Binance hack reveals crypto's uphill battle against hackers - The Express Tribune

The October 29 heist, described by experts as the largest cryptocurrency theft ever, unfolded in minutes after months of planning and preparation, according to Binance's investigation. This attack has renewed scrutiny of a longstanding weakness in the cryptocurrency industry: hackers may need to compromise only one employee to gain access, while inconsistent security practices can allow them to turn that foothold into massive theft.

Cybersecurity experts have raised questions about how exchanges defend employees against sophisticated social engineering and whether they have adequate internal controls to limit what an attacker can do once an employee's computer or credentials are compromised.

Security concerns

Social engineering is a well-understood threat in the industry, but the bigger question is why exchanges do not have stronger internal safeguards and circuit breakers to prevent an attacker who breaches an engineer's computer from escalating access and moving assets.

Varying cybersecurity practices across the industry compound the problem, along with a longstanding aversion among some cryptocurrency advocates to controls they view as inconsistent with blockchain's decentralized ethos.

Industry impact

The Binance attack is the latest in a string of major cryptocurrency hacks that have resulted in more than $22.3 billion in stolen funds since 2021, according to blockchain intelligence firm Chainalysis. The scale of losses has intensified debate over whether exchanges need more consistent standards governing access, transaction controls and other defenses.

Cryptocurrency exchanges present unusually attractive targets because hackers can identify wallets holding enormous sums of readily transferable digital assets and, in some cases, the employees with access to the systems controlling them.

Regulatory patchwork

The uneven security practices identified by experts are mirrored by a fragmented US regulatory system. Unlike banks, US cryptocurrency exchanges do not operate under a single federal cybersecurity regime. Instead, requirements vary depending on where companies operate and which state licenses they hold.

New York imposes some of the industry's toughest requirements, including mandatory cybersecurity programs, multi-factor authentication, and designated chief information security officers. Elsewhere, crypto companies may be subject primarily to state money-transmitter rules that generally require companies to provide regulators with information about their cybersecurity programs but often do not prescribe particular technical controls.

Banks, by contrast, are subject to federal requirements covering areas including risk assessments, monitoring and incident response, while the largest institutions undergo continuing examinations by dedicated supervisors.