Researchers Find Flaws in Security Protocols Developed by Major Crypto Exchanges

Share this story:


Cryptocurrency exchanges holding user funds have risked falling into numerous security pitfalls by failing to ensure security protocols are properly implemented, according to new research.

  • Speaking to Wired for an article Sunday, Jean-Philippe Aumasson, the co-founder exchange security firm Taurus Group, said he and his team, along with Omer Shlomovits from crypto wallet maker ZenGo, had uncovered three significant vulnerabilities in the way some custodial exchanges hold user funds.
  • While private crypto wallets usually have just one private key for the holder, exchanges go a step further and split keys up into different components – a distributed key scheme – so no one entity has complete control over the main wallet.
  • That generally improves security but, as Taurus Group found, the new attack vectors stemmed from splitting private keys up partly because they assumed key holders, entities responsible for part of the key, would not be malicious.
  • Some vectors come from the refresh function that enhances privacy by replacing key components so a third party can’t slowly work out a full private key.
  • In one example, from open-source software from an exchange the researchers refused to identify, a malicious key holder could change, or threaten to change, part of the component so the full private key is lost – preventing the exchange from accessing funds again.
  • Arguably the biggest vulnerability came from a key-generation protocol from Binance where the key holder pretended to be the protocol itself, assigning other key holders the random values they need to verify their identity.
  • Armed with that information, a hacker could compromise the system from the moment it was set up, giving them access to the rest of the private key and allowing them to drain wallet funds.
  • Binance fixed the problem in March and said it recommends users go through the key-generation procedure only if they are concerned one of the holders could be malicious.
  • Both Aumasson and Shlomovits said the research highlighted just how easy it was for vulnerabilities to appear in ostensibly secure mechanisms.

See also: Crypto Firm Hacked for $1.4M Admits It Will Struggle to Reimburse Users

Read more about…



The leader in blockchain news, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups.

Read More

All provided materials and tools are for entertainment purposes only and should never be considered financial advice. Crypto News 19 will not take any responsibility for lost funds based on investments/trades made on information found here or any linking website/affiliate. This includes all social media posts and all other communications occurring under the name Crypto News 19. You should always seek professional advice before making any investment or trade.