Hackers loot 14% of big digital currencies
Cryptocurrency thefts cost companies and governments billions, experts say.
Digital currencies and the software developed to track them have become attractive targets for cybercriminals while also creating a lucrative new market for computer-security firms.
In less than a decade, hackers have stolen $1.2 billion worth of bitcoin and rival currency ether, said Lex Sokolin, global director of fintech strategy at Autonomous Research. Given the currencies’ explosive surge at the end of 2017, the cost in today’s money is much higher.
“It looks like crypto hacking is a $200-million annual revenue industry,” Sokolin said. Hackers have compromised more than 14% of the bitcoin and ether supply, he said.
All told, hacks involving cryptocurrencies like bitcoin have cost companies and governments $11.3 billion through lost potential tax revenue from coin sales and illegitimate transactions, said Susan Eustis, chief executive of WinterGreen Research. The blockchain ecosystem — the decentralized “distributed ledgers” that track crypto transactions — is also vulnerable.
Those losses could snowball as more companies and investors rush into the white-hot cryptocurrency market without weighing the dangers or taking steps to protect themselves.
Blockchain records are shared, making them hard to alter, so some users see them as super secure. But in many ways, they are no safer than any other software, said Matt Suiche, who runs the blockchain security company Comae Technologies.
And because the market is immature, blockchains may even be more vulnerable than other software. There are thousands of them, each with its own bugs.
Until the field is winnowed to a few favorites, as happened with web browsers, securing them all will be a challenge.
“Each implementation is going to have its own problems,” Suiche said. “The more implementations, the harder it is to cover all of them.”
Blockchains can track identity information, property records and even digital car keys, not just cryptocurrency.
But of course, they do that too, and stolen bitcoins can be converted into hard cash.
So although hacking a blockchain may be harder than breaking into a retailer’s database, “the rewards are greater,” said Andras Cser, an analyst at Forrester Research. “You have much more information you can steal.”
Many blockchains started as forks that diverged from existing crypto ledgers, and as Taiwanese security researchers have pointed out, every fork gives hackers a new way to try to falsify data.
In a Dec. 25 paper, researchers at the Institute of Electrical and Electronics Engineers outlined ways hackers can spend the same bitcoins twice, the very thing blockchains are meant to prevent.
In a balance attack, for instance, hackers delay network communications between subgroups of miners, whose computers verify blockchain transactions, to allow for double spending.
“We have no evidence that such attacks have already been performed on bitcoin,” the IEEE researchers said. “However, we believe that some of the important characteristics of bitcoin make these attacks practical and potentially highly disruptive.”
A researcher from Cisco Talos, a security group, found vulnerabilities in Ethereum clients, including a bug that “can lead to the leak of sensitive data about existing accounts.” A security hole in the Parity wallet resulted in losses of $155 million in November.
In December, Youbit, an exchange in South Korea, said it would file for bankruptcy after an attack in which it lost 17% of its assets. The same month, mining service NiceHash said hackers stole as much as $63 million in bitcoin from its virtual wallet.
Smart contracts — blockchain-based programs that automate asset transfers — also are vulnerable. In 2016, hackers stole at least $50 million out of the DAO, a venture-capital smart contract. Only an update to Ethereum enabled users to get their money back.
Programmers’ oldschool mind-sets are partly to blame for the technology’s flaws.
“When you have a bug, you release a patch,” Richard Ma, co-founder of Quantstamp, a company backed by venture capital firm Y Combinator Inc. “With a smart contract, you deploy it to the network, and it’s not possible to ever change it again.”
But Ma sees an opportunity. In March, Quantstamp will release an automated tool that scours smart contracts for bugs. Established security firms such as McAfee Inc. may also repurpose their wares for the blockchain crowd.
“In many cases, our existing products can help secure the ecosystem,” said Steve Grobman, chief technology officer of McAfee. “In general, it will be vulnerable to threats just like any other software system.”
The market for software, services and hardware to secure blockchain activity should grow to $355 billion as the digital economy moves to cybercurrency and banks and the financial community totally restructure, WinterGreen said. It was $259 million in 2017.