Why You Should Understand the Challenges of Storing Your Cryptocurrency

Sep 8, 2020 | Blog

Why You Should Understand the Challenges of Storing Your Cryptocurrency

Guest Blog By: Andrew Rossow, Esq.

Even more than a decade into the evolution of blockchain, cybersecurity remains one of the most pressing concerns as we continue to twiddle our thumbs amidst the COVID-19 pandemic.

Across the entire blockchain sector, cryptocurrency users have lost a combined total of over $13 billion in over 290 separate hacks, according to Slowmist, a security firm which tracks similar attacks and associated losses across the entire blockchain sector.

While smart contract vulnerabilities and 51% attacks account for some of these losses, the biggest targets by far are exchanges and wallets. Malicious parties have made off with no less than $11 billion worth of crypto over the years.

Exchanges are a well-known point of weakness for the cryptocurrency community. Since the now-infamous Mt. Gox attack in 2014, exchange hacks have become an almost regular occurrence, as hackers grow ever-more sophisticated in their attempts to wrest control of exchange wallets.

Earlier this year, security firm Chainalysis outlined how Lazarus Group, a cybercrime syndicate with links to the North Korean government, had staged an elaborate phishing attack on Singaporean exchange DragonEx.

The group went as far as creating a website and social media profiles for a fake company purporting to sell trading bots. Representatives managed to convince a DragonEx employee to install the “bot,” which was actually malware, on a company computer. From there, it was easy enough for them to steal the private keys for the exchange’s wallet.

The all-too-common nature of exchange attacks is one reason that most crypto users advocate keeping funds on your own wallet. However, as the stats from Slowmist show, this isn’t necessarily any more secure. In fact, over half of all stolen crypto came from attacks on wallets.

Vulnerabilities with Hot and Cold Wallets

Online hot wallets generally offer a superior user experience to cold storage, and for frequent transactions, they’re far less cumbersome than cold hardware wallets. For a full explanation between the two, you can read my 2018 Forbes article “What Dr. Seuss Can Teach Us About Bringing Cybersecurity onto the Blockchain.”

At that time, MyEtherWallet users found that their connections to the MyEtherWallet website were intercepted and redirected to another URL–only to discover the cause resulted from a domain name server attack, according to a previous CoinTelegraph report. As soon as users logged into what they believed to be the legitimate website, the funds in their wallet accounts were immediately hijacked and sent to an unknown address (obviously not theirs and without their consent).

Point being, the very nature of hot wallets, as an online means of storage, makes them more vulnerable to attacks, which is why (and despite their inconvenience) most experienced crypto users advocate the use of cold wallets. Common wisdom dictates that if the wallet isn’t connected to the internet, it’s more secure against attackers.

Nevertheless, hardware wallets are not infallible. In 2018, a 15-year old researcher managed to find a critical security vulnerability in Ledger’s Nano S wallet, an extremely popular device. The researcher found that it would be possible for a bad actor to interfere with the wallet’s firmware while it’s still moving through the supply chain, before it even arrives with the customer.

The vulnerability means that someone could change the recovery seed, meaning they could access any digital assets stored on the device.

Trezor wallets, the biggest rival to Ledger’s consumer hardware wallets, have also been exposed as insecure. As the coronavirus began to reveal itself back in January of this year, security researchers at Kraken around the same time, found a way to extract recovery seeds from two of Trezor’s devices.

Is There Any Hope for Crypto Security?

Exchanges are starting to realize that perhaps the same wallets used by everyday crypto enthusiasts aren’t necessarily as robust as what’s needed for storing millions of dollars worth of digital assets.

Advances in secure multi-party computation mean that exchanges now have access to superior technology for safeguarding digital assets. Private keys can be split into separate portions, encrypted, and distributed among different parties or servers to remove the single point of weakness. A service such as Curv offers institutional-grade sMPC wallets, meaning signed when all parties come together with their respective encrypted portion of the key.

However, individual users are mostly still left out in the cold from these developments. It’s a gap that Ruben Merre, CEO and co-founder of NGRAVE, is addressing. Merre came to the blockchain space from the traditional fintech space after realizing that most crypto users get a raw deal from the security and usability perspective.

After all, many still depend on writing down their private keys with a pen and paper. Merre and his fellow co-founders have been developing a three-layered wallet solution that can claim to be both completely secure, and yet still improve the user experience.

The NGRAVE offering comprises a hardware wallet device called ZERO that never needs to go online or connect to any other online machine. The seed key for the device is stored on a two-part stainless steel sheet, of which both parts are needed to read the key. Finally, an app uses one-way QR codes to enable wallet transactions to or from the wallet device. According to Merre, “offline is the new online,” with the NGRAVE suite of products dubbed “the coldest of cold storage.”

Don’t Get Caught Out

Any cybersecurity specialist will tell you that it’s a game of cat and mouse. No sooner has the technology caught up with the hackers, than they will attempt to find new ways to breach the defenses.

However, the best advice for exchanges and individual users is to keep up with advances in digital asset security as much as possible. Using outdated hardware or software is only making life easier for attackers. By ensuring that you’re using the most up-to-date security methods, you stand the best chance of remaining one step ahead of the hackers.

GUEST BLOGGER:

Andrew L. Rossow is a millennial attorney, law professor, entrepreneur, writer, and speaker on privacy, cybersecurity, A.I., AR/VR, blockchain, and digital monies. He has written for many outlets, most notably Forbes and HuffPost

Connect with Andrew on LinkedIn