Analysis:Binance hack reveals crypto's uphill battle against hackers

Résumé détaillé

Nov 11 : An elite North Korean hacking group’s $6.3 billion theft from Binance is renewing scrutiny of a longstanding weakness in the cryptocurrency industry: hackers may need to compromise only one employee to get inside, while inconsistent security practices can allow them to turn that foothold into a massive theft.

The October 29 heist, described by experts as the largest cryptocurrency theft ever, unfolded in a matter of minutes after months of planning and preparation, according to Binance’s initial investigation.

Cybersecurity experts said the attack raises questions not only about how exchanges defend employees against sophisticated social engineering, but also about whether they have adequate internal controls to limit what an attacker can do once an employee’s computer or credentials are compromised.

Social engineering is a well-understood threat in the industry, said Jonathan Alexander, chief technology officer of S&P Global’s OpenZeppelin, a blockchain security provider. The bigger question, he said, is why exchanges do not have stronger internal safeguards and circuit breakers to prevent an attacker who breaches an engineer’s computer — like what happened at Binance — from escalating access and moving assets.

Varying cybersecurity practices across the industry compound the problem, Alexander said, along with a longstanding aversion among some cryptocurrency advocates to controls they view as inconsistent with blockchain’s decentralized ethos that sometimes views things such as limits on transaction amounts and automatic reviews of patterns of spending as infringing on inherent privacy rights.

The Binance attack is the latest in a string of major cryptocurrency hacks that have resulted in more than $22.3 billion in stolen funds since 2021, according to blockchain intelligence firm Chainalysis. The scale of the losses has intensified debate over whether exchanges need more consistent standards governing access, transaction controls and other defenses.

“I do…

Cryp…

Début de l'article, extrait de CNA. Pour lire la suite, ouvrez l'article chez le média.