A bitcoin automated teller machine (ATM) stands at the Coin Trader bitcoin retail store in Tokyo, Japan, on Wednesday, Aug. 30, 2017. Stock of Bitcoin, the best-known digital currency, has surged 358 percent this year. While staggering, lesser-known competitors have seen even bigger gains, such as the more than 4,000 percent increase for ethereum. Photographer: Tomohiro Ohsumi/Bloomberg via Getty Images
Bloomberg | Bloomberg | Getty Images
Two high-profile security breaches this week – including the biggest cryptocurrency theft in history – are raising questions on the safety of storing funds in a wallet on a crypto exchange.
A security incident at digital asset exchange Binance on Thursday affected some $6.3 billion in client assets, making it the largest crypto theft on record.
Earlier that day, prediction market platform Polymarket temporarily halted trading on its international exchange after a third-party data provider was hacked, resulting in at least $2.7 million being drained from users’ wallets. The company’s international platform operates on the Polygon blockchain.
Experts whom CNBC interviewed said the security incidents on the crypto exchanges aren’t surprising, especially in light of recent artificial intelligence hacking incidents.
Most of these experts even said that observers should expect more security incidents, at least in the near term, as that problem worsens.
Questions over the safety of users’ funds
“I think it’s extremely dangerous,” said Tyler Moore, a cybersecurity professor at the University of Tulsa who has followed the asset class for more than a decade. “I think you should be very wary of leaving any significant amount of funds in an exchange… there are no built-in protections for when these inevitable hacks take place.”
For instance, banking customers can rely on the Federal Deposit Insurance Corporation to insure deposits up to $250,000 per depositor, per insured bank, in the event of an institution’s failure.
There is no similar form of coverage available for funds lost from a cryptocurrency exchange, noted Moore.
Binance and Polymarket reassured users that they would make affected investors whole. That’s a sign that users should feel confident in crypto exchanges, according to Ido Ben-Natan, CEO of blockchain security company Blockaid.
“I actually think no users will lose any money,” he said. “Binance has said they’re going to cover everything… I actually don’t think it’s a bad idea for users to put money in these exchanges. These exchanges need to work really hard to make sure they don’t take another hit like this.”
Ben-Natan noted that while he thinks more hacks are likely as the cybersecurity landscape changes due to AI, he said it will only make the crypto industry stronger.
As a result, a crypto wallet could ultimately become a safer place to hold funds compared to other options, since the industry will have the experience of how to handle these attacks, Ben-Natan said.
Vulnerabilities on offshore platforms
A key point is that while Binance experienced a security incident on its offshore platform, its regulated, centralized U.S. exchange did not have a similar issue. The same was true of Polymarket’s domestic exchange.
U.S. regulated platforms Coinbase and Robinhood were also unaffected by the security breach on Binance, though shares of both fell on Friday in the aftermath.
Coinbase v. Robinhood 1-day.
In a Friday appearance on CNBC’s “Squawk on the Street,” the Commodity Futures Trading Commission — the federal regulator of derivatives — Chairman Michael Selig said that the offshore nature of these incidents was critical to note.
“They don’t have the same sorts of safeguards that we have in our financial markets,” he said. “We want to offer a federal option to these exchanges to come and register with the CFTC, and they would be subject to the same sorts of cybersecurity safeguards that we have in our markets today.”
Brett Falk, a professor and director of the Crypto and Society Lab at the University of Pennsylvania, said that U.S. regulations likely wouldn’t have stopped an incident like that of Binance on Thursday. That’s because the hack may have involved a compromised DevOps engineer’s laptop, Binance said in a post on X.
“Most of the regulation doesn’t touch the specific software stack you have to use to authenticate people,” Falk said.
In another social media post, BInance later said its investigation uncovered additional points of breach, though the company didn’t specify what they were.
A unique target in a changing landscape
Falk echoed the argument by Ben-Natan that individuals likely won’t face losses, and that it’s better for traders to leave funds with an exchange where they have the financial backing of a company rather than in a self-custody wallet where no one can refund their losses in the event of a hack.
Ben-Natan added that traders should feel secure based on how many incidents companies like his catch that don’t become news. That’s because the security technology often works and stops them before they become major incidents.
However, crypto may be a unique target for hackers in a changing cybersecurity landscape, these experts told CNBC. That’s because of how much liquidity individuals can quickly access in the event of a successful breach.
It’s why Ryan Kirkley, CEO of blockchain infrastructure company Global Settlement Network, thinks traders should be cautious leaving their funds in any wallet that’s not backed by insurance until financial companies upgrade their security infrastructure.
“I do not think there’s anything right now that is a common solution in the marketplace where your assets are truly safe,” Kirkley said.
“Unless you are dealing with a reputable and firm broker-dealer that provides an asset insurance, you are risking your assets putting them into any ecosystem today just simply because there’s so much unknown,” he added.
