Cracking crypto crimes: How Vietnam’s technologists are tackling the industry’s worst hacks

[HO CHI MINH CITY] As he boarded a flight from Ho Chi Minh City to Dubai, Nguyen Le Thanh had already done what few could in the wake of the largest crypto heist in history: engineer a critical solution and devise response strategies before the plane’s wheels even left the ground.

Just a day earlier, Dubai-headquartered Bybit – the world’s second-largest crypto exchange by trading volume – fell victim to a massive cyberattack, in which North Korean hackers drained US$1.5 billion worth of digital assets from Bybit’s cold wallet, sending shockwaves through the industry.

Thanh, founder of Vietnam-based cybersecurity firm Verichains, was among the first responders. “Investigation is just one thing. The most challenging part for firms is how to deal with the aftermath of the security breach in the most effective way,” he told The Business Times.

Having been contacted by Bybit two hours after the incident occurred, Thanh and his team in Vietnam developed a new tool in the next four hours that could enable the crypto exchange to conduct multi-signature fund transfers from unaffected wallets to restore liquidity.

The system bypassed the crypto exchange’s previous transaction approval process, which used a third-party Web-based interface – one that Verichains had flagged as a security risk. That very weakness, as it turned out, was what the North Korean hackers had targeted.

Around the same time, Thanh also dispatched a set of response guidelines to help the firm minimise losses, maintain operations and preserve crucial evidence for the investigation ahead. He accomplished all of these tasks before boarding the seven-hour flight.

“Most firms are often stumped when facing security incidents,” he explained. “This checklist should be drawn up to ensure business continuity, even prior to determining the hack’s root cause, which may take weeks or months in some cases.”

Visa delays caused him to arrive a day later than two other teams – one from the US and one from Israel – which were called on to conduct independent investigations into the case.

Sitting down in person with Bybit’s in-house security team to identify and narrow down the possible attack vectors, he produced a 28-page preliminary report within 24 hours, unveiling the cause of the breach – well ahead of the others.

After working with Verichains’ engineers, Bybit chief executive Ben Zhou recognised the team as “the world’s foremost experts on cyberattacks”, based on his response to the Vietnamese online newspaper VnExpress.

Thanh noted that Verichains is deepening collaborations with Bybit to review its systems for asset storage and management. They are also developing a year-long plan to enhance the firm’s cybersecurity capabilities.

Founded in 2017, Verichains has provided cybersecurity solutions for more than 200 global clients, including Binance – the world’s largest crypto exchange, which suffered from a US$600 million attack in 2022. Verichains is backed by Vietnam’s home-grown tech unicorn VNG.

Blockchain technologist hub

The country has emerged as a haven for digital-asset enthusiasts and blockchain technologists around the world.

While the sector is still unregulated in Vietnam, more than 21 per cent of its population owned cryptocurrencies by 2023, indicated a report by payment platform Triple-A.

The country is ranked by US blockchain analysis firm Chainalysis as one of the top crypto markets in Asia, with the crypto transaction volume between July 2023 and June 2024 estimated at more than US$100 billion.

Some projects developed in Vietnam have made their mark globally, including Sky Mavis’ blockbuster blockchain game Axie Infinity and Kyber Network’s multi-chain crypto liquidity hub. At one point, these two joined the billion-dollar club by the market capitalisation of their projects’ digital tokens.

However, their popularity and high money value made them targets of the world’s most high-profile cyberattacks.

Sky Mavis faced a staggering loss of US$625 million in a bridge hack in 2022, while Kyber Network in late 2023 suffered from a US$54.7 million exploit deemed as one of the most sophisticated ever.

Both teams then faced challenges in reinforcing user trust after the events, as ill-founded rumours started spreading, undermining the credibility and reputation of these Vietnamese technologists. 

“(The) blockchain ecosystem in Vietnam is very inexperienced in handling such circumstances,” said Tran Huy Vu, Kyber Network co-founder and chief executive, in response to BT queries after the hacker was identified by a US court in February – more than a year after the theft.

In most cases, lost funds cannot be fully recovered, at least not for a foreseeable period of time.

As the Vietnamese crypto community has gone through various incidents, there are now stakeholders ready to lend their hands, such as Verichains and the Vietnam Blockchain Association (VBA). But the ecosystem is in need of more resources.

“In such cases, I wish we could have help from security firms, legal councils and coordinators,” Vu added. These players can assist Kyber in connecting tracking teams, exchanges and bridges to isolate the hacker and prevent the perpetrator from laundering the money.

National security matters

In light of a thriving local tech community, Vietnam is now determined to put the crypto sphere out of the grey area with a regulatory framework this May, and plans to pilot a crypto exchange and a sandbox for digital-asset trading.

The country’s top leader, To Lam, is endorsing the development of a national Layer-1 blockchain network, which aligns with Vietnam’s goal to form blockchain infrastructure outlined in a strategy issued last October. This network, to be developed by One Mount Group with an investment of US$200 million to US$500 million, is expected to enable the formation of various decentralised applications across multiple sectors, including finance, healthcare, education and public services.

The effort, however, has brought the security question into focus as a large amount of citizens’ data and assets could be exposed to cyber risks.

Analysing three hacks related to Bybit, Sky Mavis and Kyber Network, Dr Jeff Nijsse, senior lecturer in software engineering at RMIT University Vietnam, noted that while the attack vectors varied significantly, these breaches involved substantial amounts of cryptocurrency transactions that are traceable due to the transparency of public blockchains.

“This is a double-edged sword in the transparency of blockchains, because bad actors can see how the crypto is moving and where it is going and in what amounts,” he added.

Vietnam’s national Layer-1 blockchain will be fundamentally different. Unlike the public blockchain networks used by Bitcoin or Ethereum, it will operate as a permissioned network – restricting access to approved participants – and will not be tied to any cryptocurrency.

“It is likely to be developed as a non-crypto permissioned blockchain that is customised to serve the state’s unique requirements,” said Phan Duc Trung, VBA chairman. He likened it to Vietnam’s version of Hyperledger Fabric – a blockchain framework provided by US tech giant IBM that supports the development of various blockchain-based solutions and applications for business use.

Experts, however, questioned how Vietnam’s national blockchain can compete with those developed by global players, as well as achieve its stated goal of “interoperability across various blockchain networks”. They noted that ensuring both high security and consistency across different blockchains remains an extremely challenging task.

“Technology is not the foremost challenge,” Trung noted. “To guarantee the security of this infrastructure, Vietnam must first establish strong institutions along with a comprehensive regulatory framework (for virtual assets) to guide its operation.”