The anatomy of attacking a crypto exchange
There is a famous quote associated with Willie Sutton, a famous 20th century American bank robber. When he was asked why he robbed banks, he simply answered: “Because that’s where the money is.”
This simple and obvious truth holds today as well; however, bank robbers of our age are typically armed with a laptop, internet connection and various malware and hacking tools.
While the whole ecosystem around banking cybercrime is very active and prosperous for more than a decade, many cybercriminals have shifted their efforts to cryptocurrency. This is not surprising, as nowadays, stealing cryptocurrency is considered the perfect crime.
When looking at the cryptocurrency ecosystem, it’s fairly easy to understand why crypto exchanges are so heavily targeted:
- Because of their need for liquidity, exchanges hold large amounts of cryptocurrencies. For example, the top 5 Bitcoin addresses belong to exchanges.
- There are constant and frequent money movements and transactions, either between different cryptocurrencies or crypto/fiat transactions.
- The majority of exchanges are fairly small businesses that are (or were) start-up companies, with less resources to invest in cybersecurity.
- Cash out of stolen cryptocurrency is far easier than cash out of fiat money through the traditional banking system.
In this blog, we will dive deeper into some of the most common vectors for attacking a crypto exchange. This is by far not a definitive guide aiming to cover all — but focus mostly on the low hanging fruits that are presently targeted by fraudsters. In the end, this kind of cybercrime is driven by economics, and fraudsters will always go after the path of least resistance.
Types of Attacks
In general, the common crypto exchange is a web service, similar in that sense to a typical online banking application (this is not the case with decentralized exchanges, which are not going to be discussed in this blog post). Attacks can roughly be divided between client-side attacks to server-side attacks. Server-side attacks are typically harder to pull off — however, if successful, can result in much higher gains.
Server-side attacks
Server-side attacks directly target the exchange web service and its underlying infrastructure. They can come in multiple forms, and often result in considerable losses to the exchange, up to bankruptcy.
Typically, a server-side attack will begin with a targeted attack to infiltrate the exchange itself. This can be accomplished using various means, such as a spear phishing campaign targeted at the exchange employees in order to deploy malware in the internal network. This is exactly how Bitstamp got hacked in 2015. Other ways to penetrate exchange systems include exploitation of known software vulnerabilities and even using insiders.
Once the exchange internal network is breached, there are various attack vectors on the exchange systems with a single goal: move as much money as possible from the exchange wallets to the fraudsters’ addresses. In most cases publicly disclosed so far, this was accomplished by the compromise of private keys of the respective wallets, or by gaining access to the private key(s) of large wallets. A few notable examples include BitFloor, BitStamp and Coincheck. Some of these attacks resulted in huge losses, as the notion of keeping most funds in cold wallets wasn’t always implemented by some of the exchanges.
In other cases, software vulnerabilities within the exchange systems are discovered and leveraged to maliciously transfer funds between accounts. For example, Poloniex was hacked due to a bug in its software, allowing transactions to be processed irrespective of the account balance under certain conditions. Another notable example includes Bitfinex, that used a radically different approach to manage customers’ funds: instead of comingling all funds in a co-wallet strategy, Bitfinex partnered with BitGo, and created a multi-sig wallet for each of their customers. Each such wallet was protected by 3 signing keys, 2 held at Bitfinex and one at BitGo, where a transaction had to be approved by at least 2, and sometimes even 3 signatures. While the full incident report was not disclosed, it is probable that a software bug was exploited, getting malicious transaction signed only by compromising Bitfinex servers (BitGo declared that their servers were not breached during this incident).
Client-side attacks
Client-side attacks are focused on the customer using the exchange, targeting the vulnerabilities of humans and their endpoint devices used for trading. While end-user devices are significantly easier to compromise than servers, gaining a significant sum requires attacking many clients; this is usually done via social engineering attacks such as mass phishing campaigns with neatly crafted emails, used to siphon credentials or install malware on the device. Here it’s a big numbers game, and the “conversion rate” from email to compromise to fraud is an indicator of the skills of the fraudsters and the effectiveness of the attack.
Client-side attacks come in forms similar to what we’ve seen in the traditional banking space, such as compromise login information by phishing or pharming sites. More advanced attacks involve deploying malware such as the infamous Man in the Browser (MitB) malware category, used against online banking users since the mid-2000’s.
Phishing and pharming attacks are typically at the low end of the spectrum from technical know-how and tools perspective, and concentrate on redirecting users to malicious web sites, which in turn siphon sensitive credentials (typically static credentials) from the user that are used to login and authorize operations in the exchange. Then, the fraudster can use the credentials to log in on behalf of the user and move funds to his/her account.
Many exchanges counter these threats by using various multi-factor authentication methods.
Malware attacks represent the higher end of the spectrum, concentrating on various ways of tricking users into initiating transactions to bad addresses or replacing the destination addresses for originally legitimate transactions. Here are two interesting examples:
1. Clipboard hijacking malware: this malware exploits the long, hard to type and to remember addresses used in crypto; typically these addresses are copy-pasted using the clipboard to execute transactions. Once this malware identifies a Bitcoin address in the clipboard, it simply replaces it with one of the fraudster’s addresses. Many users will never notice they copy a different address… This is an attack vector which isn’t tied to a specific exchange, however, the exchange is likely to take the heat and experience a lot of friction if a user of theirs copied the wrong addresses without noticing. See this article for a nice analysis of such malware.
2. MitB malware: these powerful malware variants specialize in injecting malicious code into common web browsers, thereby gaining the ability to completely control the browser and all content flowing to/from the targeted website. So, credentials, one-time passwords, account balances, etc. are easily compromised and in addition — the malware can also tamper with website content using injection of custom code to the website pages presented to the user, creating very effective social engineering scams (all of this while the user is connected to a website that looks perfectly secure, with the correct URL, lock icon etc.). While MitB was mainly targeting traditional banks, it is now successfully applied against exchanges and other cryptocurrency web applications. See here for a detailed analysis of the TrickBot MitB malware and how it’s being used for stealing bitcoins.
As mentioned, these are just two examples, and there are other types of malware strains leveraged for cryptocurrency theft.
The Attacks that Make the Headlines
Most of the headlines about mega-breaches of the multi-million-dollars worth of crypto assets being compromised are the result of a successful server-side attack carried out on the exchange, getting directly to its infrastructure and to the immense amount of crypto money stored in its wallets. Unfortunately, we’ve noticed many of these attacks over the years (and continue to see more), as many of the exchanges still lack the secure infrastructure, operations and processes to make this attack not attractive enough to pull off. This is in sharp contrast to the traditional online banking space, where a successful attack on the online bank’s system is very rare (but not impossible, as the SWIFT attacks demonstrate, see example), whereas client-side attacks by malware and phishing are very popular.
This calls for crypto exchanges to increase awareness for the risks and implement a strategy consisting of processes, tools and education (both to internal teams and end-users) to reduce and keep them low over time. Getting back to Sutton’s quote, institutions holding large amounts of money will always be targeted and suffer fraud — and crypto exchanges are not different.
This blog is part of a series about crypto exchanges security. For more about this topic, read here; for more thought leadership about cybersecurity at large, check out our company blog.
More about exchanges in this publication:
