How Did the Adversaries Abusing the Bitcoin Blockchain Evade Our Takeover?
summary
Malware encodes CNC IPs into Bitcoin payments using two satoshi-coded transactions (amounts translate to IP octets), and clients poll specific wallets; miners and fees make ordering fragile so adversaries try fee-order and time-lag strategies to force correct decoding. Researchers inject transactions to their rendezvous wallets, perform three takeovers, identify 275 infections, and estimate ~$2M in theft prevented; adversaries then switch signaling to the sending address to evade control and ultimately suspend operations after costs rise fivefold.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:58Three Main Angles for Today's Mitigation
- 5:55Three Main Angles for Yesterday's Mitigation
- 10:37Avoiding High Transaction Fees
- 12:16Experimenting with Transactions
- 20:15How Did the Adversaries Evade our Takeover?
- 22:56Concluding Remarks and Takeaways
related talks
12mThe anatomy of a malware attack: Past, present and future
18mBehind enemy lines
12mWinning the fight, losing the war
15mThe Bitcoin Protocol - Stuck in Time Forever?
47mThe Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud
43mBackground Story of "Operation neutralizing banking malware"
28mThe Coldcard Exploit What Happened & Why Bitcoin is Stronger Than Ever
43mBreaking Bitcoin Privacy