Banks or Cryptocurrency Exchange Markets? Financial institutions like banks have been facing cyber attacks almost everyday. The cyber security experience obtained by this status quo makes banks more careful and prepared against cyber attacks. However, they are still highly valuable targets and cyber criminals explore new vulnerabilities that sometimes make banks defenseless. It does not matter how hard the banks make their system secure, the weakest links are still the customers through social engineering attacks such as phishing.

On the other side, a new financial term was introduced to our daily life: cryptocoins. Crypto coins are the new mean of investment and shopping and their exchange volume increases exponentially. There are many exchange markets handles these investments. However, the question of resiliency of these markets is on the rise with recent attacks. The damage might go up to hundreds of millions of dollars as happened in January 2018, when, as the biggest cryptocurrency hack, more than half billion dollars was stolen from Coincheck.

biggest crypto

Banks or Cryptocurrency Exchange Markets

Black Kite conducted a review on cyber risk that top 25 cryptocurrency markets (based on their volume) posed to understand where they stand compared to banking companies. The Cryptocurrency exchange markets receive overall scores between 79 and 80 (C+ and A- as counterpart letter grades) based on Black Kite Risk Scorecard letter gradings, which is an acceptable level of security posture.

Compared to banking companies, grades of cryptocurrency markets are higher. This is mainly because number of assets (domains, subdomains, IPs, e-mails, employees) of banksare much larger than cryptocurrency exchange markets. Another very important factor is third-party risk that banks possess. The large number of third-party vendors of banks introduces invisible cyber risk to banking systems, which lowers the security ratings. On the other side, cryptocurrency markets are quite new and possess less number of assets that limits the attack surface for hackers.

Why do hackers target cryptocurrency markets?

compared crypto

The short answer is money. Cryptocoins, once stolen, are difficult to trace back and cyber criminals take advantage of this criminal luxury. The high market value of some crypto coins such as Bitcoin (BTC) makes it very attractive for hackers. Capturing low amount of BTC may result in high amount of US dollars in hackers hands. Since the exchange markets are quite new to finance industry, lack of security experience makes them more attractive and vulnerable targets for cyber criminals.

What are the top 3 risk factors for cryptocurrency exchange markets?

Companies and corporations in all industries encounter different cyber risks every day and experience difficulties while mitigating them. In our research, we stated that cryptocurrency exchange markets perform poorly in CDN Security, Fraudulent Domains, and Credential Management. Black Kite analyzes the CDN content to detect possible vulnerabilities. Ensuring the security of files obtained from a CDN ultimately requires a layered set of controls — including malware scanning, content filtering, and threat intelligence — that can analyze and block malicious code when it’s detected. We observe that 9 out of 25 exchange markets perform very poorly in CDN security.

Fraudulent or scam domains are frequently used by phishing attacks those targeting either a company’s employees or customers. Black Kite extracts fraudulent domains and subdomains from the domain registration database. Black Kite scorecard found more than 800 potential fraudulent domains (possibility over 75%) for cryptocurrency exchange markets. As phishing attacks are number one problem for the banks, same goes for cryptocurrency markets as expected.

There are more than 5 billion hacked email / password available on the internet and underground forums. Black Kite finds and shows the leaked or hacked emails & passwords. In this search, Black Kite found 27 leaked credentials (shared in last 90 days) for one of the exchange market. For more details of this report, please click here (Crypto Currency Report 2018.pdf).

What can be done?

Considering the impact of cyber attacks against cryptocurrency exchange markets, they should discover possible attacks in advance to avoid huge financial and reputational loss. Some on-site security services might not be sufficient to identify some threats such as phishing attacks by using fraudulent domains. If credentials of legitimate users are leaked and shared in hacker forums, it might be too late to avoid the loss when the attack is detected. Cryptocurrency exchange markets can leverage use of an external risk management product such as Black Kite Risk Scorecard to detect such threats and proactively mitigate the risk raised by these threat actors.

To learn your company’s risk score, please visit Black Kite and click on Learn Now.