As the technologies become more sophisticated, their impact is comparable to other significant revolutions in communications and transportation that have evolved over the past thousand years. Smartphones, computers, and the internet are revolutionary technologies, and these technological marvels of our time have also bred a profession called hacker. These benevolent hackers, also known as ethical or white hackers, use their skills to find flaws, vulnerable areas, and weak spots in the organization’s security system. This is done to find and fix the weaknesses and prevent malicious hackers from breaking into the security system. However, a group of hackers also operate and execute their skills in illicit activities. Also known as Black Hackers, they can gain unauthorized access to someone’s system to steal their data and files or corrupt their system. And they have started getting more creative with their scams and hacks.
Cryptocurrencies were first introduced with the introduction of Bitcoin (BTC) in 2009, and many other digital currencies — or altcoins — have also appeared since then. The attractive asset class is wholly created online; thus, they are also prone to hacking. Over the years, numerous cryptocurrency hacks and scams have taken place as cryptocurrency slowly gains a foothold in the financial market.
Through the popular rise of cryptocurrencies (and the underlying blockchain), it is no surprise that hackers seek to exploit possible vulnerabilities to claim control over these technologies for financial gains and perhaps for more sinister purposes.
Hacking where the money is
Given the available technologies and tools today, blockchain still needs to be fixed. However, the software utilizing blockchain and storing cryptocurrencies are subject to exploitation. Many hacks resulted from attacks on individual phones, but most of the thefts occurred on exchanges. An exchange is where people store their coins before exchanging them or converting them to fiat in a trade. As far as cyber thieves are concerned, exchanges are where the money is. They can hack into the exchange network, access user keys that unlock people’s funds, and wreak havoc. And while the money the hackers make off cannot be forcibly returned to the users — a blockchain usually doesn’t allow reversed transactions — the money can be monitored and tracked using various investigative and analytic tools to determine which address belongs to the hacker and freezes them. An example would be a hacking incident involving a cryptocurrency exchange called CoinCheck, in which the exchange identified, published, and froze a list of eleven addresses that held all its stolen coins.
Other notable cases include the Slovenian-based Bitcoin mining marketplace, NiceHash, where, in December 2017, a highly skilled and organized attack was carried out with sophisticated social engineering, resulting in a loss of US$64 million. The infamous Mt. Gox exchange was also hacked in 2013 during its heydays as the leading crypto exchange of that time, losing a whopping US$460 million to the attack.
Hacks beyond exchanges
Apple has claimed that its products are highly secure and that it is impossible to hack or exploit Apple products. However, they have come into the picture of a highly orchestrated series of attacks sponsored by North Korea. Disguised under the Lazarus Group alias, they tried to hack into Apple computers via a fake cryptocurrency trading app, which the group coded and later uploaded on GitHub. A piece of malware inside this code would target Apple computers when downloaded, allowing the hacker access to do something on the devices. North Korea has made about $2 billion by hacking various conventional crypto exchanges and banks, according to a United Nations report. Similar attacks by Lazarus Group were executed in March 2019, when a Singapore-based exchange known as DragonEx was infiltrated and lost US$7 million to the hackers. Chainalysis, which DragonEx hired to help in the investigation. It said it was one of the most complex phishing campaigns they have ever seen, claiming it’s “on another level of complexity.”
“It shows the time and energy that Lazarus group have at their fingertips, as well as the deep knowledge of the cryptocurrency environment required to impersonate legitimate participants effectively,” the firm stated.
Commonly used methods deployed by hackers
To prevent a possible security breach to your crypto assets, it is essential to understand the various approaches hackers commonly use to steal funds. The pioneering cryptocurrency, Bitcoin, has been the target of hackers due to its high liquidity and value. Any software or devices that have wallets installed are susceptible to attacks. Many users owning crypto assets for investment or trading purposes often store their assets online, especially in exchanges. While physical wallets can be lost and stolen, it is still a safer option than keeping them on centralized exchanges and wallet applications. Users do not own the private keys in wallets created in the latter. Private keys act as a security code used to withdraw funds, and in the case of an exchange, they hold the keys for all of its users. Hackers can access all private keys if an exchange is compromised, thereby stealing the funds. Thus, keeping your private keys offline or in a hard copy is advisable, as even your computer is accessible by hackers.
Over the years, hackers have also thought of newer and innovative ways to steal the funds of innocent users. Email phishing attacks have been on the rise, and it works by sending the victims an email that allegedly comes from a service they are most familiar with. Hackers could send an email impersonating a company representative and seek the victim to disclose specific personal data, sometimes even private keys. Therefore, it is essential to understand that an official representative will never ask for such information via email. To put it better, private keys are like your bank account’s PIN codes. No official bank representative will contact you for such information via email or phone.
Other methods, such as keyloggers, malware injection, fake browser extensions, fake advertisements, and even two-factor authentication bypassing, have been used by highly experienced hackers. Thus, the simplest way is to store your private keys offline or on a piece of paper and double-check the authenticity of the website that you are accessing. If ample precautionary measures are made, it will significantly reduce the chances of a hacker’s attack.
But can we defeat the hackers?
No guaranteed solutions can stop hackers from infiltrating systems and committing the crimes mentioned above. Fortunately, many blockchain and cryptocurrency enterprises are addressing the issue. A growing number of exchanges and wallet applications have assured their customers with insurance if an attack may occur on their systems. In addition, there are some definitive ways of improving the overall architectural security. Nevertheless, developers and users both play a massive part in this case. Some examples include stringent auditing of blockchain protocol codes before the product launch and frequent bug bounties to detect vulnerabilities in the system. Companies are also looking into partnering with blockchain analytics, such as Elliptic and Chainalysis, to see abnormal activities quickly. Users can play their part in staying vigilant in their online activities and inputs, keeping their private keys private and not sharing them with anyone else. For added protection, they could deploy various tools to ensure complete anonymity with the best Bitcoin mixers to make their cryptocurrency transactions untraceable from bad actors.
Securing your investments
Cryptocurrencies are the new form of asset classes, which are increasingly viewed as favorable investments, as many people have moved from traditional investments like real estate and gold. However, with the ease of transaction comes the risk of cyberattacks that could potentially cost users their crypto funds. As mentioned in earlier paragraphs, it is necessary to use legitimate two-factor authentication services such as Google Authenticator and other services like email verification or Bitcoin mixing to significantly reduce attacks by hackers and malware.
Blockchain and cryptocurrency enterprises such as exchanges have also acknowledged the issue. They are mitigating the risks of users by executing various measures and, especially, warranties such as insurance funds for their users. Cryptocurrency experts are sure that although crypto-related crimes will not disappear tomorrow, hackers will become less of a threat if users and enterprises regard the matter seriously, making cryptocurrencies increasingly secure.
