You are here: Home » International » News » Technology
Business Standard

How hackers broke the crypto code and stole $500 mn in digital currency

Crime raises questions about security of cryptocurrencies around the world, as affected exchange admits to security lapse

Pavel Alpeyev & Yuji Nakamura | Bloomberg 

Hacking
.

Early Friday morning in Tokyo, broke into a cryptocurrency exchange called Inc. and made off with nearly $500 million in digital tokens. It’s one of the biggest heists in history, with the exchange losing more than 500 million of the somewhat obscure The hack has raised questions about security of around the world. Q: How did the pull it off? A: hasn’t disclosed how their system was breached beyond saying that it wasn’t an inside job. The company did own up to a security lapse that allowed the thief to seize such a large sum: It kept customer assets in what’s known as a hot wallet, which is connected to external networks. Exchanges generally try to keep a majority of customer deposits in cold wallets, which aren’t connected to the outside world and thus are less vulnerable to hacks. also lacked multi-signature security, a measure requiring multiple sign-offs before funds can be moved. Q: Where did the stolen coins go? A: That’s one of the stranger aspects of these heists. Because transactions for and the like are all public, it’s easy to see where the are -- even though they’re stolen. has identified and published 11 addresses where all 523 million of the stolen coins ended up. You can see for yourself online. Trouble is, no one knows who owns the accounts. Each one has been labeled with a tag that reads "coincheck_stolen_funds_do_not_accept_trades : owner_of_this_account_is_hacker." NEM developers created a tracking tool that would allow exchanges to automatically reject stolen funds. Q: Does that mean the won’t be able to cash in? A: Not necessarily. The thief may be able to shake off surveillance by going through a “tumbler,” a service like that offers cryptocurrency trading without collecting personal data. Converting into a more anonymized currency, like Monero, could conceivably launder them.

But the huge total amount of money stolen presents a challenge. NEM trading was disabled on as of Monday. Q: What else can NEM developers do to fix this? A: Developers could change the NEM blockchain by rolling back the record to a point before the attack. The so-called hard fork would create two versions of NEM, one that has never been hacked and another containing the stolen funds. While this approach worked for in 2015, NEM Foundation Vice President Jeff McDonald said a fork is not an option. Q: For all the talk about crypto being the future of currency, these exchanges seem to be getting hacked a lot. A: You’ve noticed? Yes, there’s a long history of thefts at cryptocurrency exchanges and wallets, dating back to the infamous robbery of Tokyo-based Mt. Gox in 2014. As prices of digital assets have soared, the platforms have become increasingly juicy targets for North Korean leader Kim Jong Un has allegedly sent his out to swipe digital coins as his country faces tightening trade sanctions. One researcher estimates that more than 14 percent of and rival currency Ether has been stolen. Q: So what can an individual do to keep crypto-assets safe? A: The lesson for crypto-enthusiasts is that exchanges are prime targets for and no place to store your coins. One alternative is to keep the assets in software wallets, which come in online, mobile and desktop varieties. Hardware wallets are dedicated devices that offer an additional layer of security. For the extra paranoid, there is always the analog option: printing out the private keys for your coins on paper.

First Published: Mon, January 29 2018. 15:08 IST
RECOMMENDED FOR YOU