Researchers Find Flaws in Security Protocols Developed by Major Crypto Exchanges

Cryptocurrency exchanges holding user funds have risked falling into numerous security pitfalls by failing to ensure security protocols are properly implemented, according to new research.

Speaking to Wired for an article Sunday, Jean-Philippe Aumasson, the co-founder exchange security firm Taurus Group, said he and his team, along with Omer Shlomovits from crypto wallet maker ZenGo, had uncovered three significant vulnerabilities in the way some custodial exchanges hold user funds.
While private crypto wallets usually have just one private key for the holder, exchanges go a step further and split keys up into different components – a distributed key scheme – so no one entity has complete control over the main wallet.
That generally improves security but, as Taurus Group found, the new attack vectors stemmed from splitting private keys up partly because they assumed key holders, entities responsible for part of the key, would not be malicious.
Some vectors come from the refresh function that enhances privacy by replacing key components so a third party can't slowly work out a full private key.
In one example, from open-source software from an exchange the researchers refused to identify, a malicious key holder could change, or threaten to change, part of the component so the full private key is lost – preventing the exchange from accessing funds again.
Arguably the biggest vulnerability came from a key-generation protocol from Binance where the key holder pretended to be the protocol itself, assigning other key holders the random values they need to verify their identity.
Armed with that information, a hacker could compromise the system from the moment it was set up, giving them access to the rest of the private key and allowing them to drain wallet funds.
Binance fixed the problem in March and said it recommends users go through the key-generation procedure only if they are concerned one of the holders could be malicious.
Both Aumasson and Shlomovits said the research highlighted just how easy it was for vulnerabilities to appear in ostensibly secure mechanisms.

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Paddy Baker

Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.