Binance breach raises security questions on crypto exchanges

Two high-profile security breaches this week – including the largest cryptocurrency theft in history – are raising questions about the security of storing funds in a wallet on a crypto exchange.

A security incident on Thursday at digital asset exchange Binance affected some $6.3 billion in customer assets, making it the largest crypto theft on record.

Earlier today, prediction market platform Polymarket temporarily halted trading on its international exchange after a third-party data provider was hacked, resulting in at least $2.7 million leaking from users’ wallets. The company’s international platform runs on the Polygon blockchain.

Experts interviewed by CNBC said security incidents on crypto exchanges are not surprising, especially in light of recent AI hacking incidents.

Most of these experts even said that observers should expect more security incidents, at least in the short term, as the problem worsens.

Questions about the safety of user funds

“I think it’s extremely dangerous,” said Tyler Moore, a cybersecurity professor at the University of Tulsa who has followed the asset class for more than a decade. “I think you should be very careful when leaving a significant amount of funds in an exchange… there is no built-in protection when these inevitable hacks take place.”

For example, bank customers can rely on the Federal Deposit Insurance Corporation to insure deposits of up to $250,000 per depositor per insured bank, in the event of an institution’s failure.

There is no similar form of coverage available for funds lost during a cryptocurrency exchange, Moore noted.

Binance and Polymarket reassured users that they would cure affected investors. This is a sign that users need to have trust in crypto exchanges, according to Ido Ben-Natan, CEO of blockchain security company Blockaid.

“I actually don’t think any users will lose money,” he said. “Binance said they were going to cover everything… I actually don’t think it’s a bad idea for users to invest money in these exchanges. These exchanges need to work very hard to make sure they don’t take another hit like this.”

Ben-Natan noted that while he thinks more hacks are likely as the cybersecurity landscape changes due to AI, he said it would only strengthen the crypto industry.

As a result, a crypto wallet could ultimately become a safer place to hold funds compared to other options because the industry will have experience in how to deal with these attacks, Ben-Natan said.

Vulnerabilities on offshore platforms

A key point is that while Binance experienced a security incident on its offshore platform, its regulated and centralized US exchange did not have a similar problem. The same was true for Polymarket’s national exchanges.

Platforms regulated in the United States Coinbase And Robin Hood were also unaffected by the Binance security breach, although shares of both fell on Friday afterward.

During a Friday appearance on CNBC’s “Squawk on the Street,” Commodity Futures Trading Commission Chairman, federal derivatives regulator Michael Selig said it was critical to note the offshore nature of these incidents.

“They don’t have the same type of guarantees that we have in our financial markets,” he said. “We want to provide these exchanges with the ability to register with the CFTC, and they would be subject to the same types of cybersecurity measures that we have in our markets today.”

Brett Falk, professor and director of the Crypto and Society Lab at the University of Pennsylvania, said U.S. regulations likely would not have prevented an incident like the one at Binance on Thursday. Indeed, the hack may have involved a compromised DevOps engineer’s laptop, Binance said in an article on X.

“Most regulations don’t address the specific software stack you need to use to authenticate people,” Falk said.

In another social media post, BInance later said its investigation found other points of violation, although the company did not specify what these were.

A single target in a changing landscape

Falk echoed Ben-Natan’s argument that individuals are unlikely to suffer losses and that it is better for traders to leave their funds in an exchange where they have the financial backing of a company rather than in a standalone custodial wallet where no one can reimburse their losses in the event of a hack.

Ben-Natan added that traders should feel safe based on how many incidents companies like his capture don’t make the news. This is because security technology often works and stops them before they become major incidents.

However, crypto may be a unique target for hackers in an evolving cybersecurity landscape, these experts told CNBC. This is due to the amount of liquidity that individuals can access quickly in the event of a successful breach.

That’s why Ryan Kirkley, CEO of blockchain infrastructure company Global Settlement Network, thinks traders should be cautious about leaving their funds in a wallet not covered by insurance until financial companies upgrade their security infrastructure.

“I don’t think there’s a common solution in the market right now where your assets are actually safe,” Kirkley said.

“Unless you deal with a reputable, firm broker that provides asset insurance, today you risk placing your assets in any ecosystem simply because there is so much unknown,” he added.