By AJ Vicens and Hannah Lang
Nov 11 (Reuters) - An elite North Korean hacking group’s $6.3 billion theft from Binance is renewing scrutiny of a longstanding weakness in the cryptocurrency industry: hackers may need to compromise only one employee to get inside, while inconsistent security practices can allow them to turn that foothold into a massive theft.
The October 29 heist, described by experts as the largest cryptocurrency theft ever, unfolded in a matter of minutes after months of planning and
preparation, according to Binance’s initial investigation.
Cybersecurity experts said the attack raises questions not only about how exchanges defend employees against sophisticated social engineering, but also about whether they have adequate internal controls to limit what an attacker can do once an employee’s computer or credentials are compromised.
Social engineering is a well-understood threat in the industry, said Jonathan Alexander, chief technology officer of S&P Global’s OpenZeppelin, a blockchain security provider. The bigger question, he said, is why exchanges do not have stronger internal safeguards and circuit breakers to prevent an attacker who breaches an engineer’s computer — like what happened at Binance — from escalating access and moving assets.
Varying cybersecurity practices across the industry compound the problem, Alexander said, along with a longstanding aversion among some cryptocurrency advocates to controls they view as inconsistent with blockchain’s decentralized ethos that sometimes views things such as limits on transaction amounts and automatic reviews of patterns of spending as infringing on inherent privacy rights.
"I think that falsely, that has led some people to think that things like circuit breakers, things like more controls on the accounts, would be unacceptable or would be absolutely in conflict with that need to avoid censorship," Alexander said. "In my view, you can have security controls and have protections against that."
The Binance attack is the latest in a string of major cryptocurrency hacks that have resulted in more than $22.3 billion in stolen funds since 2021, according to blockchain intelligence firm Chainalysis. The scale of the losses has intensified debate over whether exchanges need more consistent standards governing access, transaction controls and other defenses.
“I do expect we’ll see more clarity and standardization in the kind of cybersecurity expectations and, hopefully, requirements for investor protection and trust," Alexander said. “These things show why it has to change."
HIGHLY VISIBLE, ATTRACTIVE TARGETS
Cryptocurrency exchanges present unusually attractive targets because hackers can identify wallets holding enormous sums of readily transferable digital assets and, in some cases, the employees with access to the systems controlling them.
That has made engineers and IT workers prime targets for elaborate social-engineering operations.
Alex Pruden, CEO of blockchain and digital-asset security firm Project Eleven, said defenders face a fundamental disadvantage against attackers who need to succeed only once.
“This is an extremely hard problem,” Pruden said. “The best practices in cybersecurity that we've had up to this point are just simply not up to the task of the world that we live in in terms of what the threat is.”
Cybersecurity workers in the industry, he added, “live in a world of constant warfare. We are under constant attack.”
Pruden expects the Binance theft to spur greater investment in cybersecurity, including safeguards around internal AI tools and agents that could themselves expand an attacker’s capabilities if compromised.
"We're at the beginning of the beginning of that story, but I just think like the Binance hack showed, those tools can be turned against you very, very quickly and they can be very hard to undo the damage once it's done."
Cryptocurrency exchanges have already begun moving to bolster defenses and increase information sharing following the Binance hack, Reuters reported October 30.
PATCHWORK OVERSIGHT, UNEVEN DEFENSES
The uneven security practices identified by experts are mirrored by a fragmented US regulatory system.
Unlike banks, US cryptocurrency exchanges do not operate under a single federal cybersecurity regime. Instead, requirements vary depending on where companies operate and which state licenses they hold.
New York imposes some of the industry's toughest requirements. The state's Department of Financial Services requires licensed companies to maintain cybersecurity programs, use multi-factor authentication and designate a chief information security officer.
Elsewhere, crypto companies may be subject primarily to state money-transmitter rules. Those regimes generally require companies to provide regulators with information about their cybersecurity programs and undergo examinations, but often do not prescribe particular technical controls, such as encryption standards.
Many exchanges do not operate in the US and are not subject to those state oversight regimes, although they may operate under separate requirements wherever they do business.
Banks, by contrast, are subject to federal requirements covering areas including risk assessments, monitoring and incident response, while the largest institutions undergo continuing examinations by dedicated supervisors.
(Reporting by AJ Vicens in Detroit; editing by Chris Sanders and Nick Zieminski)
