Binance hack reveals crypto's uphill battle against hackers

Cybersecurity experts said the attack raises questions not only about how exchanges defend employees against sophisticated social engineering, but also about whether they have adequate internal controls to limit what an attacker can do once an employee’s computer or credentials are compromised. Read:Binance hackers used fake job interview in $6.3b attack.

Social engineering is a well-understood threat in the industry, said Jonathan Alexander, chief ​technology officer of S&P Global’s Open. Zeppelin, a blockchain security provider.

The bigger question, he said, is why exchanges do not have stronger internal safeguards and circuit breakers to prevent ​an attacker who breaches an engineer’s computer — like what happened at Binance — from escalating access and moving assets.

Varying cybersecurity practices across the industry compound the ⁠problem, Alexander said, along with a longstanding aversion among some cryptocurrency advocates to controls they view as inconsistent with blockchain’s decentralised ethos that sometimes views things such as limits on transaction amounts and ​automatic reviews of patterns of spending as infringing on inherent privacy rights.

"I think that falsely, that has led some people to think that things like circuit breakers, things like more controls on the ​accounts, would be unacceptable or would be absolutely in conflict with that need to avoid censorship," Alexander said. "In my view, you can have security controls and have protections against that.

"The Binance attack is the latest in a string of major cryptocurrency hacks that have resulted in more than $22.3 billion in stolen funds since 2021,. The scale of the losses has intensified debate over whether exchanges need more consistent standards governing ​access, transaction controls and other defences.

“I do expect we’ll see more clarity and standardisation in the kind of cybersecurity expectations and, hopefully, requirements for investor protection and trust," Alexander said. “These things show ​why it has to change. "Highly visible, attractive targets.

Cryptocurrency exchanges present unusually attractive targets because hackers can identify wallets holding enormous sums of readily transferable digital assets and, in some cases, the employees with access to the ‌systems controlling them. That ⁠has made engineers and IT workers prime targets for elaborate social-engineering operations.

Alex Pruden, CEO of blockchain and digital-asset security firm Project Eleven, said defenders face a fundamental disadvantage against attackers who need to succeed only once. “This is an extremely hard problem,” Pruden said.

“The best practices in cybersecurity that we've had up to this point are just simply not up to the task of the world that we live in in terms of what the threat is.”Cybersecurity workers in the industry, he added, “live in a world of constant warfare. We are under constant attack”.

Read More:North Korea's army of world-class hackers is secret weapon that took down Binance. Pruden expects the Binance theft to spur greater ​investment in cybersecurity, including safeguards around internal AI tools ​and agents that could themselves expand an ⁠attacker’s capabilities if compromised.

"We're at the beginning of the beginning of that story, but I just think as the Binance hack showed, those tools can be turned against you very, very quickly and they can be very hard to undo the damage once it's done. "Cryptocurrency exchanges have already begun ​moving to bolster defences and increase information sharing following the Binance hack, Reutersreported.

October 30. Patchwork oversight, uneven defences. The uneven security practices identified by experts ​are mirrored by a ⁠fragmented US regulatory system.

Unlike banks, US cryptocurrency exchanges do not operate under a single federal cybersecurity regime. Instead, requirements vary depending on where companies operate and which state licenses they hold. New York imposes some of the industry's toughest requirements.

The state's Department of Financial Services requires licensed companies to maintain cybersecurity programs, use multi-factor authentication and designate a chief information security officer. Elsewhere, crypto companies may be subject primarily to state money-transmitter ⁠rules.

Those ​regimes generally require companies to provide regulators with information about their cybersecurity programs and undergo examinations, but often do not ​prescribe particular technical controls, such as encryption standards. Many exchanges do not operate in the US and are not subject to those state oversight regimes, although they may operate under separate requirements wherever they do business.

Banks, by contrast, are subject ​to federal requirements covering areas including risk assessments, monitoring and incident response, while the largest institutions undergo continuing examinations by dedicated supervisors.