Greatest Security Threats Facing Cryptocurrency Today
Cryptocurrency is at a crossroads. As the crypto industry matures, questions about the nature of the risks involved in virtual currency becomes more and more relevant. These concerns become more pertinent when one considers that most of these problems have existed since the beginning of cryptocurrency but ignored.
This article will look at the top security risks facing cryptocurrency today.
If we are to seriously talk about risks to crypto, we must start here. Market manipulation in the crypto world is a real thing. The question is not in proving it, but in determining if it is a fatal detriment to crypto.
The horrible truth about crypto is that it is a very small pool. Without the liquidity that more traditional markets have, every single wake and disturbance will be felt. Imagine this: you have your eyes on a relatively unknown coin. You decide to buy a significant amount of the coin, which will raise the price up. You then go to social media and – with the help of a few like minds – start to spread a rumor that the coin is partnering up with a major industry name. The price shoots up. You sell out, deflating the price – which will continue deflating once the truth about the rumor is known.
Everyone that purchased based on the speculation is hit. The value of the coin is hit, making it prone to another manipulation cycle. You, on the other hand, make a healthy profit and – since the crypto market is not supervised or regulated – did it with little immediate threat of retribution.
According to a study published in the Wall Street Journal, these “pump and dump” schemes are not only common, but typically organized. Using services like Telegram and the industry’s reliance on social media to get crypto news, organized groups are identifying, inflating, and crashing cryptocurrencies to the tune of billions of dollars. In the first half of 2018 alone, these groups squeezed $825 million from the crypto market.
There is an open question of if this speculation is limited to the minor coins or if the big coins can be affected as well. The 2017 bitcoin spike, for example, is thought to be considered by some to be due to market manipulation under exchange Bitfinex. University of Texas finance professor John Griffin found that just 87 hours of heavy Tether trading is correlated to 50 percent of the bitcoin spike.
“By mapping the blockchains of Bitcoin and Tether, we are able to establish that entities associated with the Bitfinex exchange use Tether to purchase Bitcoin when prices are falling,” the report reads. “Such price supporting activities are successful, as Bitcoin prices rise following the periods of intervention. These effects are present only after negative returns and periods following the printing of Tether. Indeed, even less than 1% of extreme exchange of tether for Bitcoin has substantial aggregate price effects. The buying of Bitcoin with Tether also occurs more aggressively right below salient round-number price thresholds where the price support might be most effective. Negative EOM price pressure on Bitcoin only in months with large Tether issuance indicates a month-end need for dollar reserves related to Tether. Proxies for Tether demand receive little support in the data, but our results are consistent with the supply-driven manipulation hypothesis.”
“Overall, our findings provide substantial support for the view that price manipulation may be behind substantial distortive effects in cryptocurrencies. These findings suggest that external capital market surveillance and monitoring may be necessary to obtain a market that is truly free. More generally, our findings support the historical narrative that dubious activities are not just a by-product of price appreciation, but can substantially contribute to price distortions and capital misallocation.”
The situation is so acute that the New York State Attorney General is actively investigating it. “The New York State Office of the Attorney General (the ‘OAG’) launched the Virtual Markets Integrity Initiative to protect and inform New York residents who trade in virtual or ‘crypto’ currency,” the Attorney General’s report reads. “As a medium of exchange, an investment product, a technology, and an emerging economic sector, virtual currency is complex and evolving rapidly. The OAG’s Initiative, however, proceeds from a fundamental principle: consumers and investors deserve to understand how their financial service providers operate, protect customer funds, and ensure the integrity of transactions.”
The report found:
- “Virtual asset trading platforms often engage in several lines of business that would be restricted or carefully monitored in a traditional trading environment. Platforms often serve (i) as venues of exchange, operating the platform on which buyers and sellers trade virtual and fiat currencies; (ii) in a role akin to a traditional broker-dealer, representing traders and executing trades on their behalf; (iii) as money-transmitters, transferring virtual and fiat currency and converting it from one form to another; (iv) as proprietary traders, buying and selling virtual currency for their own accounts, often on their own platforms; (v) as owners of large virtual currency holdings; and, in some cases, (vi) as issuers of a virtual currency listed on their own and other platforms, with a direct stake in its performance. Additionally, platform employees – who may have access to information about customer orders, new currency listings, and other non-public information – often hold virtual currency and trade on their own or competing platforms. Each role has a markedly different set of incentives, introducing substantial potential for conflicts between the interests of the platform, platform insiders, and platform customers.”
- “Though some virtual currency platforms have taken steps to police the fairness of their platforms and safeguard the integrity of their exchange, others have not. Platforms lack robust real-time and historical market surveillance capabilities, like those found in traditional trading venues, to identify and stop suspicious trading patterns. There is no mechanism for analyzing suspicious trading strategies across multiple platforms. Few platforms seriously restrict or even monitor the operation of “bots” or automated algorithmic trading on their venues. Indeed, certain trading platforms deny any responsibility for stopping traders from artificially affecting prices. Those factors, coupled with the concentration of virtual currency in the hands of a relatively small number of major traders, leave the platforms highly susceptible to abuse. Only a small number of platforms have taken meaningful steps to lessen those risks.”
- “Generally accepted methods for auditing virtual assets do not exist, and trading platforms lack a consistent and transparent approach to independently auditing the virtual currency purportedly in their possession; several do not claim to do any independent auditing of their virtual currency holdings at all. That makes it difficult or impossible to confirm whether platforms are responsibly holding their customers’ virtual assets as claimed. Customers are highly exposed in the event of a hack or unauthorized withdrawal. While domestic or foreign deposit insurance may compensate customers”
Here is the rub: the exchanges have no reason to want to stop any of this. While customer satisfaction is an interest to some exchanges, the profit motive has led others to literally laugh off the New York State’s Attorney General’s efforts. During the bitcoin spike, the exchanges made billions of dollars. “Pump and dump” manipulation increases daily volume, improving the exchanges’ bottom line. Without a regulatory party to force the exchanges to do the right thing, exchanges are not motivated to do the right thing.
The 2017 bitcoin spike almost brought down the entire market, with the repercussions still being felt. Another spike would likely collapse the entire ecosystem. For the crypto community, this represents a very sharp Sword of Damocles hanging over all our heads.
Bad Actors and the Question of Care
The notion that there are no referees on duty with crypto is a multifaceted problem. Since the 2014 Mt Gox hack, where the intermediary handling 70 percent of the world’s bitcoin exchanges at the time lost $473 million in bitcoin, the number of attacks of the bitcoin ecosystem has only increased.
The problem with this is that the ecosystem does not take the threat seriously. A critical look of the Mt Gox situation shows that there were clear warnings. In 2011, a hacker managed to hack into an auditor’s computer, transfer a large amount of bitcoin to himself, and sell them off – dropping the price to a penny. The net affect of the hack was more than $8,750,000. Mt Gox’s lax stewardship practices were so severe that the exchange was effectively locked out of the global financial market before the 2014 hack.
The Mt Gox hack happened because of a quirk of proof of work systems known as “transactional malleability.” As blockchains are unmalleable, if someone was able to change a transaction before it is recorded to the blockchain, the change and any effect due to the change would become permanent and ineligible for correction. In the case of Mt Gox, a hacker requested a transaction and changed the transaction’s signature so that the transactional hash changed and no longer matched the blockchain or to the sender’s transaction copy. The hacker claimed the transaction did not go through, there was no confirmation of the transaction being received, and the transaction was repeated.
The problem with the Mt Gox hack is that – even though the accused faced up to 55 years in prison if convicted – it was arguably worth it to the hacker. There was a more than fair chance he would get away with it, the laws that would be in play to prosecute him were weak, and the system itself would protect him. As, in crypto, the code is law, if the transaction was allowed by the blockchain, it is legal from the system’s point of view.
An example of this is the DAO hack. The DAO, or Decentralized Autonomous Organization, was a decentralized venture capital fund managed by smart contracts. The fund would provide funding for all decentralized applications developed in its ecosystem, with voting for projects to fund handled by ownership of the DAO token. The project was so popular that the fund had 14 percent of all issued Ethers at that point, with over $150 million raised in the crowdsale.
An odd feature of the DAO was the backdoor that was installed for those unhappy with the DAO’s choices. Should an investor not be happy with backing the dApp chosen by the collective, the investor could request his money back or channel his investment into a “child DAO” that could make its own decisions and solicit its own members. Coins transferred from the main DAO to a child can only be spent after a 28 days waiting period.
This is where human greed took over. Using a recursive function, a hacker requested a transfer of funds to a child DAO and forced the transaction to repeat before the transaction could be recorded to the blockchain. This resulted in $50 million in Ether being squirreled away in this child DAO, inaccessible for 28 days.
The funny thing is that there was a debate to the legitimacy of the action. Some took the position that the code is law, so the transfer was unethical, but technically correct. However, the Ethereum community ruled that a correction is needed to restore the Ethers. Those that rejected the hard fork formed Ethereum Classic and – on that copy of the blockchain – the hacker got his tokens.
In just the first six months of 2018, Japan alone lost $540 million in crypto hacks. The rate of hacks is growing beyond the point that the market can absorb them. Flatly, crypto is being hacked because it is so easy to hack the exchanges today; there have been no serious effort to make security a leading consideration. It is enough to accept that the cryptographical nature of crypto will save us, instead of recognizing it as a technology that has been largely surmounted.
Have it be the Bitfinex hack or any number of hacks that have happened since, the question of if crypto needs a referee or not has not gone away. While some would argue that the code is the referee, what must one do if the code itself is inadequate? Until this matter is resolved, a hack will undoubtedly happen again. The question is will the market be able to withstand it?
Human error is a factor of everyday life which is – arguably – unavoidable. In a system made by men that services men, the weight of human error should have a larger place than it does in crypto, where it is likely ignored.
“On August 2, 216 BC, the two largest armies in the civilized world stood face to face on an open plain near the mouth of what is now the Ofanto River on Italy’s east coast. The fate of the civilized world hung in the balance,” Risk Management Magazine wrote.
“The Romans held the better ground and had almost twice as many troops as their adversary. Nearly 80,000 armed men stood in three bristling lines of attack. Opposing the Roman juggernaut was a far weaker adversary in an inferior tactical position. With the river on one side and the ocean to the rear, an estimated 49,000 Carthaginian forces—mostly mercenaries who did not even speak a common language—prepared for what appeared to be a crushing defeat from the Roman sledgehammer.”
“But the Carthaginian general Hannibal Barca knew his adversary, a hot-headed Roman general named Varro, and through a series of maneuvers designed to embarrass his rival, he drew the entire Roman center into an unwise advance.”
“Less than four hours later, nearly 60,000 Roman soldiers lay dead or dying on the ground near the village of Cannae. They were the victims of poor decisions born of the common human errors: ego and anger. Perhaps even more important than the errors committed is the fact that the Carthaginian commander predicted and induced these errors to defeat a far superior force on unfavorable terrain.”
“Therein lies the lesson for today. In 216 BC, Hannibal was one of the few leaders in the world who understood the intricacies of human error and how to leverage them to his advantage. Today, that information is becoming available to all. Over the past two decades, human error research has expanded exponentially. The causes and effects of error have been studied and codified. The next step is behavioral change for all—individuals, team players and leaders. Human error is no longer the shadowy, ill-defined foe it once was, yet few have utilized the new discoveries to strategically attack error as a part of an enterprise risk management system.”
People make mistakes and any system made by people will inherit the capability of being error-prone. With crypto, however, a culture has developed not to acknowledge these errors. Due to this, large loopholes tend to persist where hackers and other bad actors can attack.
“Given the intangible nature of the asset class, human error and something as confounding as password amnesia can spell total loss of a crypto fortune,” Forbes report. “Not everyone is as lucky as 50 Cent, who forgot he accepted bitcoin for an album release and discovered an $8 million bitcoin bounty. The prospect of being locked out, losing hardware or facing ‘geophysical risks,’ such as spilled coffee is often enough to create losses – not to mention the ever present risk of buyer’s remorse given cryptocurrency price volatility. At the crypto whale end of the market, the high-profile nature and public quality of large asset holders may expose people to direct physical security threats, such as kidnaping, ransom and extortion. A fleet of lambos will not add to the needed discretion of not becoming a potential target.”
While forgetfulness on a local level only means losing your own personal stake, it will only take a few whales losing access to their wallets to crash a crypto. Even though a crypto can survive with the vast majority of its coins unavailable, the lack of trust would mean a collapse of the ecosystem and community.
Unsafe Havens and the Question of Regulations
Many small nations have embraced the economic miracle of crypto. For impoverished states and for regions that have no other viable industry, crypto represents a way to get in on what seems to be the “industry of the future.”
Take Gibraltar, for example. The British oversea territory became the first jurisdiction to establish a fully functioning regulatory framework for distributed ledger operations. The hope is that Gibraltar will become a more desirable place to set up an ICO, in lieu of legislative and regulatory ambiguity in traditional technology hotbeds.
The problem is that no one is sure if these early attempts at regulation will work. It may turn out that the framework is grossly inadequate, or it may turn out that a technological advance requires a new round of regulation-soul searching. The point is that going first is not always best, and prototyping regulations may lead to a situation where the industry must suddenly adjust to large-scale buyer’s remorse.
“Another key risk with cryptocurrencies and this asset class more generally is the lack of coordination and clarity on regulatory, financial, tax and legal treatment.,” Forbes adds. “This is unsurprising given the relatively new nature of this market and the often slow moving and lagging quality of “regulatory catch up.” Indeed, most regulators around the world did not begin to form an opinion about cryptocurrencies until their rise to prominence with bitcoin’s meteoric appreciation in 2017. Suddenly, countries and jurisdictions around the world have entered a crypto land grab by seeking to become destinations of choice for prospective investors and projects. Like the global financial system, coordination and coherence can go a long way in eschewing risks of the systemic and mundane variety while improving overall market stability.”
In dealing with technological problems, there are questions on the best application of the technology, operational and application limitations, and the adherent risk of intrusion and intentional subversion.
“The 2014 Interpol Internet Organised Crime Threat (IOCTA) report noted that, since, ‘the takedown of the first E-Gold in 2009, and subsequently Liberty Reserve in 2013, has resulted in a growing level of distrust in centralised schemes as cyber criminals are increasingly adopting cryptocurrencies,” a report from BAE Systems reads. “Bitcoin is beginning to feature heavily in police investigations, particularly in cases of ransomware and extortion.’”
“Bitcoin-stealing malware has become a blood sport for both personal and corporate users. During preiods of rapid Bitcoin appreciation, there have been increases in new Bitcoin-stealing malware tools, with attacks most commonly aimed at Bitcoin wallets and the compromise of private keys. Other common malware hijacks computing resources for mining Bitcoins, which earn Bitcoins as payment, though the yield for that type of exploit appears to be on the decline.”
“Hacks like those at Mt Gox, Flexcoin and Sheep Marketplace have all resulted in the disappearance of Bitcoins valued in the hundreds of millions of dollars. In the case of Mt Gox, the exchange itself collapsed into insolvency, leaving creditors (including financial institutions) and account holders carrying the loss. In some cases, the precise beneficial ownership of the exchanges has been unclear, and in some circumstances the ‘hackers’ conducting the theft, and the ‘beneficial owners’ of the exchange being attacked, could be one and the same.”
A reality that is coming down the world is the proliferation of quantum computers. Crypto is considered secure because it is thought to be too expensive resource-wise to brute-force a hash using a binary computer. However, with a quantum computer with a decent qubit rating, a crypto hash can be broken in a matter of minutes, breaking the “hard to produce” tenet of crypto safety. Unless the hashing protocol is adapted to take in considering the significant increase in hashing power quantum computing will bring, a hacker with access to a quantum machine can undo a blockchain or can pervert an entire class of transactions in less time than it took to detect the intrusion in the first place.
“There have been many reports about the computational complexity and energy consumption of bitcoin mining, as one example of some of the technological limitations of cryptocurrencies.,” Forbes noted. “This computational complexity may also work in the inverse and pose potential risks to the asset class under the premise that complex systems fail in complex ways. It is true that the decentralized feature of true blockchain structures gives then an inherent disaster and risk-proofing that is not enjoyed by centralized databases (which are veritable honey pots as evidenced by Equifax’s massive breach). Yet not all cryptocurrencies or tokens are riding on similar rails. For this, investors should beware of the technological risks and false promises of decentralization that are being made in many projects, for not all blockchains are created equal.”
A Crypto Civil War
While it is unlikely that a cryptocurrency will ever have to compete with a fiat currency for dominance, a crypto civil war is more than likely.
“While much crypto wealth is concentrated in the hands of people who are thinking long term about the positive change this asset class can have on the world, there is nevertheless the constant specter of civil wars and forks, which can bifurcate the consensus on cryptocurrencies, thus eroding market share, valuation and adoption,” Forbes elaborate. “This standards war continues to flare up, including most recently with the advent of Bitcoin Cash. It is also notable that despite the talk amongst crypto-utopians of a world ruled by blind scalable trust and no centralized authorities, that councils of large crypto holders, much like a papal conclave or the Bank for International Settlements (BIS), can set a course on the market influencing outcomes and price fluctuations. As with the real movement of whales, smaller fry can either get gobbled up or caught in the wake.”
With large crypto assets, like bitcoin, the whales rule. While it is one node, one vote, the major stakeholders have significant sway over what proposals are offer. So, say Litecoin wished to pursue several proposals to make it competitive to bitcoin or bitcoin cash. If the same major stakeholders that hold significant stakes in Litecoin also hold significant holdings in bitcoin cash, they may choose to ignore bitcoin cash proposals that would preserve the coin’s market position. This is despite most bitcoin cash nodes wanting these proposals.
This de facto plutarchy would break consensus for that crypto. As all coins that utilize consensus are potentially prone to this, it is important that ways to protect decentralization are actively explored and discussed.
Tethers to Fiat Currency and Other Entanglements
This one is possibly the most important threat. When bitcoin was introduced, it was with the intentions of making a virtual currency free of the entanglements of the banking system.
“Commerce on the Internet has come to rely almost exclusively on financial institutions serving as trusted third parties to process electronic payments,” Satoshi Nakamoto wrote in his whitepaper. “While the system works well enough for most transactions, it still suffers from the inherent weaknesses of the trust based model. Completely non-reversible transactions are not really possible, since financial institutions cannot avoid mediating disputes. The cost of mediation increases transaction costs, limiting the minimum practical transaction size and cutting off the possibility for small casual transactions, and there is a broader cost in the loss of ability to make non-reversible payments for non-reversible services. With the possibility of reversal, the need for trust spreads. Merchants must be wary of their customers, hassling them for more information than they would otherwise need. A certain percentage of fraud is accepted as unavoidable. These costs and payment uncertainties can be avoided in person by using physical currency, but no mechanism exists to make payments over a communications channel without a trusted party.”
“What is needed is an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party. Transactions that are computationally impractical to reverse would protect sellers from fraud, and routine escrow mechanisms could easily be implemented to protect buyers.”
The original idea for cryptocurrencies were a siloed payment system separated and isolated from the fiat monetary systems so that they can offer a relief from the seemingly nationalistic money politics such systems could embody.
Unfortunately, that separation today is more of an idea than a reality. With coins available that is tethered to the price of fiat currency, coin derivatives traded on the traditional commodities market, and financial brokers offering crypto as portfolio items, the separation between fiat and crypto is quickly closing. This is a problem, as there is now a clear correlation between crypto and the strength of the dollar and crypto is no longer capable of responding to market downturns. Without the ability to “spike when the dollar dips,” crypto loses its value in monetary modulation.
This gives many valid reasons to ask why bother with crypto at all if it can’t do this most basic thing? This is a fair question and may determine the future fate of cryptocurrency.
All of this is not meant to scare you, but to educate you. There are serious boogeymen haunting cryptocurrency and the industry cannot survive unless they are recognized, discussed, and dealt with. If the crypto industry is to survive, these challenges must be met and not ignored.