It’s time for blockchain security firms to join forces

Working alongside security experts from rival firms, not only with colleagues, will minimize risk for all of crypto

article-image

FLY:D/Unsplash modified by Blockworks

share

The lack of open communication between blockchain security firms requires urgent action. 

Following a spate of high-profile hacks, the time to address the prevalence of multi-million-dollar hacks is severely overdue. Not even respected figureheads like Vitalik Buterin and Mark Cuban are immune, with over $1 million lost following a hacked Twitter account and wallet, respectively. 

Without a doubt, technical capabilities matter in securing funds against bad actors. However, there is a critical component that is being overlooked in the present: teamwork. If we are to successfully neutralize the risks of financial and reputational loss to the industry, communication and collaboration between blockchain security firms is necessary. 

As one prominent example, the lack of effective communication exacerbated the Curve hack this summer and should serve as an important wake-up call for the industry. 

Read more: Mixin halts withdrawals as network suffers $200M loss in hack

Security experts faced challenges in rapidly coordinating their actions, resulting in missed opportunities for effective execution. Multiple security teams operated independently to recover and protect user funds, causing redundant efforts and a delayed response time. Due to the ambiguous nature of white hat hacking, certain security teams sought explicit permission from Curve before initiating any recovery efforts. Consequently, the attacker managed to steal funds before the coordinated white hat team could secure them. 

Openly discussing exploits, vulnerabilities and root causes is already the norm in traditional cybersecurity, as firms follow established protocols for the responsible disclosure of vulnerabilities. 

Blockchain security firms can and should adopt similar practices, ensuring that they are able to communicate vulnerabilities responsibly to relevant projects and communities to minimize risk in the most efficient way possible. 

Solid examples of streamlined communication seen in more traditional cybersecurity include Europol, a criminal information and intelligence database that collates information on cybercrime, making this information available to the wider public. Another example is the Common Vulnerabilities and Exposures (CVE), a publicly available database listing known cybersecurity vulnerabilities. 

Working alongside security experts from rival firms, not only with colleagues, is a valuable approach driven by an ethos of collaboration for the greater good. One such example already in action in crypto is the Seal 911 initiative, a collective of blockchain security experts working together to offer support from within a Telegram group. So far, Seal 911’s coordinated response has helped prevent a $200,000 theft.

Resources that pool information empower the community to more effectively monitor vulnerabilities and respond accordingly. However, there is no one such standardized process in Web3.

Read more: Mark Cuban loses nearly $900k on MetaMask fake

As the industry is still relatively nascent, this is not surprising. However, blockchain security firms should join together to create standardized protocols for common vulnerabilities for all Web3 projects — using the traditional cybersecurity resources as templates.

Crypto cybersecurity practices now are simply lacking

Relying on white hat hackers in crypto has proven extremely valuable up until now, saving individual projects millions in financial losses with each hack averted. However, relying on white hat hackers alone is not an efficient catch-all strategy. 

The execution of a white hat strategy necessitates a costly on-chain procedure to transfer funds to a trusted third party, followed by the need for that trusted third party to return the funds to the protocol or individual users. 

While advertising a white hat bounty can entice the most skilled white hat hackers to solve security issues quickly, it can also inadvertently provide attackers with hints that important or sensitive work is underway. This can propagate misinformation, potentially causing confusion about whether the event is an external attack or an asset protection operation (done by internal teams). Solving security issues publicly is not always the most effective solution. 

Web3’s penchant for anonymity, often due to legal and regulatory pressure, can also create uncertainty, as it can be unclear how to contact a trustworthy person within a protocol. Vulnerabilities should ideally be communicated to relevant parties first, in order to allow projects a fair opportunity to correct them before disclosing vulnerabilities to a wider audience. Yet the reality is that bad actors are often tipped off inadvertently at the same time, making the situation worse.

Collaboration must be embraced by blockchain security firms and experts. Only by working together cohesively can blockchain security firms establish best practices and standards for securing blockchain networks and decentralized applications.



Don’t miss the next big story – join our free daily newsletter.

Tags

Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

MON - WED, MARCH 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience:  Attend expert-led panel discussions and fireside chats  Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts   Grow your network […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

logo.jpeg

Research

Akash is a general-purpose compute platform with GPUs, storage, LLM training or inference, and validator hosting through its two-sided marketplace.

article-image

The SEC could allow half a dozen or more such funds to launch at once, Ark Invest CEO says

article-image

2023 saw a decline in a16z crypto funding, but the behemoth VC firm teased what it’s excited for next year

article-image

“Iran Unchained” launched a new version of its grant platform to make donations to activists easier

article-image

The stablecoin marks the first time a regulated European bank has made a euro-pegged stablecoin available on a crypto exchange

article-image

Build it and they will come, perhaps, but making crypto easier to use is turning out to be just as important

article-image

Amid moves by Itau Unibanco and Nubank, the country could serve as “a proof of concept” for TradFi-crypto integrations, industry research exec says