Scalable Solutions

Cryptocurrency Exchange Hacks: How to Secure Users’ Funds from Theft

admin

With growing popularity and mass adoption of crypto assets, the amount of funds flowing to centralized exchanges have been increasing as well. Unlike fiat money, transactions with digital currencies are basically irreversible, as known cases with digital currency hack attacks showed. The return of stolen funds is rather controversial, and at the same time it becomes a notable event.

In order to protect user’s funds from stealing, custodians have started to offer sophisticated solutions, hardware and software, advanced technologies, for safe storage of cryptocurrencies.

In this article we will emphasise the importance of custody, specify the risks associated with storing cryptocurrencies, as well as cover leading technologies and measures utilized by custodians to protect users’ funds.

The importance of digital assets custody

Crypto custody is a solution which allows secure digital assets. Digital asset custodians do not store any of the assets since all data and transactions are recorded on the blockchain. Instead, they protect users’ private keys for a crypto wallet, which grants access to the funds stored in it.

Crypto custodians are crucial for the extensive adoption of digital assets. According to Blockdata, the global assets under custody have grown significantly from Jan 2019 to Jan 2022 (approximately 600%).

Graph 1. Assets Under Custody vs. Total Market Cap [1]

Below are the key statistics that support the need for secure storage of digital currency:

Graph 2. Funding Raised by Digital Asset Custody Providers [1]

The number of assets under custody, cyber-criminal cases with digital assets and funding raised by digital asset custodians emphasise the importance of secure custody solutions.

How to reduce the likelihood of a successful attack or fraudulent transaction?

There are three main risks related to digital assets, these are private key management, nearly irreversible transactions and product and networking risk. These risks mean that custodians of digital assets and technology providers must constantly ensure security and comply with necessary procedures, while companies’ products must be constantly monitored, tested and improved. Moreover, with the increase in the number of supported blockchains, these risks have intensified. While these 3 risks are true of the asset category as a whole, custodians and this article will focus on private key management keeping in mind that this management is crucial as stolen assets are nearly impossible to recover.

Many custodians have been using advanced methods and technologies to reduce the likelihood of a successful attack or fraudulent transaction.

Among the main technologies for user’s fund protection, The Block Research stated:

1) Hardware security modules (HSMs);
2) Multi-party computation (MPC);
3) Multi-signature technology (multisig)

Below you will find the characteristics of these technologies utilized by custodians to secure and manage access to digital assets.

1) Hardware security modules (HSM) are hardware devices applied to perform encryption, decryption, authentication, protection and cold storage of digital keys and other cryptographic functions. They have been tested and used in a diverse number of industries for nearly 20 years.

The main advantages of a HSM are:

However, HSMs are not a perfect security solution: HSMs are harder to update than software solutions; it involves slower transactions than some other solutions; the module implementations can be quite costly due to the need for purchasing, shipping, installation, maintenance, upgrading, configuration and scaling.

2) The main concept of multi-party computation (MPC), a cryptographic protocol, is that multiple parties can perform joint computations using their combined data without revealing each other’s inputs.

Custodian and technology providers usually implement MPC in secure private key generation. The private keys are used to digitally sign and authorize transactions for digital assets under custody. Below are the steps needed for transactions to be signed using MPC.

Growing number of institutional custodians, such as Coinbase and Gemini, have invested in MPC technology, highlighting its significant role in hardening security of the custodian service. MPC has also been growing in popularity with custody tech providers like Fireblocks and Curv.

3) Multisignature or “multisig” wallets share a similar idea with MPC, these two technologies require multiple parties to sign a digital asset transaction and access the funds stored on a multi-signature address. However, the difference between the processes is that multisig wallets are secured by several diverse on-chain signatures generated by different private keys, while MPC relies on a single signature created off-chain.

Graph 3. Difference between Multisig and MPC technologies [5]

In the institutional custodian space multisig serves not only as a strictly technical and security solution, but also as a policy and asset management feature. The main benefits of multisig technology are:

Other highly effective security measures include:

4) Two-factor authentication (2FA);
5) Know your customer (KYC) policy;
6) Whitelisting

4) Two-factor authentication is a security system that requires two distinct forms of identification to access an account. 2FA is a combination of two of the following:

5) Know Your Customer is a set of standards used to verify customers, identify their risk profile, monitor their transactions and receive client’s acceptance with the company’s policy. KYC allows to limit or prevent cases of fraud, tax evasion and money laundering in financial markets.

6) Whitelisting is a security feature in wallets against any illegitimate activity. When this option is turned on, it allows crypto withdrawals only to authorized (whitelisted) wallets.

It is important to understand that not all of these measures are necessarily technological innovations (for example, KYC or access control). However, such measures as regulation (KYC) allow to consider the human and regulatory elements and ensure the reliability of stored funds.

Conclusion

Custody of digital currencies is a fairly mature area on the crypto market. However, it’s a matter of fact that custodial solutions will continue to evolve due to the expansion of brokerage services, lending and derivatives market as well as emerging of sophisticated fraud schemes. At the same time, without the custody, these services might not even exist.

The ability to protect the ownership of our digital assets will continue to be one of the most crucial topics in the crypto industry. Reliable custody must be inherently correlated with digital security, policy enforcement, and meeting customer needs with the right tools and services.

 

 

References:

  1. “Crypto Custody: The Gateway to institutional adoption”. BlockData, January 2022
  2. “The 2022 Crypto Crime Report”. Chainalysis, February 2022
  3. Groves, K. “Cryptocurrency Exchange Hacks (Updated 2022 List)”. HedgewithCrypto. Access Date: February 24, 2022
  4. Kartsev, A. “Largest Crypto Hacks in History: Have Exchanges Learned Anything From Their Mistakes?” CoinMarketCap. Access Date: February 24, 2022
  5. Reyers, K. “Institutional Custody for Digital Assets”. The Block Research, September 12, 2021
  6. Spector, B. “What is Multi-Party Computation (MPC)?” Qredo, July 02, 2021
  7. Harper, C. “Multisignature Wallets Can Keep Your Coins Safer (If You Use Them Right)”. CoinDesk, September 14, 2021
  8. “Cryptocurrency Transactions: Multi-Signature Arrangements Explained”. Freeman Law. Access Date: February 24, 2022
  9. Wiener, F. “Secure Multiparty Computation (MPC) for Digital Asset Custody Wallets”. Sepior, February 09, 2021
  10. Jaerv, G. “MPC or HSM: Who Would Win?”. First Digital, August 7, 2020
  11. Kenton, W. “Two-Factor Authentication (2FA)”. Investopedia, Access Date: March 08, 2022
  12. Chen, J. “Know Your Client (KYC)”. Investopedia, Access Date: March 08, 2022