Researchers Find Flaws in Security Protocols Developed by Major Crypto Exchanges

Private key protocols for some crypto exchanges have been implemented with bugs that could have been exploited by a well-placed malicious party, researchers say.

AccessTimeIconAug 10, 2020 at 3:39 p.m. UTC
Updated Sep 14, 2021 at 9:41 a.m. UTC

Cryptocurrency exchanges holding user funds have risked falling into numerous security pitfalls by failing to ensure security protocols are properly implemented, according to new research.

  • Speaking to Wired for an article Sunday, Jean-Philippe Aumasson, the co-founder exchange security firm Taurus Group, said he and his team, along with Omer Shlomovits from crypto wallet maker ZenGo, had uncovered three significant vulnerabilities in the way some custodial exchanges hold user funds.
  • While private crypto wallets usually have just one private key for the holder, exchanges go a step further and split keys up into different components – a distributed key scheme – so no one entity has complete control over the main wallet.
  • That generally improves security but, as Taurus Group found, the new attack vectors stemmed from splitting private keys up partly because they assumed key holders, entities responsible for part of the key, would not be malicious.
  • Some vectors come from the refresh function that enhances privacy by replacing key components so a third party can't slowly work out a full private key.
  • In one example, from open-source software from an exchange the researchers refused to identify, a malicious key holder could change, or threaten to change, part of the component so the full private key is lost – preventing the exchange from accessing funds again.
  • Arguably the biggest vulnerability came from a key-generation protocol from Binance where the key holder pretended to be the protocol itself, assigning other key holders the random values they need to verify their identity.
  • Armed with that information, a hacker could compromise the system from the moment it was set up, giving them access to the rest of the private key and allowing them to drain wallet funds.
  • Binance fixed the problem in March and said it recommends users go through the key-generation procedure only if they are concerned one of the holders could be malicious.
  • Both Aumasson and Shlomovits said the research highlighted just how easy it was for vulnerabilities to appear in ostensibly secure mechanisms.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.


CoinDesk - Unknown
A Major Crypto Exchange Abandons Ethereum: Is the World’s Computer Falling Behind?

By ditching Ethereum for Cosmos, dYdX has sparked claims that it has chosen sovereignty over security.

CoinDesk - Unknown
CoinDesk - Unknown
Three Arrows Capital Liquidation Ordered in British Virgin Islands

Partners from Teneo Restructuring have been called in to handle the insolvency.

CoinDesk - Unknown
CoinDesk - Unknown
Bitcoin Dips Under $20K on Blunted Growth Sentiment as Spain Fuels Inflation Concerns

Traders assessed revived concerns of rampant inflation and growth for the coming months.

CoinDesk - Unknown
CoinDesk - Unknown
First Mover Asia: Remember ICOs? You Would Have Made a Fortune if You HODLed; Bitcoin Slogs Toward $20K

Investors who purchased a breadbasket of blue chip coin offerings about five years ago would have generated an 819% return, even with the current bear market; most cryptos fell in Tuesday trading.

CoinDesk - Unknown