Analysis-Binance hack reveals crypto’s uphill battle against hackers - The Mighty 790 KFGO

The October 29 heist, described by experts as the largest cryptocurrency theft ever, unfolded in minutes after months of planning and preparation, according to Binance's initial investigation. The attack raises questions about how exchanges defend employees against sophisticated social engineering and whether they have adequate internal controls to limit what an attacker can do once an employee's computer or credentials are compromised.

Social engineering is a well-understood threat in the industry, but the bigger question is why exchanges do not have stronger internal safeguards and circuit breakers to prevent an attacker who breaches an engineer's computer from escalating access and moving assets, said Jonathan Alexander, chief technology officer of S&P Global's OpenZeppelin.

Industry-wide vulnerabilities

Varying cybersecurity practices across the industry compound the problem, Alexander said, along with a longstanding aversion among some cryptocurrency advocates to controls they view as inconsistent with blockchain's decentralized ethos. This has led some to believe that security measures like circuit breakers would conflict with privacy rights.

The Binance attack is the latest in a string of major cryptocurrency hacks that have resulted in more than $22.3 billion in stolen funds since 2021, according to blockchain intelligence firm Chainalysis. The scale of losses has intensified debate over whether exchanges need more consistent standards governing access, transaction controls and other defenses.

Attractive targets

Cryptocurrency exchanges present unusually attractive targets because hackers can identify wallets holding enormous sums of readily transferable digital assets and, in some cases, the employees with access to the systems controlling them. This has made engineers and IT workers prime targets for elaborate social-engineering operations.

Alex Pruden, CEO of blockchain and digital-asset security firm Project Eleven, said defenders face a fundamental disadvantage against attackers who need to succeed only once.

Pruden expects the Binance theft to spur greater investment in cybersecurity, including safeguards around internal AI tools and agents that could themselves expand an attacker's capabilities if compromised.

Regulatory patchwork

The uneven security practices identified by experts are mirrored by a fragmented US regulatory system. Unlike banks, US cryptocurrency exchanges do not operate under a single federal cybersecurity regime. Instead, requirements vary depending on where companies operate and which state licenses they hold.

New York imposes some of the industry's toughest requirements, including mandatory cybersecurity programs, multi-factor authentication, and a designated chief information security officer. Elsewhere, crypto companies may be subject primarily to state money-transmitter rules that generally require companies to provide information about their cybersecurity programs but often do not prescribe particular technical controls.

Banks, by contrast, are subject to federal requirements covering areas including risk assessments, monitoring and incident response, while the largest institutions undergo continuing examinations by dedicated supervisors. Cryptocurrency exchanges have already begun moving to bolster defenses and increase information sharing following the Binance hack.