Linking blockchains together is a key part of the industry. But bridges are vulnerable to hackers and confusing for consumers.
Binance CEO Changpeng “CZ” Zhao sounded the alarm on a massive data leak of one billion Chinese residents that went up for sale on the dark web.
B.C. money laundering report calls for new law enforcement unit, provincial office
Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Cyber Security, Quantum, Hacks, Fraud Alerts, Risks, InsurTech
Crypto Bridges are Integral to Blockchain Adoption but Vulnerable to Attack
Protocol | Tomio Geron | Jul 18, 2022
Linking blockchains together is a key part of the industry. But bridges are vulnerable to hackers and confusing for consumers.
One of the challenges for the crypto industry is how many blockchains there are and how complex it is to move across them. This has led to the growth of bridges for people to send tokens across chains. But these bridging tools have come under attack by hackers, leading to major losses.
Many in the industry believe it’s inevitable that there will be multiple blockchains that develop, each emphasizing different strengths such as gaming, trading, NFTs, mobile or payments.
See: Why Blockchain analytics are catching Washington’s attention
Because crypto has become a multichain industry, bridges have become a key part of the infrastructure. Attacks on them can have “cascading effects” across chains, as Chainalysis researchers recently put it. Some of the largest DeFi hacks to date have involved bridges.
Hacking bridges
- There are two main kinds of hacks on bridges: code attacks, which exploit vulnerabilities in smart contracts, and attacks on the design of a network, often accomplished through social engineering.
- In one smart-contract-related incident, hackers exploited a security problem in the Wormhole bridge’s code to make off with $325 million. Wormhole bridges blockchains like Ethereum, Solana and Polygon, enabling people to deposit tokens from one chain and get the equivalent on a different chain.
- In the incident, a hacker minted 120,000 wrapped ether, or WETH, on the Solana blockchain without putting in the equivalent on the Ethereum side.
- The recent $100 million hack of Harmony’s Horizon Bridge was apparently the result of social engineering to obtain the required electronic signatures to authorize a transaction.
- In Axie Infinity’s Ronin bridge, a hacker took control of five of the nine validator nodes that handle transactions. Four of those five nodes were controlled by Axie developer Sky Mavis, a flaw in its design, Khurana said. Social engineering allowed hackers to take control of those four nodes: An Axie engineer applied for a fake job on LinkedIn and opened a fake job offer document that contained spyware. A fifth node was hacked through a third-party validator managed by the Axie DAO.
See: Bain Capital Launches Dedicated Crypto Team – Sights on DAO Services
Until bridging across different chains becomes easier, widespread crypto adoption will be hindered.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Binance CEO Raises Red Flag on Massive Chinese Data Leak
BeINCrypto | David Thomas and Kyle Baird | Jul 4, 2022
Binance CEO Changpeng “CZ” Zhao sounded the alarm on a massive data leak of one billion Chinese residents that went up for sale on the dark web.
- Twenty-three terabytes of data containing names, addresses, birthplaces, national IDs, phone numbers, and criminal case information was reportedly stolen from a police station database in Shanghai, China. The hacker offered the information on a dark web forum for ten bitcoins.
- CZ took to Twitter on July 3 to announce that Binance threat intelligence had discovered resident records for sale on the dark web, without mentioning the country. He attributed the data breach to a bug in a government agency’s software using an “Elasticsearch” algorithm. CZ explained that the compromised data had implications for Binance users since the data in question could be used to take over accounts. CZ added that Binance uses internal and outsourced threat detection.
- Elasticsearch is used to quickly search through massive data sets and return answers in milliseconds (and could include corporate or government entity, data from social media posts to emails to company spreadsheets).
- While this makes for easy access to a wealth of enterprise information, it becomes equally a tantalizing prospect for cyber bandits.
See:
Leaky Forms: Thousands of Popular Websites See What You Type—Before You Hit Submit
Crypto.com $34 million stolen in user account hack | Data Breach Lessons
Cybersecurity experts concerned with the size and sensitivity of data
- News of the hack sent jitters throughout the Chinese security industry, triggering speculation on how it could have happened. Shanghai police have not made public any official statement.
- Cybersecurity professionals that have weighed in are concerned due to the hack’s size and the sensitivity of the exposed information, including criminal activity details.
- According to the Wall Street Journal, some reporters downloaded the list and called phone numbers to check the validity of the information. Five parties verified criminal information only the police could access, while four confirmed their identity before hanging up.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
CFTC Alleges South African Commodity Pool Operator Ran a Fraudulent $1.7B Bitcoin Trading Scheme
CFTC | Release | Jun 30, 2022
Today, the Commodity Futures Trading Commission (CFTC) filed a civil enforcement action in the U.S. District Court for the Western District of Texas against Cornelius Johannes Steynberg of South Africa and Mirror Trading International Proprietary Limited (MTI), a South African company, alleging that they operated a fraudulent scheme to solicit, accept, and pool more than $1.7 billion to trade off-exchange, retail foreign currency (forex) on a leveraged, margined and/or financed basis.
Defendants engaged in an international fraudulent multilevel marketing scheme via various websites, in addition to social media, to solicit bitcoin from members of the public for participation in their pool.
At least 23,000 of the pool participants—most, if not all, of whom were not eligible contract participants—were from the United States.
See: Fraud Prevention Month: CSA encourages Canadians to ask questions before investing in crypto assets
Instead of trading forex as represented, Defendants misappropriated pool funds, misrepresented their trading and performance, provided fictitious account statements as well as created a fictitious broker at which trading purportedly took place, and in general operated the pool as a Ponzi scheme.
As a matter of fact, the little trading that Defendants did was unprofitable, and they misappropriated essentially all of the at least 29,421 bitcoin accepted from participants.
The CFTC’s complaint seeks full restitution on behalf of defrauded participants, as well as disgorgement, civil monetary penalties, permanent trading and registration bans, and other relief. Notably, this fraud represents the largest to date charged by the CFTC involving Bitcoin.
View the original release --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Small Businesses Incur Greatest Loss of Cyber Attacks | 67% Suffer Repeat Attacks Within 12 Months
CPO Magazine | Alicia Hope | Jun 23, 2022
Two-thirds of companies that suffered cyber attacks were hit again within a year, according to a global Cymulate Data Breaches Study. According to the report, 40% of the businesses were attacked within 12 months, with an average of 1.3 cyber attacks per year. However, 10% of the firms experienced ten or more incidents within a year.
Employees and connected partners are the main gateways for cyber attacks
- Most cyber attacks originated from end-user phishing (56%) and hacking third parties with corporate network access
- Direct cyber attacks on the enterprise network by threat actors accounted for 34% of incidents
- Insider threats were responsible for 29% of incidents
See: Lex Fridman Podcast with Brett Johnson: US Most Wanted Cybercriminal
Businesses responded differently after cyber attacks
- 39% handling everything internally, without hiring experts, public relations, or mandatory reporting
- 35% of the cases, the company responded by hiring security consultants
- 12% hired public relations consultants to protect their reputation
- 12% responded by dismissing their current security staff, while 4% dismissed the executives
According to the report, security teams needed to involve a legal, finance, or executive staff to deal with the aftermath of cyber attacks in 39% of the cases.
Multi-factor authentication remains the most preferred mitigation for cyber attacks
- The top types of incidents reported were malware (55%), followed by ransomware attacks (40%), and DDoS attacks (32%)
- Two-thirds (67%) of the respondents preferred multi-factor authentication (MFA) to mitigate cyber attacks, followed by proactive corporate phishing and awareness campaigns (53%), well-planned and practiced incident response plans (44%), and least privilege (43%).
See: 90% of IT Managed Service Providers Experienced a Successful Cyber-Attack (in the Past 18 months)
Small businesses incur more losses from cyber attacks
More than half (57%) of large businesses reported that disruptions after cyber attacks lasted for a short time, while 40% reported minor damage. In contrast, only 33% of small businesses reported short-lived disruptions and low-level damage (27%).
The larger the company, the more resources they are likely to have to recuperate
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Top Security Investments For Your Recently Funded Startup
Guest Post | Jul 1, 2022
Photo by: SOCIAL.CUT on Unsplash
3 out of 5 startups have fallen victim to a security breach in the last two years. If you have just received funding for your startup, you need to invest in security technologies to ensure your sensitive data and assets remain secure.
Which security technologies should a startup business invest in?
Keep reading as we go through the best security investments for your startup to secure your assets and help you improve productivity, and streamline your monthly overheads.
Top Security Investments For Your Startup
Let’s look at some of the best security investments for your startup. These technologies can help you to protect your data and ensure there are no setbacks for your newly founded business. Consider which tools would be most valuable in your security strategy.
Occupancy Management
Occupancy management software is an investment that can help you manage your business's health and safety and your space more effectively.
Occupancy management software integrates with your access control system to provide accurate data logs of the occupancy levels in your building. Since the pandemic began, overcrowding has become an occupational safety hazard. To maintain social distancing measures in your workplace, you should consider implementing occupancy management software.
Occupancy management software can help you understand your office space and may offer an opportunity to downsize your office space. Suppose you switched to a remote or hybrid work model. In that case, your occupancy management software will help you determine how many users are in your office at once and whether your company could potentially downsize to streamline monthly overheads and allocate more money toward the growth of your business.
Touchless & Keyless Access Control
Touchless access control is the foundation of any modern and sophisticated security. With touchless entry, you can reduce the number of touchpoints your employees must touch when entering the building and put health and safety first.
Keyless access control secures your building without inconveniencing your employees. The door locks operate using mobile access credentials. Opting for mobile-first access control can avoid extra expenses caused by keycard or fob replacement.
Users who wish to enter the building do not have to withdraw their mobile devices from their pockets. Instead, they can simply wave their hand in front of the access control reader. The wave of their hand will trigger remote communication with their mobile device that will open the door.
You can operate touchless access control remotely and view security data using a mobile application or cloud-based control center. This convenient security technology supports hybrid work models, where managers and system administrators will be off-site.
Modern, cloud-based access control systems have open API integrations, which can help you to build a fully-integrated security system that performs HR and administrative functions. Since access control is a cloud-based solution, it is best to invest in cybersecurity training and software to avoid falling victim to the rising rate of cyberattacks.
Smart Desk Management
Smart desk management software is a necessity for any hybrid startup. If your employees come into the office to access resources and collaborate on projects, they will need desk space. However, if your office is busy that day, they could drive to work only to find that all the desks are occupied.
Smart desk management software offers a solution to this problem. With this software, your employees can reserve desk space for when they need to use office resources. Employees will be able to view a digital floorplan of your office, with a clear picture of the desks that are reserved and the available desks. Your employees will also be able to see which employees book each desk so they can sit with their friends or in teams.
Visitor Management
Visitor management software integrates with access control to provide more accurate visitor logs. In the event of a security breach, you need to have detailed records of who is in your building to aid in an investigation.
Visitor management software implements digital surveys that your visitors, contractors, and interviewees must fill out before entering the building. Once they have filled in the form, they can enter the building using a temporary digital access key stored on their mobile device. The system will log them out with an accurate timestamp and revoke their access credentials when they leave.
Automated Wellness Verification
Automated wellness verification operates similarly to visitor management software. Your employees must fill out digital forms based on their symptoms to enter the building. This software helps you screen for coronavirus and prevent the spread of the virus in your office, which could lead to staffing difficulties.
Security Integration
When establishing security integrations in a cloud-based system, you must ensure that the information and remote operation capabilities are only accessible to authorized parties. If a third party intercepts this information, it could lead to a costly security breach for your business.So, ensure that you enlist the services of a commercial security system integrator with experience in the industry. Your integrator will be able to advise you on and install the best cybersecurity software and physical security tools to keep your business secure.
Photo by Tim van der Kuip on Unsplash
Summary
To ensure the success of your startup, you need to put security first. Failing to protect your assets and sensitive data could lead to the failure of your business. So, consider which security technologies would most benefit your business and plan your security strategy with integration in mind.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Code is Law Case: A Hamilton teen ‘hacked’ US$16 million in crypto (while he may not be in the wrong)
FP | Ethan Lou | Jun 15, 2022
On Oct. 14, 2021, a DeFi platform (everything is code) called Indexed Finance had a weakness in the code that a Hamilton teen and mathematics guru (he was already completing a master's degree in mathematics at Waterloo University), Andean Medjedovic manipulated into letting him buy coins at an extreme discount, whisking away crypto worth US$16 million, as he would later publicly admit.
The proponents behind Indexed Finance sued Medjedovic. So did some users of the platform who lost their money as a result, saying he had “hacked” the project.
But Medjedovic has said he never improperly accessed anything he wasn’t allowed to. Some software developers have a Code is Law ethos, and Medjedovic said he did only what the project’s publicly available rules allowed him to do.
The central tenet of DeFi is that humans are the weak points in any system. That thinking, though, forgets that code is a human product, and as such it inherits human weaknesses that can be exploited.
See: Alleged US$16 million crypto theft case to test ‘Code is law’ defence in Canada
Even Justice Fred Myers in the Toronto case has said the matter raises “an interesting, timely and important issue about the relationship between the common law and blockchain technology.” Benjamin Bathgate of McMillan LLP, acting for an unnamed Indexed Finance user or group of users, has said the case could be the first to test the issue of whether code truly is law.
But, for now, the case might never delve any deeper into that issue.
That is because Medjedovic has apparently packed up and ran instead of dealing with the civil lawsuit. Justice Myers has issued an order for his arrest, and the case is effectively stalled until Medjedovic is found.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Cullen Commission Money Laundering Report Estimates Billions Laundered in B.C. Every Year
Today In BC | Jane Skrypnek | Jun 15, 2022
B.C. money laundering report calls for new law enforcement unit, provincial office
B.C.’s long-awaited report into money laundering was released Wednesday (June 15), with 101 recommendations including the creation of a new law enforcement unit and permanent commissioner dedicated to addressing the estimated multi-billion dollar problem.
B.C. Supreme Court Justice Austin Cullen was commissioned to lead the inquiry in May 2019 after a series of reports to the government found “extraordinary” levels of money laundering in the real estate, casino, horse racing and luxury car sectors, fuelled in part by the illegal drug trade. In his final report, Cullen says human trafficking and fraud also feed into the problem.
Lack of action, prioritization allowed problem to thrive
The 1,800-page Cullen Final Report points to a lack of effective action from law enforcement, government and regulatory agencies as the reason for why money laundering has been allowed to grow for so long. It also aims blame at the federal agency responsible for receiving and analyzing information related to money laundering threats, FINTRAC, which the commissioner says has done a poor job of relaying information back to provinces.
See: Guide: How to spot potential money laundering
In 2019/2020, for example, FINTRAC received over 31 million reports, but only disclosed 2,057 to law enforcement agencies across Canada, and just 355 to B.C., the report says. As a result, reporting entities have begun “defensive reporting,” where they send in information to FINTRAC even if they are unsure of its value. This causes high-volume, low-value reporting, Cullen found.
To solve this, Cullen says B.C. law enforcement needs its own dedicated money laundering intelligence and investigations unit. At the legislative level, Cullen also recommends the government establishes an office for a permanent and independent Anti-Money Laundering Commissioner, who will provide strategic oversight on B.C.’s response.
“Because the damage it (money laundering) causes is not as visible as that caused by other crimes (such as violent crime) it is often afforded less priority and attention,” Cullen states in his report.
Continue to the full article --> here
Download the Full 1831 page PDF Cullen Commission Report --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
