Beware of bitcoin exchanges

There have been several major hacks so it’s best to check what security systems they have in place

The high-risk nature of investing in cryptocurrency is a well-expressed concern. But there’s another part of cryptoinvesting that is less often scrutinised and can be equally treacherous — the exchanges on which cryptocurrencies are traded.

Many have fallen from grace, typically because of hacking attacks.

In December last year, a bitcoin exchange in South Korea, Youbit, filed for bankruptcy after it was hacked for the second time and cyber criminals yet again got away with a sizeable sum of its clients’ digital currency holdings. Youbit reportedly promised customers they would get back about three-quarters of the value of the digital currencies they had stored in accounts with the exchange and the rest would be refunded after bankruptcy proceedings.

In 2014, Mt Gox, the largest bitcoin exchange in the world at the time, filed for bankruptcy after a hack, which saw a reported 24000 customers lose hundreds of millions of dollars in cryptocurrencies and cash. Four years and many lawsuits later, the prospects of investors ever being compensated appear to be slight.

But the victim of the largest cryptocurrency hacking to date, Japanese exchange Coincheck, compensated clients from its own capital after losing $500-million in virtual currency when it was hacked in January this year.

Cryptocurrency exchanges are online platforms that allow customers to exchange a cryptocurrency for another cryptocurrency or to buy cryptocurrencies using hard currency, often referred to as fiat in crypto circles. The exchanges can operate in several ways. (See “What there is to know about exchanges”)

How secure are exchanges?

A big problem is security and customers need to be assured their money is in safe hands, says Luno chief technology officer, Timothy Stranex. “Without the trust of clients, you don’t have a business.”

Luno is the most popular digital currency platform in South Africa and processes the majority of cryptocurrency exchanges. It is also one of the world’s leading digital currency companies, with more than 1.6-million customers in 40 countries on three continents.

Luno originated with the building of the first fully integrated bitcoin pilot system for a major multinational bank in 2013. “This means we have been very compliance- and security- focused from day one, working very closely with financial services compliance teams and regulators. This ultimately means a safer and more reliable digital currency experience,” Stranex says.

“Unlike traditional financial companies, Luno’s technology forms a core competency of the company. It has been built from the ground up using modern techniques, [and with] a strong focus on security, and leverages Amazon web service’s cloud, whose data centre and network architecture meet the requirements of security-sensitive organisations like Luno,” he says.

Although the exchanges are not regulated in any of the countries in which Luno operates, it says it took the decision to regulate itself, taking guidance from existing financial regulations and working closely with governments, banks, regulators and financial institutions globally to create the appropriate regulatory frameworks to operate in.

“We have put in place very advanced know-your-customer, antimoney laundering and anti-terror financing measures to mitigate risks and respond to threats and suspicious activity,” Stranex says.

He would welcome industry regulation if it had a positive effect.

Sonya Kuhnel, the managing director of the Blockchain Academy, which provides training and consultancy in crypto and blockchain, says the hacking of world’s largest exchanges and the loss of millions of its users has exposed many security flaws and vulnerabilities.

The private keys of user wallets in these exchanges are stored in the companies’ centralised servers and can be compromised. But the next generation of cryptocurrency exchanges have been decentralised, which allow users to trade cryptocurrencies while remaining in full control of their funds, she says.

Most of the large exchanges store the majority of their user funds in cold wallets or digital currency wallets, which are not connected to the internet. If all the user funds were kept in cold wallets it would take too long to process withdrawals, Kuhnel says.

Storing cryptocurrency in a hardware wallet, which is a physical device similar to a USB flash drive and is not connected to the internet, is a safe way to store cryptocurrency. “Only when the hardware wallet is plugged into a computer can the currency be accessed. Users should not store too much cryptocurrency in an online exchange and should move it into a hardware wallet as soon as possible,” she says.

Although hacking is the current concern, there is also a long-held fear that, if the bitcoin bubble bursts, exchanges won’t be able to keep up with alarmed investors rushing to cash in their cryptocurrencies and will fold.

Stranex says Luno does not buy or sell bitcoin; it merely provides a platform for buyers and sellers to meet and transact. “Thus if the demand of bitcoin totally collapses at a global level there would probably be a collapse in prices and people will only be able to get back what willing sellers or buyers are willing to transact at, which could be zero in a worstcase situation,” he says.

Luno holds customers’ “normal” money deposits in segregated safeguarding accounts — the bank keeps the money safe. “We are not allowed to use these funds for corporate activity [such as paying staff salaries], so even in the highly unlikely case that Luno would go bankrupt, the customer funds would be safe and protected. As such, the customers can rest assured that the money they see in their wallet is kept safe,” he says.

As far as customers’ virtual currency holdings are concerned, for somebody to be able to sell their bitcoin, there must be another person willing to buy it, Stranex says. “Even if there isn’t sufficient liquidity on our own exchanges, we are connected to other global exchanges and we can potentially bring in that liquidity to ensure that customers will always be in a secure position to sell their holdings. We also allow anyone to transfer their bitcoin holdings to another wallet.”

But he expresses Luno’s firm belief in the long-term sustainability of cryptocurrencies.

The price of bitcoin peaked at more than $19 000 a bitcoin in December last year but fell to $6 800 in April, a 65% plunge, which analysts at the Bank of America Merrill Lynch posit was the bursting of the bubble. Bitcoin was trading at $7 500 this week.