Why is it Harder to Control a Billion-Dollar Theft from Cryptocurrency Exchanges than Banks?

The recent attack on Binance and the theft of billions of dollars in assets has once again highlighted a significant difference between cryptocurrency exchanges and banks: hackers can move a large volume of assets within minutes if they infiltrate a withdrawal system of an exchange; transactions that, once confirmed on the blockchain, are usually irreversible.

According to Mihan Blockchain, experts have differing opinions on whether cryptocurrency exchanges are targeted more than banks or if thefts from them are simply more noticeable. However, the speed of asset transfers and the irreversibility of transactions make the consequences of a security breach in exchanges much heavier.

The Debate over the Security of Exchanges and Banks

Tomer Sharoni, CEO of blockchain intelligence company Addressable, believes that the main difference between an attack on a bank and an exchange is not in the method of hackers' infiltration, but rather in what they gain access to after the breach.

In a discussion about this, he stated:

A bank employee's laptop is hacked in exactly the same way as a cryptocurrency exchange employee's laptop; phishing emails, downloading infected files, or fake job interviews are the same in both cases. The difference lies in what the attacker ultimately gains access to.

According to Sharoni, banks have several opportunities to identify and stop suspicious transfers, from compliance checks to controls by intermediary banks. In some cases, it is even possible to stop or recover a transaction after the money has been sent. However, confirmed transactions on the blockchain are generally irreversible; although issuers of some stablecoins can block stolen assets.

Sharoni considers these features to be the reason for the attractiveness of large cryptocurrency treasuries for hackers, stating:

The speed, certainty, and irreversibility of transactions make large crypto treasuries the most valuable targets in the financial industry.

In contrast, Abdul Rafay Gadit, co-founder of ZIG Finance, believes that it cannot be said that cryptocurrency companies are hacked more than banks. He sees the difference in the transparency of the blockchain and the difficulty of hiding thefts.

Gadit says:

Crypto is not hacked more than banks; it just cannot hide it and cannot reverse the transaction.

According to him, banks also regularly face security breaches, but many of these incidents are reviewed internally and may never be publicly disclosed. In contrast, cryptocurrency thefts are visible on blockchain explorers within minutes.

The Heavy Cost of a Security Breach

The recent attack on Binance is an example of the dangers that Sharoni refers to. Investigations show that attackers were able to withdraw about $2.5 billion from one of the exchange's wallets in less than four minutes after confirming malicious code using Ethereum's EIP-7702 feature. This feature allows regular wallets to execute code that was previously reserved for smart contracts.

However, this attack did not mean breaking the encryption of the Ethereum network; rather, the attackers exploited access and mechanisms used for wallet management. Richard Teng, co-CEO of Binance, also announced that investigations have revealed several security breaches and evidence of attackers attempting to erase traces of their activities. In response to these events, Binance announced that it is reviewing its withdrawal infrastructure and transaction signing processes, key management, and employee device security.

Gadit believes that exchanges should implement the same operational measures as banks, including separating transaction signing authority, requiring multi-step verification, and setting withdrawal limits. He summarizes his view by saying:

No, the crypto industry is not inherently more vulnerable; it just does not forgive mistakes.

Daniel Tunkel, head of financial regulations at Edwin Co, also described the security situation of cryptocurrency exchanges as "an incident waiting to happen." From his perspective, regulatory bodies should not only focus on preventing attacks but should also examine whether exchanges have sufficient financial resources and operational infrastructure to absorb losses and protect customer assets after a major breach.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.