Your crypto exchange may be less secure than your email account
NEW ORLEANS — Cryptocurrency exchanges and apps aren’t just among the most valuable targets for hackers, they also remain among the most vulnerable.
That’s the warning Chris Wysopal, chief technology officer at the security-tools firm Veracode, offered during a talk at the Collision conference here on May 1. It’s something that should be at the top of concerns for people looking to trade or invest in cryptocurrencies such as bitcoin, which are generated through increasingly complex mathematical “mining” and allow pseudonymous transactions online and across international borders — and have increased in value wildly, even after recent plunges.
“When we talk about cryptocurrency, we’re not talking about just stealing someone’s data that we then have to monetize,” he said. “We’re actually talking about stealing money. It’s a very, very attractive target for attackers.”
Mistakes were made
Wysopal recounted a series of embarrassing but preventable hacks of cryptocurrency exchanges and apps. A partial selection:
-
In 2016, a bug in the smart-contacts code meant to allow automatic execution of transactions at a network called the Distributed Autonomous Organization allowed a hacker to siphon out $50 million worth of the cryptocurrency Ethereum.
(Onstage, Wysopal said this happened in 2014; in an email Thursday, he said he mixed up that date with that of another cryptocurrency hack, the theft of some $460 million from the Mt. Gox exchange in 2014.) -
In August of 2016, the cryptocurrency exchange Bitfinex got hacked to the tune of $73 million. A key cause: That Hong Kong-based site kept all of its security keys online instead of putting one in offline “cold storage.”
-
In January, attackers broke into another exchange, Coincheck, and stole $534 million in cryptocurrency. Their work was eased by that Tokyo-based firm keeping all of its customers’ funds in a single “hot wallet.” Observed Wysopal: “That seems really, really dumb. This isn’t how banks work, right? They don’t have all the money in the tellers’ drawers all the time.”
-
In February, the Ukrainian hacking group Coinhoarder stole $50 million from users of the Blockchain.info digital wallet by running Google (GOOG, GOOGL) ads that conned victims into thinking they were logging into the real site. Since then, Google, Facebook (FB) and Twitter (TWTR) have banned cryptocurrency ads.
What you can do
Wysopal — who began his information-security career as one of the first members of the L0pht hacking collective and then co-founded Veracode, now owned by CA Technologies (CA), in 2006 — offered some specific tips to his audience.