[et_pb_section bb_built=”1″ fullwidth=”on” specialty=”off” next_background_color=”#212121″ _builder_version=”3.17.6″ background_image=”https:\/\/monitorchain.com\/wp-content\/uploads\/2018\/11\/FAQ2.jpg” background_color=”#212121″][et_pb_fullwidth_header _builder_version=”3.17.6″ title=”The Primary Causes of Exchange and Tokens Hacks” background_color=”rgba(0,0,0,0)” background_video_pause_outside_viewport=”off” text_shadow_color=”rgba(0,0,0,0.5)” title_text_color=”#1f8ee2″ title_text_shadow_style=”preset1″ title_text_shadow_color=”rgba(0,0,0,0.5)” text_shadow_vertical_length=”0.1em” text_shadow_blur_strength=”0.1em” title_font=”|700|||||||” \/][\/et_pb_section][et_pb_section bb_built=”1″ specialty=”off” prev_background_color=”#212121″ _builder_version=”3.17.6″ background_color=”#212121″ inner_shadow=”on” box_shadow_style=”preset6″ box_shadow_spread=”10px” box_shadow_color=”rgba(0,0,0,0.5)” background_image=”https:\/\/monitorchain.com\/wp-content\/uploads\/2018\/11\/BlogBG3.jpg”][et_pb_row admin_label=”Top Image – Hide Row if None” _builder_version=”3.17.6″ background_color=”#212121″ background_image=”https:\/\/monitorchain.com\/wp-content\/uploads\/2018\/08\/locks.jpg” width_unit=”off” custom_width_percent=”100%”][et_pb_column type=”4_4″][et_pb_divider admin_label=”Desktop + Tablet + Phone” _builder_version=”3.17.6″ show_divider=”off” height=”100px” disabled=”off” disabled_on=”off|off|off” \/][et_pb_divider admin_label=”Desktop + Tablet” _builder_version=”3.17.6″ show_divider=”off” height=”100px” disabled=”off” disabled_on=”on|off|off” \/][et_pb_divider admin_label=”Desktop” _builder_version=”3.17.6″ show_divider=”off” height=”100px” disabled=”off” disabled_on=”on|on|off” \/][et_pb_divider admin_label=”Desktop” _builder_version=”3.17.6″ show_divider=”off” height=”100px” disabled=”off” disabled_on=”on|on|” \/][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”3.17.6″][et_pb_column type=”2_3″][et_pb_divider _builder_version=”3.17.6″ show_divider=”off” height=”10px” \/][et_pb_text _builder_version=”3.17.6″ text_text_color=”#e0e0e0″ background_layout=”dark”]<\/p>\n
It\u2019s no secret that cryptocurrencies have become \u2018big business.\u2019 As lucrative as they can be, not only do they attract investors but also draw attention from online thieves and hackers.\u00a0 Since the dawn of crypto, many companies have fallen victim to online attacks: leading to losses of billions of dollars worth of digital assets and even the closure of some exchanges.<\/p>\n
In this post, we shall explore top causes, and illustrate with examples of notable hacks that shook the crypto-world to its very core:<\/p>\n
[\/et_pb_text][et_pb_text _builder_version=”3.17.6″ text_text_color=”#e0e0e0″ background_layout=”dark”]<\/p>\n
Social engineering or phishing hacks typically revolve around psychological manipulation. \u201cCon artists\u201d devise ingenious methods for fooling unsuspecting users and employees into handing over confidential and valuable company data.<\/p>\n
Popular phishing methods include; use of emails, imitation profile and websites as well as other communications to invoke a sense of urgency or fear, leading the victim to open a malicious file, click on a malicious link or promptly reveal confidential information. And because these hacks involve a human element they can be quite tricky to prevent.<\/p>\n
In December 2014, hackers stole millions worth of digital currency from\u00a0Bitpay<\/a>. They used a sneaky phishing attack that harvested Bryan Krohn (BitPay\u2019s Chief Financial Officer) email and password. Using Bryan\u2019s email, the hackers sent several fund requests to Stephen Pair (BitPay\u2019s CEO). By the time BitPay came to their senses, $1.8 million worth of Bitcoin had gone down the drain.<\/p>\n In January 2015,\u00a0Bitstamp<\/a>\u00a0employees were the target in a weeks-long phishing attempt leading to the loss of approximately $5 million in Bitcoin. Hackers utilized email and Skype to distribute files that contained malware to employees. The exchange\u2019s system became compromised after Luka Kodric; the systems administrator downloaded a file that he thought was sent by the organization representative.<\/p>\n In March 2018,\u00a0Binance<\/a>\u00a0reported unauthorized transactions through a phishing attack linked to Viacoin Pump. The hackers executed unauthorized orders through users\u2019 accounts which caused a 400% pump for Viacoin.<\/p>\n ICO\u2019s are not an exception. Fraudsters dupe naive investors to send their hard-earned ETH\/BTC to a fake address.\u00a0NuCypher<\/a>\u00a0which recently launched its ICO has suffered several phishing attempts. The most recent being messages delivered to users via slackbots; asking them to send ether funds to an Ethereum address provided in return for NuCypher tokens. Nevertheless, NuCypher promptly cautioned investors that would never make investment requests via Slack.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”3.17.6″ text_text_color=”#e0e0e0″ background_layout=”dark”]<\/p>\n The biggest security threat is within. While it is natural that organizations would trust their employees, a\u00a0study<\/a>\u00a0done in 2015 reveals that 60% of hacks is either an inside job or designed by \u201cmalicious insiders.\u201d<\/p>\n In 2011, Bitcoin7 was one of the biggest exchanges (after TradeHill and Mt Gox). The company was hacked, and 5,000 BTC disappeared into thin air. While the company linked the attack to a group of Russian hackers, many believe it was an inside job. The exchange was shut down soon after the incident.<\/p>\n In 2012, Bitcoinica suffered three attacks and Bitcoins worth thousands of dollars lost. While the initial hacks were linked to the exploitation of their webhost known as Linode, the third attack was suspected to be an inside job. According to some Blockchain\u00a0analysis<\/a>, Zhou Tong (Bitcoinica CEO) may have been the beneficiary of the July 2012 hack.\u00a0 Zhou, however, denied the allegations; he claimed he was being framed.<\/p>\n In 2013, Bitcoin Savings and Trust which was allegedly meant to serve as the first securities platform (using Bitcoin as an asset class), turned out to be a giant\u00a0Ponzi scheme<\/a>. Trendon Shavers (the man behind this scam) was arrested in 2014 and sentenced to pay the investors restitution of $40.7 million.<\/p>\n Mintpal, at one time, was one of the top crypto exchanges preferred by traders because of its ability to process large trading volumes. In 2014,\u00a0Mintpal<\/a>\u00a0was sold to Moopay executive \u201cAlex Green\u201d (alias, Ryan Kennedy), who is believed to be a shady scammer. Soon after the sale, the exchange was attacked, and $3.2 million worth of Bitcoin lost. While it possible that the vulnerability was present at the point of sale, and the buyer just failed to detect and patch it in good time. Many people claim that Alex Green \u201chacked\u201d it himself.<\/p>\n In April 2016,\u00a0ShapeShift<\/a>\u00a0was also in the frying pan. Investigations linked the theft to one of its employees. ShapeShift\u2019s investigation report indicated that the worker made away with $130,000 worth of digital currency, and then sold ShapeShift\u2019s security system information to a hacker.\u00a0 And the fraudsters made a second attack during the same month and stole yet another $100,000 from Shapeshift.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”3.17.6″ text_text_color=”#e0e0e0″ background_layout=”dark”]<\/p>\n The other leading cause to how fraudsters gain access to an exchange system is due to poor security practices.<\/p>\n In May 2013,\u00a0Vicurex<\/a>\u00a0security was breached and $160,000 worth of digital assets stolen. The hacker got access to the login credentials of their VPS control account and then requested a root password reset to all servers. The simple mistake that cost them was that the hosting service provider sent the VPS credentials via Vicurex helpdesk ticket, instead of the standard procedure of communicating via an official email address.<\/p>\n In June 2013, PicoStocks \u2013 a first generation digital assets stock exchange was hacked and $130,000 worth of cryptocurrency lost.\u00a0 Through a\u00a0forum post<\/a>, a PicoStocks representative indicated that the company\u2019s slovenly security practices were to blame for the attack. They had the same password for several accounts. Admitting that it was their fault, the company promised to refund customers for the loss.<\/p>\n In December 2017, EtherDelta suffered a\u00a0DNS hijacking<\/a>\u00a0attack. According to EtherDelta, the hackers took control over its DNS server, redirecting etherdelta.com domain to a malicious server hosting an imitation of their website. Other crypto companies that have been a victim of DNS hijacking hacks in the previous years include; Etherparty ICO website<\/a>\u00a0and\u00a0Classic Ether Wallet<\/a>.<\/p>\n In January 2018,\u00a0Coincheck<\/a>\u00a0was hacked and 523 million NEM coins were stolen. The platform admitted of not securing its hot wallet by using multisignature private keys. Hackers managed to access a single private key which they used to unlock the digital wallet and drained the funds. In a scenario where multisignature security protocol is employed, the private keys are stored in a distributed fashion and should not be reachable in a single breach.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”3.17.6″ text_text_color=”#e0e0e0″ background_layout=”dark”]<\/p>\n Smart Contracts are essentially the core of all Ethereum DApps as well as token sales.\u00a0 They automatically and autonomously enable execution of credible transactions on the Blockchain.<\/p>\n Since smart contracts control millions of dollars, it\u2019s no surprise that they are a target for attackers. Consequently, some hacks emanate from vulnerabilities in smart contracts. Here are a few examples:<\/p>\n DAO hack<\/em><\/p>\n A Decentralized Autonomous Organization (DAO<\/a>) is a decentralized venture capital fund run by smart contracts. By eliminating the need for documents and people, DAO was intended to democratize the funding of Ethereum projects.<\/p>\n In June 2016, unknown hackers exploited the\u00a0fallback function<\/a>\u00a0\u2013 vulnerability on the DAO code that exposed smart contracts to reentrancy and stole 3.6 million Ether. As a survival strategy, the Ethereum\u2019s codebase resolved for a reset via a hard fork. Consequently, it resulted in the creation of Ethereum and Ethereum Classic as two distinct chains.<\/p>\n Multi-sig wallet hack<\/em><\/p>\n During the same period, in June, Parity\u2019s multi-signature wallets were hacked.\u00a0 Usually, Multi-sig wallets require more than one digital signature before a transaction is approved. The attackers exploited the\u00a0delagatecall and fallback function<\/a>\u00a0in the smart contracts and made away with 150,000 Ether.<\/p>\nInside Jobs \/ Corrupt Employees
<\/strong><\/span><\/h2>\nPoor Security Practices
<\/strong><\/span><\/h2>\nSmart Contract Vulnerabilities
<\/strong><\/span><\/h2>\n