Chain, with more possibly stuck in cross-chain bridges that were unusable.

9) Russia shuts U.S. institutions down Russian-speaking hackers claimed responsibility for shutting down state government websites in Colorado, Kentucky, and Mississippi in October of 2022. The hacking campaign was part of a continuous attempt to disrupt U.S. voter registration from foreign threat actors that are backed by governments, including Russia. 10) Beanstalk Farms loses $76M Stablecoin protocol Beanstalk Farms was hit by a $76M breach on April 18 from a threat actor that used a flash loan to buy governance tokens. The exploit was initially thought to have cost the company around $182M as Beanstalk was drained of all its collateral, but in the end, the hackers were unable to steal the full amount.

Quick Hits Need help setting up and securing your business' Apple devices? Manage up to 3 devices for free with Jamf Now..* LockBit Ransomware has claimed responsibility for hacking the Port of Lisbon Administration, the third-largest port in Portugal. The Canadian Copper Mountain Mining Corporation was forced to shut down its mining operations after being breached by unspecified threat actors. Cybersecurity research company Dr.Web has tracked Linux malware that is able to take advantage of over 30 WordPress security flaws. The malware injects code remotely and enables the threat actor to take control of the targeted entity. Three Founders wished they could invest in fractional shares of real estate while browsing Zillow. So they made Arrived.*  *This is a sponsored post.

Upcoming events at Inside: January 05 - AMA with Gun.io - Building and managing software development teams w/ Deividi Silva (Watch On Demand) January 06 - AMA with LinearB - Improving workflow for developers w/ Ori Keren (Watch On Demand) January 10 - Inside Startups Coffee Break (Register Here) January 17 - Inside Marketing Coffee Break (Register Here) January 31 - Growth Summit 2023 (Register Here)

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.