Securing Cryptocurrency: The Priority for Tech Firms in 2020

One of the persistent issues holding back the mainstream acceptance of
cryptocurrencies is fears about asset security. Once lauded as unhackable,' it has now been proven that it is possible to steal digital coins and tokens from people who own them. Regardless of the process by which it is happening, that is all that really matters to the victim.

In order to restore its damaged reputation and make good on its potential, the cryptocurrency industry has to tighten up its protections. We look at what has been happening and what is still left to do.

A good starting place is the incident that first woke the world up to the fact
that BitCoin may not be the digital miracle it had been built up as: the
(second) Mt. Gox hack of 2014.

The theft of around 850,000 BitCoins from the Tokyo-based Mt. Gox exchange is the biggest stain on the reputation of virtual money to date. The subsequent investigations revealed a number of security and operational flaws which enabled hackers to withdraw BitCoins to invalid addresses and even for the exchange owners to manipulate the system. The exchanges MintPal (twice) and Cryptsy were also hacked that year.

The next year started with a flurry of attacks as Chinese exchange 796, LocalBitcoins and BitStamp were breached in January and KipCoin and BTER in February. The next hack of note was the insider theft of $230,000 from ShapeShift in April 2016 and further exchanges were robbed later that year and the next.

In 2018, four years after the Mt. Gox scandal, another Japanese exchange,
Coincheck, suffered a hack resulting in the theft of $530m of NEM tokens.

With Cryptopia (twice), CoinMama, CoinBene, Bithumb, Binance, GateHub and Bitrue all succumbing in 2019, the situation seems as bad as ever for the crypto industry.

However, it would be wrong to suggest that nothing has been done to tighten up the security situation.  A number of tech-based advances have been made including improvements in wallet authentication, particularly with the application of multi-signature security.

This involves having several private keys associated with an account or wallet with any transaction or change requiring more than one key (the so-called M-of-N type of multisig security). These keys can be held in hardware devices created by different vendors to reduce the risk of insider compromise (they can also offer an element of redundancy by reducing the reliance upon just one key).

It is natural for tech-minded people to search for tech solutions for problems but the issues with Mt. Gox, Coincheck and the rest have never really been about the security of the blockchain itself. In the exchange hacks above, the blockchain itself has remained intact.

With Coincheck, much of the money is still, in fact, trapped in the system with accounts tagged in the same way as dirty bank notes can be stained (although some were sold via the dark web shortly after the hack).

It is also, of course, possible to see all past and future NEM transactions (e.g. using the NEM Explorer). However, the fast that the hackers may be unable to use their coins – and even the decision by Coincheck to reimburse all victims – doesn't affect the damage cryptocurrencies are facing to their reputation.

For example, there needs to be more robust checking of account holders to avoid the creation of fake wallet addresses. There also needs to be better vetting procedures for employees. These are lessons that the traditional financial sector have learnt over decades but are often overlooked by inexperienced exchange providers.

In the case of Mt. Gox, even basic development safeguards like version control and a test environment were lacking.

One of the most basic business errors the crypto industry has been
guilty of is failing to separate the asset controllers (i.e. the exchange
hosts) from the assets of their investors. This clear conflict of interests
makes insider dealing and even internal hacking a temptation (just as the
banker in a game of Monopoly must sometimes be tempted to slip out a few notes). Although Coincheck maintain there was no internal attack in their case, other exchange hacks, including the Mt. Gox scandal, had either confirmed or suspected insider involvement.

Tackling internal threats requires standard cybersecurity measures
such as Identity and Access Management and third party oversight. When
auditing and improving exchange security, it is always best to enlist the help of neutral third parties.

Cybersecurity training must also be incorporated into the culture
and practise of every exchange so that all employees understand the risks and do what they can to minimize them. For example, the Coincheck hack largely happened because of an unforgivable practise of storing most NEM in hot wallets.

A lack of regulation in the cryptocurrency space has excited many advocates of the technology but the industry seems to be slowly coming round to the idea that some regulation will be needed to shore up the security and reputation of digital money.

It is no surprise that the country that has been at the brunt of the worst
attacks, Japan, has finally taken measures to self-regulate. In fact, had
Coincheck been a new exchange at the time of the hack, they would have been forced to update their security practises much earlier due to the 2017 Payment Services Act passed by the government. For example, multi-signature security wasn't used by Coincheck when it was hacked but is now mandatory under the Act.

2020 is likely to see more progress in terms of international regulation of virtual currency as the FATF (Financial Action Task Force on Money Laundering) gets its teeth into the issue.

So far we have focused on exchange hacks but it is possible to actually hack into the blockchain itself. So-called 51% attacks are a particular cause for concern because they strike at the very heart of the cryptocurrency business model itself.

Ironically, given the urge for decentralization behind many crypto advocates, 51% attacks can occur because of a massive centralization of power within a specific cryptocurrency system.

In most cryptocurrencies, mining power is distributed between a large number of miners which means that the cost of defrauding the system is too high for any one person or entity. However, should one person or company control the biggest share of the power, they can then create their own copy of the blockchain (a hard fork) minus any new transactions made by miners on the now redundant blockchain.

The biggest cryptocurrencies are immune to this risk but some of the smaller ones are susceptible. The biggest such attack came in January 2019 when a hacker gained control and started to rewrite the code of the Ethereum Classic blockchain, the first time a top 20 currency had been targeted.

Although Coinbase assured the public that no assets were stolen in this attempted heist, the warning bell has definitely been rung again. It is yet more evidence, if any were needed, that developers and the wider industry have a lot of work to do as we enter a new decade.

(Disclaimer: The Author is the CEO of DCG Technical Solutions Inc)