Tag: Hacks

Kiffmeister’s #Fintech Daily Digest (20230227)

~ kiffmeister

Companies have sprung up that say they can recover stolen crypto. That rarely happens.

Forbes published an article about a new industry that has cropped up that promise victims of crypto scams to spend more money in order to recover their already-lost sums, with scant evidence that they regularly work as advertised. Multiple U.S. financial and law enforcement agencies generally tell scam victims to treat these services with a healthy dose of skepticism. That’s because even if one of these companies is involved, law enforcement still has to do its own independent investigation — for which victims aren’t charged. Plus, no private company has the authority to compel the freezing, much less the seizure, of crypto assets held at an exchange. [Read more at Forbes]

Over 13 Million ALGO Now Suspected Stolen, Algorand Foundation CTO Responds To The Situation

Over 13 million ($3.5 million) ALGO has reportedly been stolen between 19th to 21th of February, over 12 accounts have been affected. Most of the stolen ALGO was transferred to the ChangeNow, a non-custodial crypto exchange that operates without extending know-your-customer (KYC) to all its users. However, the ChangeNOW team has implemented anti-money laundering (AML) mechanisms designed to detect fraud and filter suspicious transactions, and had halted $1.5 million of suspicious ALGO and USDC transactions on the Algorand blockchain and stopped the malicious actors from accessing the stolen funds any further. [Read more at AlgoDaddy]

There may be a connection with MyAlgo web-based non-custodial wallets, which recently reported a targeted attack carried out against a group of high-profile MyAlgo accounts. MyAlgo wallets keep users’ encrypted private keys on their local devices, accessed using passwords and mnemonic phrases. However, being a web-based wallet, it is vulnerable to phishing attacks. According to MyAlgo, it appears that the attacked users all had significant funds in their accounts and were using mnemonic wallets with the key stored in the browser. None were using hardware wallets. The firm is strongly advising all users to withdraw any funds from mnemonic wallets that were stored in MyAlgo.

Upcoming conferences, webinars and speaking engagements:

  • I’ll be providing a (probably virtual) update on global central bank digital currency (CBDC) developments at the Digital Euro Association Digital Euro Conference on March 31 in Frankfurt. [Register here]
  • I’ll be moderating a panel on “what happens when the lights go out…different schemes for offline functionality” at the in-person Digital Currency Conference (DCC) in Mexico City on May 18. [Register here]

Kiffmeister’s global central bank digital currency monthly monitor

Just a reminder that I produce a monthly digest of central bank digital currency (CBDC) developments exclusively for the official sector. So for any of you out there who work for a central bank, ministry of finance or international financial institution who would like to receive it by email on the first business day of every month, please DM me on LinkedIn or email me at chronicles@kiffmeister.com.

The Sovereign Official Digital Association (SODA) is a technology-agnostic firm offering advisory services at the intersection of central banking, digital finance and the web3 industry, aiming to make public digital money a reality. SODA believes institutions in the existing financial ecosystem should have access to the tools and resources they need to move from discussion to action. SODA offers ‘real life’ use cases to help test digital money and drive adoption as central banks and other public institutions explore the future of a more financially inclusive world powered by interoperable blockchain-based networks. SODA would love you to join us on this journey – please get in touch (chris@sodapublicmoney.org).

Satoshi Capital Advisors is a New York-based, global advisory firm that works with central banks, governments, and the private sector to architect, implement, and operate varying initiatives. Satoshi Capital Advisors’ central bank work revolves around CBDC architecture and implementation, providing advisory services from research phase through to growth phase. Utilizing a product-market fit and technology agnostic approach to CBDC architecture and implementation enables Satoshi Capital Advisors to build tailored solutions, bespoke to local financial system nuances. Satoshi Capital Advisors welcomes requests from central bank officials for virtual and in-person CBDC workshops. [Click here for more information]

WhisperCash offers the first fully offline digital currency platform that has the same properties as physical cash. It can perform secure consecutive offline payments without compromising on security, privacy or accessibility. WhisperCash allows direct person to person offline payments without any server infrastructure or internet connectivity. It comes in various form factors including the self-contained credit card-sized “Pro” that sports an eInk screen and capacitive keyboard, and lasts for two weeks between recharges assuming a few transactions per day. [Click here for more information]

Kiffmeister’s #Fintech Daily Digest (20221010)

~ kiffmeister

My posts this week may get a bit spotty, as I’ll be in Washington DC for the Georgetown University DC Fintech Week, the CBDC Think Tank Summit, and various activities around the International Monetary Fund / World Bank Annual Meetings.

FSB outlines next steps for enhancing cross-border payments

The Financial Stability Board (FSB) published the priority themes for the next phase of work under the G20 Roadmap for Enhancing Cross-Border Payments. The FSB also published a report on the progress made during the second year of the Roadmap. Three priority themes have been identified to focus on in the next phase; (i) payment system interoperability and extension, (ii) legal, regulatory and supervisory frameworks, and (iii) cross-border data exchange and message standards. The plan includes steps to strengthen external engagement during this next phase. [Read more at the FSB]

Here are some specifics of the next steps from the progress report:

  • The Bank for International Settlements (BIS) in collaboration with International Monetary Fund (IMF) and World Bank will organize a conference to share information and encourage collaboration on cross-border payments across (planned) CBDC implementations by March 2023. Additionally, the IMF and World Bank will provide technical assistance on how to facilitate cross-border use of CBDC if requested.
  • The Committee for Payments and Markets Infrastructure (CPMI) will consider whether and how the use of well-designed and risk-managed stablecoin arrangements could enhance cross-border payments by addressing existing frictions, what opportunities and challenges this would entail, and how this could impact central banks’ core functions.

ECB seeks scheme rulebook manager for the digital euro

The European Central Bank (ECB) Directorate General Market Infrastructure and Payments is looking for a senior expert from the payments industry to coordinate the group that will draft a potential digital euro scheme rulebook, i.e. a set of rules for payment transactions with a digital euro. [Read more at the ECB]

EU tenders for blockchain data and DeFi project

The European Commission has reportedly put out a tender for a study on embedded supervision of decentralised finance. The study will entail a six month pilot project to develop, deploy and test a technological solution that would enable regulatory bodies to automatically monitor compliance by reading public blockchain data. [Read more at FinExtra]

First Digital Securities Issuances Go Live in Germany

Clearstream created the first digital instrument on D7, Deutsche Börse’s digital post-trade platform. The first automated issuances were performed by LBBW and Vontobel. D7 is fully integrated within Clearstream’s global infrastructure and works as a connector between established networks and digital capabilities. This will provide a fully digital alternative to conventional physical issuance for about 80% of German securities. [Read more at MarketsMedia]

Kiffmeister’s Global Central Bank Digital Currency Monthly Monitor

Just a reminder that I produce a monthly digest of central bank digital currency (CBDC) developments exclusively for the official sector. So for any of you out there who work for a central bank, ministry of finance or international financial institution who would like to receive it by email on the first business day of every month, please DM me on LinkedIn or email me at chronicles@kiffmeister.com.

Kiffmeister’s #Fintech Daily Digest (20221009)

~ kiffmeister

Understanding Stablecoin Technology and Related Security Considerations

The US National Institute of Standards and Technology (NIST) published a technical paper on the ways in which stablecoins are architected and implemented. This includes a descriptive definition, commonly found properties, and distinguishing characteristics, as well as an exploration of stablecoin taxonomies, descriptions of the most common types, and examples from a list of top stablecoins by market capitalization. This document also explores related security, safety, and trust issues with an analysis conducted from a computer science and information technology security perspective as opposed to the financial analysis and economics focus of much of the stablecoin literature. [Read more at NIST]

Hackers Feast on Crypto Weak Link and Even Binance Isn’t Spared

“There’s a gaping hole in the crypto industry’s security architecture, and even the most deep-pocked players haven’t figured out how to plug it. The weakness in question is what’s known in industry parlance as cross-chain bridges — software that allows crypto tokens to move between different blockchains. On October 6, 2022, a hacker made off with about $100 million via a bridge used by Binance… Chainalysis estimates that $2 billion worth of tokens have been looted from 13 separate attacks, the majority of which was stolen this year.” [Read more at Bloomberg]

Global VC Pullback Is Dramatic In Q3 2022

“Venture and growth investors in private companies scaled back their investment pace significantly as the slump in the public markets stretched into the third quarter. Venture funding for the third quarter of 2022 totaled $81 billion, down by $90 billion (53%) year over year and by $40 billion (33%) quarter over quarter, according to a Crunchbase News analysis. While funding for the most recent quarter will increase a little in the coming months as stealth fundings are announced, this is a huge drop in funding compared to prior quarters.” [Read more at Crunchbase]

Kiffmeister’s Global Central Bank Digital Currency Monthly Monitor

Just a reminder that I produce a monthly digest of central bank digital currency (CBDC) developments exclusively for the official sector. So for any of you out there who work for a central bank, ministry of finance or international financial institution who would like to receive it by email on the first business day of every month, please DM me on LinkedIn or email me at chronicles@kiffmeister.com.

Kiffmeister’s #Fintech Daily Digest (20220805)

~ kiffmeister

Jurisdictions Where Retail CBDC Is Being Explored

I’ve made some minor updates to my tabulation of retail central bank digital currency (CBDC) explorers. I count 85, which is lower than the count of some other trackers that, for currency unions, count all member countries. I count only the central bank that is responsible for currency issuance (e.g., the European Central Bank (ECB) in the Eurozone, and the Eastern Caribbean Central Bank in the Eastern Caribbean Currency Union (ECCU)). If I count all eight Eurozone member countries whose central banks are contributing to the ECB CBDC work, plus all eight member countries of the ECCU, my tally goes up to 101. If I also include all Eurozone countries I have a big fat headline number of 112! [See my tabulation here]

Thailand’s Central Bank Extends Retail CBDC Study to Pilot Phase

The Bank of Thailand (BoT) is extending the scope of retail CBDC development by starting a pilot study. It will adopt technology developed by Giesecke+Devrient and it is expected to run from the end of 2022 to mid-2023. However, the BoT emphasized that the purpose of the pilot is to assess the suitability of technology and CBDC design, and at present it does not have plans to issue retail CBDC until thorough consideration of benefits and associated risks for the financial system. [Read more at the Bank of Thailand]

ZB Exchange Loses Nearly $5M in Suspected Hack, Pauses Withdrawals

Crypto exchange ZB Exchange has paused user withdrawals, likely in response to a suspected hack that appears to have drained nearly $5 million in tokens from the firm’s hot wallet. The multimillion-dollar loss is the latest in a series of security breaches to hit crypto companies this year and the third multimillion-dollar hack reported this week. [Read more at CoinDesk]

PayTech and the D(ata) N(etwork) A(ctivities) of BigTech Platforms

The Bank of Canada published a paper that models the trade-off faced by BigTech payment platforms between costs associated with compensating users for their privacy concerns and revenues from the harvested data. The results of the modeling lead to two policy implications. First, data monetization is not necessarily inefficient from a social point of view because data are socially valuable and users are compensated for their privacy concerns with cheaper platform services. Second, when assessing BigTechs’ introduction of payment services, one needs to consider the bundling of data and payments and the implied complementarity. In economies with large payment frictions, data-driven payments tend to increase social surplus. In advanced economies, however, where payments are already fairly efficient, payment-driven data can lead to inefficient adoption by platforms that seek to generate data beyond what is socially efficient. [Read more at the Bank of Canada]

Upcoming events I’m affiliated with:

The CBDC Think Tank, in partnership with the International Monetary Fund and George Washington University, is hosting a full-day in-person CBDC Masterclass on October 12 in Washington DC. The sessions are designed as instructional deep dives with full presentations and Q&A components.  [Register here]

Kiffmeister’s #Fintech Daily Digest (20220804)

~ kiffmeister

A pair of hacks rattle an already jittery crypto industry

Solana said that at least 7,700 wallets that held at least $5.2 million crypto-assets, including Solana tokens and USDC stablecoins, had been breached. Earlier in the week, Nomad, a blockchain bridge, acknowledged that about $190 million had been taken from it after a hacker infiltrated its system. (A blockchain bridge allows users to swap crypto from one blockchain to another making it vulnerable to “both sides” weaknesses on either blockchain.) The Nomad attack was a “free-for-all,” because the hacker’s original code allowed anyone to copy it and steal the crypto for themselves. [Read more at the Washington Post]

Slope wallet provider saved user seed phrases in plain text, Solana security researchers find

Solana also said that the closed-source Slope wallet may be responsible for the exploit. And security firm Otter reported that the Slope wallet app sent out users’ seed phrases to a centralized server. Slope hired this server from a company called Sentry. It added that seed phrases passed to Slope’s server were saved in the form of readable text. Since the phrases were not encrypted, anybody with access to this specific Sentry server could potentially access users’ private keys. [Read more at The Block]

Coinbase selected by BlackRock to provide Aladdin clients access to crypto trading and custody via Coinbase Prime

Investment manager BlackRock has formed a partnership with Coinbase to make crypto-assets directly available to institutional investors. Mutual customers of Coinbase and BlackRock’s investment management platform. The access will be granted through Coinbase Prime, an existing integrated trading platform for institutional crypto investors. Aladdin users will be able allow to manage their crypto-asset exposures directly in their existing portfolio management and trading workflows for a whole portfolio view of risk across asset classes. The platform integration and functions will be rolled in phases. [Read more at Coinbase]

Entity-based vs activity-based regulation: a framework and applications to traditional financial firms and big techs

The Bank for International Settlements (BIS) published a paper that proposes a framework for classifying regulatory measures with a financial stability objective as activity-based (AB) or entity-based (EB). AB measures constrain an activity on a standalone basis, whereas EB measures constrain a combination of activities at the level of entities. Since such combinations underpin much of financial intermediation, financial stability regulation features EB measures at its core, even though its ultimate objective is to make financial activities more resilient. In discussing the relative merits of AB and EB measures, the paper applies its framework to the regulation of banks, collective investment vehicles and big techs. When addressing systemic risk, neither AB nor EB regulation need be consistent with a level playing field, contrary to a widely held view. [Read more at the BIS]

An Illustrative Industry Architecture to Mitigate Potential Fragmentation across Central Bank Digital Currency and Commercial Bank Money

A paper by a couple of Barclays staffers aims to provide a mitigation to the risk that the adoption of central bank digital currency (CBDC) fragments payments markets and retail deposits. It introduces the concept of ecosystems providing a common programmability layer that interfaces with the account systems at both commercial banks and the central bank. The paper focuses on a potential U.K. CBDC, including industry ecosystems interfacing with commercial banks using open banking application programming interfaces (APIs). [Read more at Arxiv.org)

Upcoming events I’m affiliated with:

The CBDC Think Tank, in partnership with the International Monetary Fund and George Washington University, is hosting a full-day in-person CBDC Masterclass on October 12 in Washington DC. The sessions are designed as instructional deep dives with full presentations and Q&A components.  [Register here]

Kiffmeister’s #Fintech Daily Digest (02/20/2022)*

~ kiffmeister

Wyoming Lawmakers Want State to Launch Its Own Stablecoin

Wyoming lawmakers have proposed the Wyoming Stable Token Act (SF0106), which paves the way for the crypto-friendly state to launch its own dollar-pegged token. The act would allow Wyoming treasurer Curtis Meier Jr. to create a state stablecoin pegged to the U.S. dollar. The token would be redeemable for a single dollar held in trust by the state. [Read more]

OpenSea Confirms Phishing Attack Affecting Multiple Users

OpenSea is investigating a phishing attack aimed at users of its non-fungible token (NFT) platform. The hacker(s) stole several NFTs and had already sold a few for ethereum worth $1.7 million, according to CEO Devin Finzer. NFTs are blockchain-based deeds of ownership to different kinds of digital items, from expensive illustrations of apes to collectibles like celebrity autographs. [Read more]

Canadian Court Freezes Millions in Convoy Protestor Funds—Including Bitcoin

An Ontario Superior Court judge has issued an order to freeze millions of dollars in funds, including crypto-assets, as Ottawa’s convoy protests continue. The freezing order—known as a Mareva injunction—was part of a wider lawsuit filed against the convoy by the residents of Ottawa. The Canadian government is involved in an ongoing effort to seize protestors’ funds. [Read more]

However, it is impossible to freeze crypto-asset address and render it useless to the owner. The only way to do that is by using force to ultimately obtaining a crypto owner’s private keys. This is why fundraisers, like Nunchuk, utilize multi-signature controls. Basically, people worried about getting their crypto funds frozen should not keep crypto on centralized platforms. [Read more]

Judge orders Terraform Labs to comply with SEC subpoenas

A judge in the Southern District of New York has granted a US Securities and Exchange Commission (SEC) application for an order requiring Terraform Labs to comply with investigative subpoenas. The SEC is investigating whether Terraform Labs had violated US securities laws with its Mirror Protocol, a platform which creates crypto-assets for users to buy and sell popular stocks. [Read more]

UAE Prepares to Launch Nationwide Crypto Licensing System

The United Arab Emirates Securities and Commodities Authority (SCA) is reportedly getting ready to start issuing federal licenses to cryptocurrency service providers in the first quarter. The SCA will regulate the crypto industry with input from the central bank, but local financial centers can establish their own daily procedures around licensing. [Read more]

* To get these updates sent to your inbox, please sign up here. Also, for those interested in intra-day updates and news that didn’t make the Daily Digest cut, please check out my Diigo fintech bookmarks: https://www.diigo.com/user/kiffmeister/Fintech.

Central Bank Digital Currency Workshop, Hosted by the CBDC Think Tank

In Q2 2022, the CBDCTT will launch the OpenCBDC Sandbox for evaluating, studying and learning from the OpenCBDC Boston Fed and the MIT Digital Currency Initiative open source CBDC platform. It will provide easy to use access, with the CBDCTT providing training and all updates. It’s available exclusively to central banks and official institutions. [Read more]