Investigating Web3 With OSINT

Investigating Web3 With OSINT

Speakers: Dhia Mahjoub, Independent Researcher, Independent

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=vOqa-CxINDM

Overview

In his HITB Amsterdam talk, "Investigating Web3 With OSINT," independent researcher Dhia Mahjoub offers a comprehensive exploration of the Web3 ecosystem through the lens of open-source intelligence. Mahjoub navigates the complex landscape of blockchain technology, decentralized applications (DApps), and the burgeoning ownership economy, demonstrating how readily available public data can illuminate both its foundational architecture and its inherent security vulnerabilities. The presentation serves as a critical guide for security professionals, developers, and enthusiasts seeking to understand the often-opaque world of Web3, moving beyond speculative narratives to a data-driven analysis of its operational realities and risks.

The talk comes at a pivotal time for Web3, following a turbulent period marked by high-profile collapses such as Terra Luna, FTX, Celsius, and Three Arrows Capital, which collectively exposed significant mismanagement and criminal behavior. Despite these setbacks and a 70% drop in crypto valuations, Mahjoub highlights a paradox: sustained interest from institutional investors, mega-brands entering the NFT space, and a 5% increase in active Web3 developers. This resilience underscores a philosophical commitment to building value with decentralized technologies, even as the industry grapples with its growing pains. Mahjoub's work provides essential tools and methodologies to investigate this evolving domain, fostering a more mindful approach to its security challenges and best practices.

By leveraging common OSINT tools like Google, Etherscan, DappRadar, and DefiLlama, Mahjoub systematically deconstructs the Web3 stack, identifies key investment trends, and analyzes prevalent attack vectors. He illustrates how apparent decentralization can mask critical points of centralization, dissects the mechanics of smart contracts and cross-chain bridges, and presents a Web3-adapted cyber kill chain. Ultimately, the talk aims to empower attendees to better understand the technology, identify patterns of risk, and contribute to building a more secure and resilient decentralized future.

Background

▶ Watch: Introduction to Web3 OSINT and recent challenges (0:00)

The journey from Web1 to Web3 represents a fundamental shift in how users interact with the internet. Web1, the "information platform," was characterized by static websites and search engines. Web2 ushered in the era of "read-write" social media platforms, emphasizing interactivity and user-generated content, albeit under the control of centralized entities. Web3, or the ownership economy, promises to return control to users by enabling fully decentralized applications (DApps). Its core tenets include user ownership of data and content, self-sovereign identity, native payments, and permissionless, trustless infrastructures where anyone can participate and contribute value.

Technically, Web3 is built upon a stack of protocols. At its base are Layer 1 blockchains like Bitcoin, Ethereum, Solana, and Avalanche, serving as the fundamental data structures. On top of these, primitives offer core services such as storage, compute, communication, identity, and security. These enable the development of more complex decentralized finance (DeFi) building blocks—borrowing, buying, selling, staking, and insurance—and analytics tools. Applications (DApps) currently revolve around entertainment (NFTs, gaming, streaming, social networks) and DeFi. User interaction is facilitated by wallets (for identity and transaction signing) and node providers (to communicate with the blockchain).

Investment trends, as revealed by OSINT from venture capital firms like Andreessen Horowitz (a16z) and Coinbase Ventures, highlight a strategic focus on foundational infrastructure. A16z, for example, has heavily invested in scalable Layer 1s like Aptos, Linera, and Mysten Labs (Sui)—projects often originating from Facebook's Libra initiative. Both a16z and Coinbase Ventures also show significant interest in gaming, NFTs, metaverse, and DeFi. CB Insights' quarterly reports further corroborate these trends, indicating that over 50% of recent large fundraises (>$60 million) went to Layer 1 projects aimed at solving the blockchain trilemma—the inherent tension between decentralization, security, and scalability. Early blockchains like Bitcoin and Ethereum prioritized decentralization and security but struggled with scalability. Newer Layer 1s often make trade-offs, sacrificing some decentralization for increased throughput and scalability. The maturation of developer tools is also seen as crucial for broader Web2 developer adoption.

Ethereum, as a leading blockchain, exemplifies this architecture. It operates as a public, append-only, decentralized data structure with a global state machine replicated across all participating nodes. Transactions trigger state changes, enforced by a consensus layer. Initially Proof of Work (PoW), Ethereum successfully transitioned to Proof of Stake (PoS), altering how network security and validation are achieved. The network layer handles node discovery and information propagation, while the data layer comprises blocks containing transactions. The application layer features the Ethereum Virtual Machine (EVM), which executes smart contracts—self-executing agreements whose terms are directly written into code. Understanding this foundational context is essential for analyzing the security landscape of Web3.

Key Findings

▶ Watch: Ethereum's surprising centralization risk with hosting providers (11:30)

Mahjoub's investigation using OSINT tools uncovers several critical findings regarding the current state of Web3, challenging some of its core tenets and revealing significant vulnerabilities.

Firstly, a major finding is the surprising degree of centralization within supposedly decentralized networks. By examining Etherscan's node tracker, Mahjoub reveals that over 50% of Ethereum nodes are hosted on just two cloud providers: Hetzner and Amazon Web Services. This concentration raises serious questions about Ethereum's true decentralization, a concern highlighted by past controversies where Hetzner threatened to shut down nodes, impacting networks like Solana, which lost 1,000 validators. While Ethereum's distribution is better than some (e.g., Binance Smart Chain with only 29 validators), the reliance on a few centralized hosting providers creates a single point of failure and potential censorship risk, directly contradicting Web3's promise of autonomy.

Secondly, the talk elucidates that Web3 attacks often leverage traditional Web2 attack vectors alongside novel smart contract vulnerabilities. The Ronin Bridge hack, where over $626 million was stolen, serves as a prime example. This massive exploit wasn't due to a flaw in the blockchain itself, but rather a private key compromise facilitated by social engineering, allowing attackers to control 5 out of 9 validators. This pattern is echoed in numerous other incidents, where phishing and social engineering lead victims to surrender their keys. However, Mahjoub also details Web3-specific vulnerabilities, categorizing them into code exploits (e.g., re-entrancy, overflow/underflow in smart contracts) and economic exploits (flaws in incentive mechanisms or governance design, like the Beanstalk governance attack). This dual nature of attacks underscores the need for a holistic security approach that addresses both human and technological weaknesses.

Thirdly, Mahjoub demonstrates the power of OSINT tools in providing transparency and actionable intelligence within the Web3 space. Tools like Etherscan allow for detailed tracking of Ether holders, beacon chain depositors, and token/NFT distributions. DappRadar and Cryptoslam provide insights into DApp activity and NFT market trends. DefiLlama acts as a crucial dashboard for tracking hacks, classifying them by type (infrastructure, protocol logic, ecosystem) and technique (private key compromise, access control exploits). Breadcrumbs.app is highlighted as an effective tool for tracing stolen funds across decentralized and centralized exchanges, offering forensic capabilities. Dune Analytics transforms raw blockchain data into queryable SQL databases, enabling deep analytical insights into network activity, such as the 17 million blocks and 1.9 billion transactions on Ethereum. These tools collectively empower researchers and defenders to monitor, analyze, and respond to threats in real-time.

Finally, the presentation reveals a pervasive scamming technique involving NFT spamming. Scammers exploit the public nature of blockchain wallets by minting fake NFTs (e.g., replicas of Bored Ape Yacht Club) and sending them to the wallets of high-profile celebrities and influencers (e.g., Snoop Dogg, Mark Cuban, Justin Bieber). This creates a false impression on NFT marketplaces like OpenSea that these fake collections are popular and owned by notable figures. Naive traders, seeing these "endorsements," are then lured into buying these valueless NFTs, only for the scammers to dump their holdings and cash out, leaving victims with significant losses. This highlights how social engineering and manipulation of public data can be weaponized in the Web3 context, emphasizing the need for user education and vigilance.

Technical Deep Dive

▶ Watch: Deep dive into the $626M Ronin Bridge hack (29:30)

Dhia Mahjoub meticulously dissects the technical underpinnings of Web3, focusing heavily on Ethereum as a primary example, and elaborates on its components, transaction mechanisms, and prevalent attack vectors.

At its core, Ethereum is presented as a public, append-only, decentralized data structure—a chain of blocks, each linked to the previous one. Within this structure resides a global state machine, replicated across every node participating in the network. Transactions committed to the blockchain trigger changes in this state. The network layer facilitates node discovery and information propagation, while the consensus layer (now Proof of Stake after the Merge) ensures agreement among distrusting parties. The data layer comprises the blocks themselves, containing transactions, and the application layer leverages the Ethereum Virtual Machine (EVM) to execute smart contracts.

The concept of accounts is fundamental:

• Externally Owned Accounts (EOAs): Controlled by a private key, typically held by a person. EOAs can send transactions (e.g., Ether transfers, smart contract calls) but do not contain executable code.
• Contract Accounts: These are smart contracts, possessing both storage and executable code. They execute business logic on the EVM. Transactions can be sent to contract accounts to invoke their functions.

Mahjoub introduces ERC-4337, or Account Abstraction, as a significant development aiming to address EOA flaws, particularly the risk of losing funds if private keys are compromised. ERC-4337 enables users to have smart contract wallets with enhanced security features, including account recovery mechanisms, which are not possible with traditional EOAs.

Transactions are the lifeblood of Ethereum, with six possible interactions:

1. EOA to EOA: Simple Ether transfer.
2. EOA creating a smart contract: Deploying bytecode to the blockchain, with the to field often pointing to a null address initially, then becoming the contract's address.
3. EOA invoking a smart contract function: Calling specific logic within a deployed contract.
4. Smart contract calling another smart contract: Internal transaction, often for modularity or helper functions.
5. Smart contract transferring Ether to another smart contract: Internal transaction, following predefined business logic.
6. Smart contract transferring Ether to an EOA: For instance, a payment contract distributing salaries.

Key transaction fields include nonce (a counter to prevent replay attacks), gas price and gas limit (to manage execution cost and prevent infinite loops/DDoS), to (destination address), value (amount of Ether), and init or data (bytecode for contract creation or function call data). The transaction lifecycle involves submission to the mempool, selection by a validator, inclusion in a block, and eventual addition to the blockchain.

The EVM is critical for executing smart contract code, using gas as a computational fuel to ensure finite execution and resource allocation. Ethereum's transition to Proof of Stake (PoS) replaced miners with validators, who must stake 32 ETH into a deposit contract to participate in securing the network. Mahjoub highlights Etherscan's utility in identifying top depositors, revealing that staking pools and exchanges hold significant amounts of staked ETH, further demonstrating potential centralization.

The data model of the blockchain can be transformed for analysis. While running a full node grants full read/write access, services like Infura or Alchemy provide node-as-a-service. More advanced analytics tools like Dune Analytics convert raw blockchain data (blocks, transactions, contracts) into a SQL database format, allowing users to run complex queries and create dashboards. Mahjoub demonstrates querying for total blocks (17 million), transactions (1.9 billion), logs (2.7 billion), and traces (6 billion) on Ethereum.

Tokens are standardized digital assets on Ethereum:

• ERC-20: The standard for fungible tokens, where each unit is interchangeable (e.g., USDT, USDC). Key functions include totalSupply(), balanceOf(owner), allowance(owner, spender), and transfer().
• ERC-721: The standard for Non-Fungible Tokens (NFTs), where each unit is unique and non-interchangeable (e.g., Bored Ape Yacht Club, CryptoPunks). Functions include ownerOf(tokenId) and balanceOf(owner). Etherscan and DappRadar are useful for tracking top tokens and NFT collections.

Cross-chain bridges are vital for interoperability in a multi-chain world. They are smart contracts enabling asset (tokens, NFTs) and information transfer between different blockchains, addressing issues like high gas fees or slow throughput on certain chains. Common bridge types include lock-and-mint (assets locked on one chain, equivalent minted on another), burn-and-mint (assets destroyed on one, created on another), and atomic swaps (direct exchange without locking/burning). The Ronin Bridge hack (2022, $626 million stolen) serves as a stark example of bridge vulnerability, where attackers compromised 5 of 9 validators through social engineering to authorize fraudulent transactions.

Mahjoub presents a detailed taxonomy of Web3 attacks:

1. High-level classification:

• Compromised private keys: As seen in Ronin, leading to fraudulent fund transfers.
• Phishing and social engineering: Traditional Web2 attacks causing victims to surrender keys.
• Smart contract vulnerabilities: Flaws inherent to the Web3 ecosystem.

1. Smart contract vulnerability breakdown:

• Code exploits: Bugs in implementation (e.g., re-entrancy, integer overflow/underflow).
• Economic exploits: Flaws in the protocol's design or incentive mechanisms (e.g., flash loan attacks, governance manipulation).

1. Specific attack types:

• Governance attacks: (e.g., Beanstalk, where an attacker gained voting power to drain funds).
• Supply chain vulnerabilities: Exploiting flaws in third-party libraries or providers.
• Oracle attacks: Manipulating off-chain data feeds (e.g., price information) used by smart contracts, leading to fraudulent trades.

Finally, Mahjoub adapts the Cyber Kill Chain for Web3:

1. Funding: Attackers first fund their wallets to pay for gas fees of malicious transactions.
2. Preparation: Crafting malicious smart contracts for code exploits or preparing phishing campaigns for social engineering.
3. Exploitation: Compromising the victim (e.g., stealing private keys, executing malicious code) to authorize fraudulent transactions.
4. Laundering: Moving stolen funds through centralized exchanges (historically Binance, Kraken, Coinbase, now with stricter AML/KYC) or decentralized mixers like Tornado Cash (now sanctioned).

This deep dive underscores the complex interplay of cryptographic security, software engineering, economic incentives, and human factors that define Web3 security.

Demo / Proof of Concept

▶ Watch: Categorizing Web3 attacks: private keys, code, economics (34:50)

While the talk did not feature a live, interactive exploit demonstration, Dhia Mahjoub effectively demonstrated the power and practical application of Open Source Intelligence (OSINT) methodologies and tools for investigating Web3. He systematically walked through how various publicly available resources can be leveraged to gain deep insights into the Web3 ecosystem, acting as a "proof of concept" for the OSINT approach itself.

Mahjoub showcased specific tools and their utility:

• Etherscan: This blockchain explorer was repeatedly highlighted as a primary OSINT tool. He demonstrated how to use its node tracker to identify the alarming centralization of Ethereum nodes on hosting providers like Hetzner and Amazon. He also used Etherscan to view the top ETH accounts, top depositors in the beacon PoS contract, and track the distribution of top ERC-20 tokens (e.g., USDT, USDC) and ERC-721 NFTs (e.g., Bored Ape Yacht Club).
• DappRadar and Cryptoslam: These dashboards were shown to reveal active DApps, trading volumes, and top NFT collections, providing market and usage insights for traders and hobbyists.
• CB Insights: Mahjoub referenced their "State of the Blockchain" reports to illustrate investment trends, particularly the significant capital flowing into Layer 1 solutions, gaming, and security startups, offering a macro-level view of industry development.
• Dune Analytics: This powerful platform was demonstrated as a way to transform raw blockchain data into queryable SQL databases. Mahjoub showed how to run queries to extract aggregate statistics like the total number of blocks, transactions, logs, and traces on Ethereum, illustrating its analytical capabilities for understanding network activity.
• DefiLlama and Direct.news: These platforms were presented as crucial resources for tracking Web3 hacks. DefiLlama, in particular, was used to sort hacks by amount lost, classify them by attack type (infrastructure, protocol logic, ecosystem), and identify specific techniques (e.g., private key compromise via social engineering in the Ronin hack). Direct.news was noted for its leaderboard of recent hacks.
• Breadcrumbs.app: In the context of the Ronin Bridge hack, Mahjoub used Breadcrumbs.app to visually trace the movement of stolen funds from the attacker's initial address across various decentralized and centralized exchanges, demonstrating its utility in blockchain forensics and money laundering investigations.

Through these demonstrations, Mahjoub illustrated how a combination of blockchain explorers, analytics platforms, market trackers, and forensic tools provides a robust framework for understanding the Web3 landscape. This OSINT methodology allows researchers to uncover vulnerabilities, track malicious activity, analyze investment patterns, and gain a comprehensive view of this rapidly evolving technological frontier without needing privileged access.

Defensive Implications

▶ Watch: Future Web3 challenges and useful OSINT resources (44:45)

Dhia Mahjoub's detailed analysis of Web3 attacks and vulnerabilities naturally leads to a robust discussion of defensive strategies, which he categorizes into pre-deployment prevention and post-deployment detection and response. The overarching message is that Web3 security requires a multi-layered approach, combining established Web2 best practices with Web3-specific considerations.

Pre-Deployment (Prevention): The focus here is on proactive measures to build secure Web3 projects from the ground up:

• Secure Software Development Life Cycle (SDLC): Integrating security practices throughout the development process is paramount.
• Threat Modeling: Developers must thoroughly understand their project's attack surface, identify potential attackers, and assess their capabilities and motivations.
• Code Audits: This includes both internal code and external libraries. Smart contract audits by reputable third parties are critical to identify vulnerabilities like re-entrancy or overflow/underflow exploits before deployment.
• Supply Chain Audits: Given the reliance on external libraries and service providers, ensuring the security of the entire supply chain is essential. A vulnerability in a dependency can compromise the entire system.
• Testing and Attack Simulation: Implementing comprehensive testing, including fuzzing, unit tests, and integration tests, alongside red teaming and blue teaming exercises, helps validate the resilience of the infrastructure and smart contracts.
• Policy Enforcement:
• Identity Verification and Access Control: Strict controls should be in place to ensure only authorized individuals can access keys, modify code, or interact with critical smart contracts.
• Asset Segregation: Emulating the practices of major centralized exchanges, Web3 protocols should store the vast majority of funds in cold storage (offline wallets) and only keep a small portion in hot wallets (online) for operational liquidity. This significantly mitigates the impact of a hot wallet compromise.

Post-Deployment (Detection & Response): Once a Web3 project is live, continuous monitoring and rapid response capabilities are crucial:

• Transaction Monitoring and Reputation Scoring: Real-time monitoring of transactions for suspicious patterns or malicious actions. Reputation scores can flag potentially risky wallets or contracts.
• Front-Running Exploits (White Hat Hacking): In some cases, white hat hackers can detect an impending exploit and submit a transaction with a higher gas fee to "front-run" the attacker. This allows them to drain funds from the vulnerable contract into a secure white hat-controlled account, preventing the attacker from profiting, and then returning the funds to the legitimate owner.
• Automatic Pause Mechanisms: Smart contracts should ideally incorporate emergency pause functions that can temporarily halt operations in response to detected exploits, allowing time for investigation and remediation.
• Tracing and Forensics: If an attack occurs, robust Digital Forensics and Incident Response (DFIR) capabilities are needed to trace stolen funds (e.g., using Breadcrumbs.app), understand the attack vector, and learn from mistakes to improve future security.
• Cyber Insurance: While reactive, cyber insurance can help mitigate financial losses in the event of a successful attack.

Mahjoub also highlights the collective efforts within the Web3 security community. A thriving ecosystem of companies and tools focuses on smart contract auditing, protocol logic security, wallet security, security testing, bug bounties, and formal verification. Furthermore, blockchain forensics and threat intelligence firms play a vital role, often collaborating with government entities for Anti-Money Laundering (AML), Know Your Customer (KYC), and Counter-Financing of Terrorism (CFT) efforts. This indicates a growing recognition that security must be a shared responsibility across the entire Web3 landscape.

Key Takeaways

• OSINT is a Powerful Web3 Security Tool: Publicly available information and tools (Etherscan, DefiLlama, Dune Analytics, Breadcrumbs.app) are invaluable for understanding Web3 architecture, identifying vulnerabilities, tracking funds, and analyzing attack patterns.
• Centralization Risks Persist: Despite the promise of decentralization, significant portions of Web3 infrastructure (e.g., Ethereum nodes on cloud providers) exhibit centralization, creating single points of failure and potential censorship vectors.
• Hybrid Attack Vectors: Web3 attacks frequently combine traditional Web2 social engineering and private key compromises with Web3-specific smart contract code and economic exploits, demanding a comprehensive security approach.
• Cross-Chain Bridges are Critical but Vulnerable Infrastructure: Bridges are essential for interoperability but represent high-value targets, as demonstrated by the Ronin Bridge hack, underscoring the need for extreme security measures.
• Proactive and Reactive Security are Imperative: A robust defense strategy requires secure development practices (audits, threat modeling, asset segregation) combined with continuous monitoring, rapid response capabilities (front-running, pausing), and thorough forensics.
• Web3 Needs Maturity for Broader Adoption: To fulfill its promise, the ecosystem requires better scalability, enhanced user experience, a focus on solving real-world problems beyond entertainment, and more mature developer tools to attract wider participation.

About the Speaker(s)

Dhia Mahjoub is an independent researcher specializing in blockchain and security. With a distinguished career in cybersecurity research, he previously led the research team at Cisco Umbrella and served as the first senior researcher at OpenDNS before its acquisition by Cisco. Mahjoub is a prominent figure in the security conference circuit, having shared his extensive work and insights at prestigious events such as Black Hat, Defcon, and Hack in the Box. His current focus is on understanding and dissecting the security landscape of the evolving Web3 and blockchain ecosystems.