-By Tyler Moffitt, Senior Threat Research Analyst at Webroot
When asked to name a cryptocurrency you’d likely think of Bitcoin, but today there are now over 900 cryptocurrencies on the market. In theory, the blockchain that cryptocurrencies use should be un-hackable and yet last month we saw hackers make off with $32 million worth of the cryptocurrency Ether. Before that, Bithumb fell foul and even Bitcoin was itself exploited back in 2011 from the Mt. Gox Exchange.
Bitcoin was the first ever decentralized currency but the newer variants all follow the same principle. Their decentralized nature means there’s no central repository of information, no central management, and, crucially, no central point of failure. There’s no single target to hack and most blockchains are publicly visible so all thefts are in plain sight.
Ultimately, they should be the most secure form of currency out there.
How do cryptocurrency hacks/heists work?
Currency holdings can only be accessed by a private key. This private key is essentially a password to a digital currency wallet that allows access to the currency to do as you wish with it. Safeguarding that key is the weak-link in the cryptocurrency security chain. If hackers find a way to steal it, then a digital wallet can be accessed.
One way cryptocurrencies bolster their security is through “cold storage,” meaning that private keys are kept offline, away from the reach of online hackers. The key can be written down on paper or stored on a drive that’s locked away in a bank safe. Some users have even taken to keeping their keys in high-security guarded Swiss vaults, but these high-security measures naturally impacts convince and the speed in which you can access your money.
In the latest Ethereum attack, hackers exploited a vulnerability in multi-signature wallets from Parity which allowed hackers to drain accounts as if they had the private keys. While the hackers were making the transactions, White Hat Group used the same exploit to drain Ether from 500 other vulnerable wallets into the group’s own account to save them. The White Hat Group was able to save over 377,000 ETH which was about $75 million. (115M now).
The key takeaway from this hack is that we're still exploring the blockchain space and wallet security is more important than ever. The multi-sig wallets in question are popular among companies because they have multiple key-holders and require a majority to sign off on transactions, making it trickier for fraudulent payments to be made.
As a threat researcher, I personally recommend hardware or native wallets (desktop wallets); they are the most secure, as you are in control of any transaction. Do not store lots of currency in exchanges that control your private address. Only use them to make trades then back out to safe addresses.
So will cryptocurrency hacks like this happen again?
I think the answer is almost certainly, yes.
With more and more coins appearing and alternative uses for the blockchain being discovered it’s going to continue to be a high-profile target for cyber criminals. Not just financial transactions coins like Bitcoin, but also decentralized apps like Ethereum and cloud storage like Siacoin have already been developing in the space.
I have no doubt these blockchain technologies will be a big part of the future, but it will take some years for the disruption of contemporary tech to take place. During these "teething" years as more users get into the space, we're going to see more phishing targets trying to get users to deposit to wrong addresses and more bugs and mistakes in code being exploited.