Crypto exchanges continue to be hacked, and there is much no one can do

[ad_1]

It’s not just the lucky investors who get rich from crypto.

Hackers have taken billions of dollars in virtual assets over the past year by compromising some of the cryptocurrency exchanges that emerged during the bitcoin boom.

There have been over 20 hacks this year where a digital thief stole at least $ 10 million in digital currency from a crypto exchange or project. In at least six cases, hackers stole more than $ 100 million, according to data compiled by NBC News. By comparison, bank robberies earned perpetrators an average of less than $ 5,000 per heist last year, according to annual FBI crime statistics.

Despite the large sums associated with these thefts, they often lack the drama or attention of traditional bank heists. But cryptocurrency experts say they are offering a warning to potential crypto investors: Exchanges are now lucrative targets for hackers.

“If you hack into a Fortune 500 company today, you could steal usernames and passwords,” said Esteban Castaño, CEO and co-founder of TRM Labs, a company that creates tools for companies to track. digital assets. “If you hack a cryptocurrency exchange, you can have millions of dollars in cryptocurrency.”

Once an internet oddity that required a certain level of technological know-how to buy, cryptocurrencies have become a more common investment and speculation tool, prompting more than 300 companies to start in recent years to offer people a easy way to buy and sell. everything from bitcoin to more marginal “altcoins” such as dog-inspired dogecoin.

Crypto exchanges work like traditional currency exchanges, setting prices for various currencies and charging a small fee to allow users to trade one. But while a handful of countries have strict regulations in place, it’s relatively easy for tech entrepreneurs to set up an exchange almost anywhere in the world and run it however they see fit.

Cryptocurrencies generally offer a certain level of security, taking their name, in part, from “encryption.” But the exchanges that run them, especially new ones who are starting their businesses from scratch, often start with a small staff, which means few or no full-time cybersecurity professionals. Their developers can work frantically to make the code work, sometimes accidentally leaving loopholes that allow hackers to gain a foothold. Combined with the fact that a volatile market often suddenly leaves them a fortune, exchanges are an especially ripe target for hackers.

Exchanges often keep access to some of their cryptocurrencies in cold wallets, which live securely offline. The rest are in “hot wallets”, which are liquid and can be sent to users. This means that if a hacker can gain access to a particular employee account – a common Internet security hole – they can achieve a major heist, said Dave Jevans, founder of CipherTrace, a company that tracks theft and fraud. in cryptocurrencies.

“If you steal the private keys from a hot wallet, it’s not like stealing a database of people’s names and Social Security numbers,” Jevans said. “You just stole all their wholesale money. “

If an exchange is rich enough and plans in advance to have an emergency fund, it can compensate its clients if its operations are hacked, Jevans said. Otherwise, they often go bankrupt.

“Not all stock markets are that rich or have that much foresight. It’s just okay, pop, ‘We’re bankrupt. Sorry, you’re all fucked up,’ he said.

Recent cases

One of the biggest heists happened in early December, when crypto trading platform Bitmart announced that hackers broke into a corporate account and stole nearly $ 200 million. The company froze all customer transactions for three days before allowing them to exchange their money again.

The problem is exacerbated by the fact that many cryptocurrency projects, aimed at avoiding government regulations, are being implemented in countries whose law enforcement agencies do not have much power to tackle hackers. transnational IT. Or if they are hacked, they tend to be less likely to call on government help on ideological grounds, said Beth Bisbee, head of US investigations at Chainalysis, a company that tracks cryptocurrency transactions. for private companies and government agencies.

“The ecosystem, in general, wants to be anti-banking and anti-surveillance,” Bisbee said. “So when something like this happens, they don’t necessarily want to work with law enforcement, even though they would be seen as a victim and it would be helpful for them.”

Low profiles

While exchange hacks have some similarities to the bank robberies of old, they don’t leave behind the characteristics that once made headlines. Public scrutiny of these hacks may be lacking despite the large dollar sums. Most exchange hackers go unchecked, leaving little closure for consumers. And there is rarely any physical evidence or real-world sequelae: no traumatized bank tellers or criminal walks.

But some hacks have happy endings. In a strange public affair, a hacker stole $ 600 million from the Poly Network cryptocurrency platform. Instead of blaming the thief, the company decided to appeal to its best nature, calling it “Mr. White Hat,” which is a cybersecurity term for a researcher working to make things safer. Poly Network thanked them for exposing a flaw in their code and requested the refund. The hacker finally gave in and gave everything back.

But these cases are rare. Usually, when major law enforcement agencies tackle a major cryptocurrency hack, they try to follow every lead, an exhausting process that takes place much slower than the criminals they hunt.

Claire Georges, deputy spokesperson for Europol, the European Union’s international law enforcement agency, said the agency was aware of a number of cases against hackers who were stealing digital assets. But she said building a strong case is a long, slow process that doesn’t keep pace with attacks.

“We have a number of ongoing investigations as we speak,” said Georges. “They take a long time, because we would also like to eliminate the whole criminal network,” she said. “These cases often fuel other cases.”

“They could go on forever,” she said. “These investigations usually take a long time.”

[ad_2]