A securely vetted cryptocurrency firm appears to have scammed customers out of millions after its developers made off with their deposited funds.

Arbix Finance was a yield farming firm previously audited by decentralized finance (DeFi) security player CertiK.

However, earlier this week, CertiK tweeted news that it had performed a classic “rug pull” scam. Also known as “exit scams,” these involve project developers running off with investor funds.

The security firm explained that those in charge of the depositor contract at Arbix directed $10m of investor funds to unverified “pools” – a tool used to deposit and withdraw funds in DeFi ecosystems.

An unknown hacker then drained the assets from these pools and converted them to Ethereum through exchange AnySwap USDT.

“The exploited contract was not in the audit scope that was done for Arbix,” CertiK explained. “The project inserted eight `mint()` functions to a newly deployed ARBX ERC20 contract which allowed the owner to mint any amount of ARBX tokens to any address.”

The fact that Arbix Finance was previously certified highlights the difficulty investors face in the world of DeFi.

However, rug pulls are increasingly common. According to one report, over a third (37%) of the revenue generated from cryptocurrency fraud in 2021 came from such scams, versus just 1% the previous year.

This generated more than $2.8bn for fraudsters in 2021.

“Rug pulls are prevalent in DeFi because with the right technical know-how, it’s cheap and easy to create new tokens on the Ethereum blockchain or others and get them listed on decentralized exchanges (DEXes) without a code audit,” explained Chainalysis.

Yield farming is a particularly attractive prospect for investors, and a valuable lure for fraudsters, because it offers the promise of generating “interest” on cryptocurrency in a similar way to the annual percentage yields banks offer depositors of fiat currency.

Credential stuffers have compromised over a million customer accounts linked to 17 well-known companies, New York’s attorney general has confirmed.

Letitia James yesterday announced the results of a “sweeping” investigation into the practice, in which hackers use automated software to try breached log-ins across multiple accounts simultaneously to see if any fit.

Once inside the accounts, they look for personal and financial information to steal and/or try to buy goods with saved cards fraudulently.

As James said in her notice, the practice is made possible because many people use the same passwords across multiple online accounts.

New York’s Office of the Attorney General (OAG) has alerted the relevant companies so they can reset passwords and notify affected customers, claiming most of the malicious activity had not been detected.

It also released a guide outlining how organizations can detect, defend against and respond to credential stuffing attacks and prevent any follow-on fraud.

Bot detection services were recommended as an effective way to spot and block such attacks, as threat actors typically use these automated applications.

The OAG also urged firms to offer customers multi-factor and passwordless authentication options to foil their attackers. This means that hackers cannot access accounts even if they obtain a password.

Cyber-criminals ramped up their credential stuffing activity during the pandemic. Akamai detected 193 billion such attempts globally in 2020, including a 45% increase in attacks on the financial sector.

However, the retail, hospitality and travel sectors are most frequently hit.

In 2020, the same vendor released research claiming that 60% of attacks detected over the previous two years were aimed at these verticals, with retail accounting for over 90% of the total.

That’s because these accounts often have saved store cards which can be used in follow-on fraud and can be poorly protected compared to, say, online bank accounts.