This week, two high-profile security incidents – including the largest cryptocurrency theft in history – have raised doubts about the security of keeping funds in wallets on cryptocurrency exchanges.
A security incident that occurred on Thursday at the digital asset exchange Binance ( Binance ) affected approximately $6.3 billion in customer assets, making it the largest cryptocurrency theft case on record.
Earlier on the same day, the predictive market platform Polymarket temporarily halted trading on its international exchange after a third-party data provider was hacked, resulting in at least $2.7 million being transferred from users' wallets. The company's international platform operates on the Polygon blockchain.
The expert interviewed by CNBC stated that with the recent increase in artificial intelligence-related hacking incidents, it is not surprising that crypto exchanges are encountering such security issues.
Most of these experts even stated that observers should expect more security incidents in the future, at least in the short term, as this issue is worsening.
Questions arise regarding the security of users' funds
"I think this is extremely dangerous," said Tyler Moore, a professor of cybersecurity at Tulsa University (University of Tulsa). He has been researching this class of assets for over a decade. "I think you should be very cautious and not leave any large amounts of money on the exchanges... When these inevitable hacker attacks occur, there are no built-in protective measures."
For example, in the event of a bank's closure, bank customers can rely on the Federal Deposit Insurance Corporation ( FDIC ) to provide insurance for deposits up to $250,000 per depositor and per insured bank.
Moore points out that there is no similar protection for funds lost in cryptocurrency exchanges.
Both Binance and Polymarket assure users that they will provide full compensation to the affected investors. Blockaid, a blockchain security company, and its CEO Ido Ben - Natan believe that this indicates that users should have confidence in crypto exchanges.
“I actually don’t think any users will lose their funds,” he said. “Binance has already stated that they will bear all the losses… I really don’t think it’s a good idea for users to put their money in these exchanges. These exchanges need to make a great effort to ensure that they don’t suffer similar blows again.”
Ben-Natan pointed out that although he believes more hacker attacks are likely to occur as artificial intelligence changes the landscape of network security, he stated that this will only make the crypto industry stronger.
Therefore, he believes that, compared to other options, encrypted wallets may ultimately become a safer place to store funds, as the industry will accumulate experience in dealing with such attacks.
Vulnerabilities in offshore platforms
One key point is that the security incident that Binance encountered was on its offshore platform, while its regulated centralized exchange in the United States did not experience similar problems. The same is true for Binance’s domestic exchange in the US, which is marked with Polymarket.
Platforms regulated by the United States, Coinbase and Robinhood, were not affected by this security vulnerability at Binance either; however, the stock prices of both companies fell on Friday following the incident.
The chairman of the Commodity Futures Trading Commission (CFTC) of the United States, Michael Selig, stated on Friday in the program Squawk on the Street that the offshore nature of these events deserves special attention.
“They don’t have the same safeguards that we have in our financial markets,” he said. “We hope to provide a federal-level option for these exchanges, allowing them to register with CFTC and to adopt the same cybersecurity safeguards as those in our current markets.”
A professor and director at the University of Pennsylvania Crypto and Society Lab Brett Falk said that it is very likely that U.S. regulators will not be able to prevent incidents like the one involving Binance on Thursday. The reason is that Binance posted on X stating that this hacker attack may involve the intrusion into the laptop of a DevOps engineer.
“Most regulations do not touch on the specific software stack you use for identity verification,” says Falk.
Anbin later stated in another social media post that its investigation revealed more entry points for the intrusion, but the company did not specify what they were.
In a changing environment, a unique target for attack
Falk agrees with Ben-Natan's view that individual investors are unlikely to suffer losses. Moreover, rather than keeping their funds in a self-hosted wallet that has no one to compensate for losses in the event of a hacker attack, it is better to keep them in an exchange that has the financial support of a company.
Ben-Natan added that traders should feel confident about their companies' security capabilities, as many incidents that are intercepted by them do not make it into the news. The reason is that security technologies are indeed effective and can prevent incidents from escalating into major accidents.
However, these experts told CNBC, in the constantly changing cybersecurity environment, cryptocurrencies may become a unique target for hackers. The reason is that once an intrusion is successful, individuals can quickly obtain a large amount of liquid assets.
This is also why Global Settlement Network, the CEO of a blockchain infrastructure company, believes that before financial companies upgrade their security infrastructure, traders should be cautious about keeping their funds in wallets that do not have insurance coverage.
“I don’t think there is any commonly available solution on the market at present that can truly secure your assets,” said Kirkley.
“Unless you are cooperating with a reputable and stable brokerage firm that provides asset insurance, there is always risk in putting your assets into any ecosystem today, as there are simply too many unknown factors,” he added.
