Latest Paper from Cloud Security Alliance Examines Top 10 Blockchain Attacks, Vulnerabilities, and Weaknesses

In the last five years, 43 exchanges have been publicly hacked, and more than 49 Decentralized Finance protocols have been exploited, resulting in a loss of more than $2.8 billion

SEATTLE – Sept. 28, 2021 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today released Top 10 Blockchain Attacks, Vulnerabilities, and Weaknesses, the latest research from the CSA Blockchain/Distributed Ledger working group. The report offers a high-level overview of the top 10 attack vectors targeting cryptocurrency and distributed ledger technology (DLT), namely exchange hacks, Decentralized Finance (DeFi) hacks, 51% attacks, phishing (for private keys), rug pull/exit scams, ransomware, SIM swaps, investment scams, high-profile doubler scams, and extortion. Illustrative examples are provided for each vector, along with an overview of the costly lessons that can result.

As the authors note, unaudited smart contracts and lapses in security protocols can result in major losses for centralized and decentralized exchanges. In the last five years, for example, 43 exchanges have been publicly hacked, and more than 49 DeFi protocols have been exploited, resulting in a loss of more than $2.8 billion. The paper aims to educate everyone from developers to compliance officers and day-to-day cryptocurrency users so that they might avoid the same pitfalls.

“There is a strong misconception that the immutable nature of DLT systems makes them inherently secure. The reality, however, is that cryptocurrencies and the ecosystem of platforms that enable their usage have been the target of attacks since the inception of bitcoin over 12 years ago. As centralized exchanges have hardened their cloud security controls, attackers have pivoted to target the human users with social engineering attacks and confidence schemes. Fortunately, because of the open nature of most blockchains, blockchain analytics tools provide unprecedented capabilities to trace virtual assets in order to investigate crypto crimes, seize assets, and prosecute bad actors,” said Bill Izzo, co-chair of the Blockchain/DLT Working Group and a contributor to the paper.

There are a broad range of attack vectors targeting blockchain applications, targeting anything from cryptographic primitives to consensus mechanism vulnerabilities or smart contract exploits. Nascent crypto companies with inadequate security protocols can suffer unrecoverable losses if administrators with access to hot and cold wallet storage fall victims to any of these attack vectors. Additionally, unaudited smart contracts and lapses in security protocols can result in major losses for centralized and decentralized exchanges.

“People new to the space can also easily fall victim to common scams and extortion techniques. Phishing attacks will continue to target the human element behind DLT systems, resulting in anything from centralized exchange hacks to loss of personal private keys. With the proper security training as outlined in this document, many of these attacks can be prevented,” said Dave Jevans, CEO of CipherTrace and a contributor to the paper.

The Blockchain/Distributed Ledger Working Group strives to produce useful content to educate different industries on blockchain and its proper use, as well as define blockchain security and compliance requirements based upon different industries and use cases. Individuals interested in becoming involved in Blockchain/Distributed Ledger future research and initiatives are invited to join the working group.

Download the complete report.

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa.