Cryptocurrency exchange BitMart was hacked yesterday, losing $196m in online currencies. It is the latest in a series of attacks on crypto exchanges as criminal gangs target the places digital currencies are stored. These incidents could cause crypto exchanges to introduce tighter security as a way of attracting customers, and could also pique the interest of regulators which have already been looking to introduce stricter controls on exchanges around the world.
Blockchain security company Peckshield is thought to be the first to have flagged up the breach in a tweet yesterday, which showed that hackers had drained $100m worth of cryptocurrency from the Etherium blockchain and $96m on the Binance Smart Chain. BitMart CEO Sheldon Xia released details of the vulnerability on Twitter today, explaining that the security breach was “caused by a stolen private key that had two of [their] hot wallets compromised.” After identifying the affected assets, Xia resolved to compensate users out of his own pocket, according to his statement online.
BitMart, which has suspended customer withdrawals until further notice in the wake of the breach, launched in 2018 and is based in the Caymen Islands. The value of trades on the platform amounted to over $985m in the past 24 hours, mainly comprising popular cryptocurrencies Bitcoin, Ethereum and Binance Coin.
BitMart cryptocurrency attack: not the first of its kind
BitMart is the latest in a series of cryptocurrency exchanges to be targeted by criminals. In October the BXH exchange was drained of $139m worth of cryptocurrencies, also due to leaked administrator keys. In August the Poly Network was stung for $610m in various online currencies, the costliest attack on a cryptocurrency exchange to date.
According to a report released recently by the cryptocurrency tracing agency CipherTrace, decentralised finance, or DeFi, fraud has soared in the past year. "When breaking down crypto crimes by those DeFi and non-DeFi related, a clean pattern emerges" the report states. DeFi-related hacks total $361m, already making up three-quarters of the total hack volume this year, an increase 2.7 times higher than those of 2020.
Why do cryptocurrency exchanges keep getting hacked?
When it comes to online security, cryptocurrency exchanges will have the same issues as any other company, says Steve Forbes, head of cyber product at security company Nominet. "Any time you bring technology into it there are going to be points of weakness," he says. But because cryptocurrency exchanges are not regulated, they don't face sanctions for breaches, meaning they are not compelled to boost their cybersecurity, Forbes argues. "No one's really holding them to account for these things," he says. "So while it sounds like common sense [to shore up cyber defences] there's no one with oversight of these organisations who can actually enforce anything."
This can be disastrous for customers, and convenient for hackers looking for a less risky cybercrime than ransomware, which has led to numerous arrests by international law enforcement agencies this year. Forbes says it is possible that for criminals, attacking crypto exchanges "is [seen as] a lower risk area, in terms of not attracting such large law enforcement retaliation."
Are more cryptocurrency exchange attacks on the way?
The success of the BitMart cryptocurrency exchange attack and other similar incidents will embolden more cybercriminals to try their luck, Forbes believes. "If there's big money to be made, as it appears there is, you could see a shift in mindset to 'let's not just worry about ransomware, we can go to where this money is collected and steal it from there as well'," he says.
More and more businesses are turning to crypto-assets, and users of exchanges should try to protect themselves as best they can, says Max Heinemeyer, the director of threat hunting at cybersecurity company Darktrace.
Heinemeyer says security could become a selling point for crypto-exchanges. "These kinds of attack are not new – we have seen several similar instances in this sector over the last few years," he says. "Users are increasingly wary of the security implications of trading, and having strong security mechanisms in place is already a selling point for some cryptocurrencies. Over time, we could see a similar trend emerge in the increasingly crowded crypto-exchange space.”
Heinemeyer also argues that the wave of attacks could spark more regulatory interest in crypto-exchanges. In June the UK financial conductor authority banned Binance's exchange, making it one of a number of global regulators to target the exchange over security and money laundering concerns. "Attackers will continue to focus on crypto exchanges – a lucrative source of income for cybercriminals," Heinemeyer says. "If these attacks keep happening, crypto exchanges are likely to become a bigger focus for regulators. We have seen this already in the wake of recent crypto-related ransomware attacks.”
Forbes agrees greater regulation is only a matter of time. "Sooner or later, no matter what anyone says, these things come into the eyes of the government and they will get regulated by governments around the world. It's just a matter of when, not if," he says.
