Analysis-Binance hack reveals cryptos uphill battle against hackers - Livemint

The October 29 heist, described by experts as the largest cryptocurrency theft ever, unfolded in minutes after months of planning, according to Binance's initial investigation. The $6.3 billion theft by an elite North Korean hacking group is renewing scrutiny of a longstanding weakness in the cryptocurrency industry: hackers may need to compromise only one employee to get inside.

Cybersecurity experts said the attack raises questions about how exchanges defend employees against sophisticated social engineering and whether they have adequate internal controls to limit what an attacker can do once an employee's computer or credentials are compromised.

Industry Security Concerns

Social engineering is a well-understood threat in the cryptocurrency industry, but varying cybersecurity practices across the industry compound the problem. Some cryptocurrency advocates have an aversion to controls they view as inconsistent with blockchain's decentralized ethos.

Jonathan Alexander noted that this has led some people to mistakenly believe that security controls like circuit breakers would conflict with avoiding censorship. "In my view, you can have security controls and have protections against that," he said.

The Binance attack is the latest in a string of major cryptocurrency hacks that have resulted in more than $22.3 billion in stolen funds since 2021, according to blockchain intelligence firm Chainalysis.

Attractive Targets

Cryptocurrency exchanges present unusually attractive targets because hackers can identify wallets holding enormous sums of readily transferable digital assets and, in some cases, the employees with access to the systems controlling them.

That has made engineers and IT workers prime targets for elaborate social-engineering operations. Alex Pruden, CEO of blockchain security firm Project Eleven, said defenders face a fundamental disadvantage against attackers who need to succeed only once.

Pruden expects the Binance theft to spur greater investment in cybersecurity, including safeguards around internal AI tools that could themselves expand an attacker's capabilities if compromised.

Regulatory Challenges

The uneven security practices identified by experts are mirrored by a fragmented US regulatory system. Unlike banks, US cryptocurrency exchanges do not operate under a single federal cybersecurity regime.

New York imposes some of the industry's toughest requirements, including mandatory cybersecurity programs, multi-factor authentication, and designated chief information security officers. Elsewhere, crypto companies may be subject primarily to state money-transmitter rules that don't prescribe particular technical controls.

Many exchanges do not operate in the US and are not subject to those state oversight regimes. Banks, by contrast, are subject to federal requirements covering areas including risk assessments, monitoring and incident response.

Following the Binance hack, cryptocurrency exchanges have begun moving to bolster defenses and increase information sharing, as reported by Reuters on October 30.