Black Hat Hacker

A black hat hacker is a person who gains unauthorised access to computer systems, networks or data with malicious or self-serving intent, such as stealing money or information, extorting victims or causing disruption. The term contrasts with white hat hackers, who test systems with permission to improve security, and grey hat hackers, who break in without permission but without clear criminal intent. The labels come from old Western films, in which villains wore black hats and heroes white ones.

Black hat activity is a major concern for banks, payment companies, crypto exchanges and decentralized finance protocols, all of which hold valuable assets and data. Black hats range from lone individuals to organised criminal groups and state-linked teams. Their activity falls under hacking and wider cybercrime, and it overlaps with phishing, fraud and money laundering when stolen funds have to be moved and cashed out.

Think of a building's locks and alarms. A locksmith hired by the owner to test them, and who reports every weakness, is like a white hat. A burglar who studies the same locks to break in and steal is like a black hat. Both may have similar skills; the difference is permission and purpose.

In the digital world, black hats look for unlocked doors in software, careless staff or reused passwords. Once inside, they may copy customer data, transfer money, install software that locks files until a ransom is paid, or quietly watch for a better opportunity.

Black hat hackers use a wide range of techniques, often in combination:

• Social engineering. Tricking people into revealing passwords or approving payments, as described in social engineering, is often easier than breaking technology.
• Malware. Viruses, spyware and remote-access tools steal credentials or keys; ransomware encrypts data and demands payment, often in cryptocurrency.
• Exploiting vulnerabilities. Unpatched software, misconfigured servers and coding errors provide entry points; in crypto, flaws in smart contracts are a frequent target, a topic covered under bug exploits.
• Credential attacks. Password guessing, credential stuffing with leaked passwords and brute force attacks target weak logins.
• Account takeover. Techniques such as SIM swapping let attackers intercept one-time codes and seize bank or exchange accounts.
• Denial of service. Flooding services with traffic, as in a DDoS attack, can be used for extortion or as cover for other attacks.

Banks and payment systems have long been targets. A notable case was the February 2016 theft from Bangladesh Bank's account at the Federal Reserve Bank of New York, in which attackers used compromised SWIFT credentials to send fraudulent payment instructions and stole about $81 million. Card data breaches at retailers have exposed millions of card numbers. In crypto, attacks on exchanges, bridges and DeFi protocols have caused some of the largest thefts in history, and investigators have attributed several major incidents, including the 2022 Ronin bridge hack and the February 2025 theft of about $1.5 billion from the Bybit exchange, to North Korean state-linked groups. These incidents are discussed further under crypto bridge risks. Stolen crypto is often passed through mixers, cross-chain swaps and networks of money mules before being cashed out.

The boundary between types of hacker depends on authorisation and intent. White hats work as penetration testers, security researchers and auditors, and many earn rewards through bug bounty programmes that pay for responsibly disclosed vulnerabilities. Grey hats may access systems without permission and then notify the owner, sometimes asking for payment, which can still be illegal. In crypto, some attackers have returned funds after negotiating a "bounty" with the affected protocol, blurring the lines; courts and prosecutors generally treat unauthorised exploitation as a crime regardless of later returns.

Unauthorised access to computers is a criminal offence in most countries, for example under the US Computer Fraud and Abuse Act and the UK Computer Misuse Act 1990. Stealing funds also brings fraud, theft and money laundering charges, and sanctions authorities have designated some hacker groups, making it illegal to deal with their wallets. Financial institutions defend themselves with layered controls: multi-factor authentication, network monitoring, staff training, patching, encryption, segregation of duties and incident response plans. Regulators increasingly set cyber resilience requirements, such as the European Union's Digital Operational Resilience Act, which applies from January 2025. Individuals can reduce their risk with unique passwords, app-based or hardware authentication, caution with links and attachments, and by keeping significant crypto holdings in a hardware wallet.