(Rejected) Dangerously Unsafe Cryptocurrency Exchanges Expose $18 Million For Anyone to Steal

According to a new report recently published by CyberNews, a famous cybersecurity research publication, over $18 million in cryptocurrency has been exposed to theft in crypto exchanges with very poor cybersecurity. This makes it possible for anybody with modest technical skills to change or steal balance.

Cryptocurrency has been rapidly gaining the public eye for a few years now, with Bitcoin increasing its popularity and massive valuation. Cryptocurrency marketplaces are being opened around the globe to meet the demand. 

So, in a rush to make money, the newer or smaller exchanges may leave security behind giving it a second thought.  This is exactly what CryptoNews found out.  Its research indicates that several cryptocurrency marketplaces are dangerously unsafe.

Cybersecurity Blind Spot

In an attempt to analyze many crypto marketplaces, where people can trade various cryptocurrencies, CyberNews publication identified “dangerously unsafe” security practices in two cryptocurrency exchanges (Lykke and Hub dex).

Lykke, a swiss cryptocurrency marketplace, had exposed API keys on a publicly accessible database, which could be used to directly access the database of the crypto exchange and perform trades, deposits, withdrawals, and exchanges, enabling a malicious party to interfere with other users’ trades or transfer cryptocurrency to their own account.

Lykke was also identified to have the private keys of clients exposed – mainly passwords for crypto wallets – which would enable anyone to trade, spend or transfer users’ cryptocurrency without their knowledge.

Moreover, some clients make use of multi-sig wallets, which require a minimum of two authorization to enable funds to be spent. But Lykke’s database also exposed the private keys and the redeem scripts to these wallets – either of which would enable a malicious actor to steal customers’ crypto funds.

In its report, CyberNews said: “Having this information allows us direct access to these users’ funds, meaning the full ability to steal those funds or manipulate any data we choose.”

CyberNews contacted Lykke about the matter, and had an immediate response, with the Swiss crypto marketplace taking swift action to make the database private and inform affected clients.  

Lykke told CyberNews that: “No personal data was exposed and no funds lost. However, we have done a thorough process review and a proper incident post-mortem to avoid such situations in future.”

CyberNews also discovered similar security concerns with Hub dex, a Chinese cryptocurrency marketplace with 1.1 million customers’ private keys left exposed on the exchange’s database, including the ability to change the password hash, thus enabling a malicious actor to log into the account of their choice. The crypto exchange has also left multi-sig wallet keys and API keys exposed, thus giving criminals various ways of stealing customers’ funds.

CyberNews said: “The amount of data we stumbled across is quite staggering and significant. Instead of providing users with security and anonymity, these unsecured platforms have exposed their users, not only to getting their data stolen, but also their investment.”

CyberNews attempted to contact Hub dex but found out that their email address was not functioning and other attempts proved unsuccessful. CyberNews eventually contacted China’s CERT, the non-governmental organization that deals with handling cybersecurity issues in the nation, which led to Hub dex’s database taken offline.

Now there are nearly 19,000 cryptocurrency marketplaces across the world. Although users are assured their currencies and data are safe within them, this research shows that it may not always be the case. According to CyberNews, when consumers place their money on crypto exchanges, hoping to sell and buy various crypto assets, they are putting their faith into the exchanges to offer the utmost anonymity and security. After all, this is what cryptocurrencies are known for. But the opposite is true. CryptoNews was not only able to see customers’ private information and account balances but also had the ability to manipulate or steal millions of dollars in such exchanges. Customers’ personal data are not anonymous (by leaking KYC data) and this, therefore, implies that their exchanges can be traced and they also stand to lose their money. This represents a huge betrayal of users’ privacy and security.

Crypto Exchanges Must Reinvent Themselves to Stay Relevant

Several crypto marketplaces have shut down their operations because of various reasons. For instance, several exchanges have found themselves having little business to sustain the cost of staying open. Other marketplaces have closed due to lack of meeting regulatory requirements. However, crypto marketplaces are not going away. There is always an adequate number of marketplaces to deal with the demand of the industry for a long time to come. To better serve customers, crypto exchanges will have to reinvent themselves more than just acting as trading venues. They must provide cryptocurrency value-added services to give customers what they need. If this is not done, then many exchanges will eventually face extinction.