Report: Cybercriminals Stole NFTs Worth Over $100M, With 52% Processed Through Tornado Cash

According to a recent study from the blockchain security and analytics firm Elliptic, cybercriminals stole more than $100 million worth of non-fungible tokens (NFTs) between July 2021 and July 2022. 

The report revealed that the malicious actors received approximately $300,000 for each crime. 

More than 4,600 NFTs were Stolen In July 2022

The study, aimed at understanding the prevalence of money laundering, terrorist financing, and other market manipulation, scams, and sanction risks, found that these financial crimes represent a small proportion of the NFT’s trading activities. 

The blockchain analytics firm found that around 4,600 digital artworks were stolen in July 2022, making it the highest month on record, which shows that scams remain rife despite the current market meltdown. 

In May, the industry saw an explosion of confirmed NFT thefts through scams and other dubious methods amounting to $24 million. The data analytics company further noted the actual number of cons could be higher as thefts are not usually reported publicly.

Social Media Scams on the Rise 

The Elliptic data revealed that crimes on social media platforms, especially NFT project Discord servers, have exponentially increased over the years, accounting for 23% of the total NFT scams. 

According to the report, nearly 5000 NFTs worth about $20 million were stolen from the platforms this year. The company noted that the growing availability of tailored malware designed to override multiple security protocols, including Authentication, could be blamed for the increasing growth of scams on social platforms.

The blockchain analytics firm also found growing threats to NFT-focused services from sanctioned entities and state-sponsored exploits. For instance, such threats have been emphasized by the Axie Infinity’s Ronin Network Bridge exploit masterminded by the infamous South Korean hackers known as the Lazarus Group.  

The possession of NFTs by the U.S.-sanctioned Chatex is another scenario of impending threats.  

The analytics firm noted that virtual assets worth over $160,000 originating from sanctioned entities had been used to purchase NFTs. 

Sanctioned Tornado Cash and NFTs Scam

According to the report, the now blocklisted crypto mixer, Tornado Cash, was the source of $137.6 million of crypto assets processed by NFT marketplaces.  Additionally, the tumbler was the favorite choice of many scammers as their go-to laundering tool to process their scam proceeds.

The company noted that Tornado Cash processed 52% of NFT scams before it was sanctioned by the Department of the Treasury Office of Foreign Assets Control (“OFAC”) earlier this month. 

Elliptic also noted that its continuous use by criminals engaging with NFT calls for effective sanction screening by NFT platforms.