Ben Strack

Vagueness and ambiguity might not always be the proper recipe to regulate an industry.&nbsp;



But when it comes to crypto cybersecurity, guidelines that leave room for the self-regulation of an evolving sector is likely the best route, according to the former head of digital assets technology at BNY Mellon.



David Schwed joined blockchain cybersecurity firm Halborn as its chief operating officer in June 2022 after working for a year at BNY Mellon. He had, years earlier, spent time at the bank as a vice president of enterprise threat management.&nbsp;



Aside from the stints at BNY Mellon, Schwed also formerly worked at traditional finance giants Citi and Merrill Lynch. He became the chief information security officer at Galaxy Digital in 2018.



Certain traditional financial risk management regulations, such as capital reserve requirements for custodians in the Dodd-Frank Act, can be easily ported over to crypto, the executive said.&nbsp;&nbsp;



“When we get into [cybersecurity], that’s when things get a little bit trickier because, by design, regulations don’t necessarily dictate specific technologies or different tactics,” Schwed told Blockworks in an interview. “It’s meant to be broad enough that it’s changing. What was good today may not be good tomorrow, but you don’t want to keep changing regulation.”



<h2 class="wp-block-heading">Security is crucial, but what are appropriate guardrails?</h2>



Blockchain cybersecurity is crucial to mainstream adoption, Schwed said, as the prevalence of hacks can keep institutions on the sidelines and scare regulators.



But bank-level security for crypto doesn’t exist yet, and crypto’s “bearer asset” status attracts some of the most dangerous cyber crime groups, including <a href="https://blockworks.co/news/north-koreas-lazarus-hackers-try-to-exfiltrate-harmony-funds">North Korea’s Lazarus Group</a>.&nbsp;



“You’re not stealing credit card numbers and selling [them] on the black market,” Schwed said. “You steal it, you have it…and the best hackers in the world are now going after that.”&nbsp;



Schwed pointed to the Gramm–Leach–Bliley Act (GLBA) — enacted in 1999 — as a potential model for blockchain cybersecurity regulation. The law requires financial institutions to safeguard customer data and reveal details to customers about their information-sharing practices.



The GLBA’s broad language around “maintaining appropriate safeguards,” for example, allowed financial companies to continue “raising the bar” around what the industry deemed to be acceptable, Schwed said.&nbsp;



The same type of legislation with “vague and ambiguous” language could benefit the&nbsp; crypto-related cybersecurity space, he added.&nbsp;&nbsp;



“Once you kind of set that bar, you’re giving banking regulators the ability now to come in and maybe start setting that standard through banking examination,” Schwed said. “I don’t think explicit regulation is the way to go, because once you give people a framework and say you must do A, B, C and D, they’re only going to do A, B, C and D.”



<h2 class="wp-block-heading">States to lead on regulation?</h2>



Though there remains a lack of knowledge from regulators, as well as traditional technologists and security professionals, around crypto, “no one disagrees this is where the market’s headed,” Schwed said. <a href="https://blockworks.co/news/blackrock-ceo-us-lagging-innovation-tokenization">Larry Fink, the CEO of BlackRock</a>, has emphasized the significance of tokenizing securities. This involves enabling the asset class to move on blockchains, and according to Fink, it represents the next generation for markets.



The SEC has <a href="https://blockworks.co/news/sec-crypto-enforcement">launched various enforcement actions</a> in recent months, alleging unregistered securities violations against industry firms. The CFTC <a href="https://blockworks.co/news/bitcoin-and-ether-are-commodities-says-cftc-in-binance-lawsuit">has labeled various cryptocurrencies commodities</a>, including ether (ETH) and tether (USDT) and litecoin — signaling a jurisdictional battle that adds another wrinkle to regulatory progress.&nbsp;&nbsp;



“I believe in my heart of hearts that they want to come out with regulation, but they don’t want to do the wrong thing,” Schwed said. “I think they’re taking the time to figure things out.”



But as US policymakers and the country’s federal regulatory agencies move slowly, states could swoop in to fill in the gaps.&nbsp;



Schwed called the cybersecurity <a href="https://govt.westlaw.com/nycrr/Document/I60c61d2e0d5f11e79781d30ba488e782?viewType=FullText&amp;originationContext=documenttoc&amp;transitionType=CategoryPageItem&amp;contextData=(sc.Default)">policy</a> within New York’s <a href="https://www.dfs.ny.gov/virtual_currency_businesses">BitLicense</a> regulation — implemented by the state’s Department of Financial Services in 2015 — “fairly comprehensive.”



“I think we saw a lot of companies running out of New York because they didn’t want to get the BitLicense, but I think we might start seeing the opposite,” Schwed said. “The BitLicense is a really great standard when it comes to cybersecurity, at least comparably, so maybe you start seeing some states stepping up and addressing where [the federal government’s] not coming in.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Ex-BNY Mellon Exec: ‘Vague’ Crypto Security Regulations Are Ideal

Shalini Nagarajan

<div id="highlights-block_634d446fc15cd" class="highlights">
 <ul>
 <li>Lazarus is most likely targeting Japanese crypto operators through cyberattacks, authorities say</li>
 <li>Crypto businesses urged to caution against phishing attacks and social engineering</li>
 </ul>
 
</div>



North Korean hacking group Lazarus plotting phishing and social engineering attacks against crypto businesses, authorities in Japan have warned.



Local police, Japan’s financial regulator and the National Center of Incident Readiness and Strategy warned local crypto businesses in a recent <a href="https://www.npa.go.jp/cyber/pdf/R041014_cyber_alert.pdf">advisory statement</a> about further hacking attempts. They also laid out preventive measures to monitor breaches.



Since Lazarus is state-sponsored, it is believed proceeds from the hacks may go toward North Korea’s nuclear weapons program. The group has also been associated with using crypto mixer Tornado Cash, recently <a href="https://cms.blockworks.co/us-treasury-bans-citizens-from-using-mixing-service-tornado-cash/">sanctioned</a> by the US Treasury, to conceal the origin of stolen funds.



The authorities didn’t mention which crypto businesses were targeted by Lazarus, but warned that security measures such as improved private key management are warranted.



They asked both individuals and companies to implement countermeasures such as ensuring the origin of downloaded files is a trusted source, interfaces to web applications are legitimate and private keys are stored offline, such as on a hardware wallet.



Lazarus is believed to have stolen more than $1.75 billion worth of cryptoassets since its formation in 2009, <a href="https://blog.chainalysis.com/reports/lazarus-group-kucoin-exchange-hack/">Chainalysis</a> found last year. The group has been behind several crypto exchange hacks, including the theft of $49 million worth of crypto from Upbit in 2019.



After several companies had their internal systems hacked and crypto stolen, police reportedly launched an investigation within a special investigation unit. They eventually found Lazarus to be the culprit.



A <a href="https://docs.google.com/document/u/1/d/1pTtOJ9Jg4jPE8Xts8OAZ57QYSqlKwsj4QFePaXLbAsY/edit">local report</a> by Japan News states it isn’t usual to name a suspected attacker before a more substantial action like an arrest, but that publicly naming the group is also viewed as an effective move to preempt attacks, as it could prompt people to take action and remain vigilant.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Japan-based Crypto Businesses Warned of Possible Cyberattack Threat

Sebastian Sinclair

<div id="highlights-block_634d1932a233e" class="highlights">
 <ul>
 <li>Citizens will be able to access their digital IDs via their smartphones</li>
 <li>The tech-savvy nation ranks highest among developed markets for smartphone use</li>
 </ul>
 
</div>



South Korea plans to leverage blockchain technology for the use of digital identity cards as the country pivots towards a post-COVID-19 era of remote work and online verification processes.



The country’s government will allow citizens to verify their identity via digital IDs embedded into their smartphones, replacing Korea’s resident registration cards by 2024, <a href="https://www.bloomberg.com/news/articles/2022-10-16/south-korea-aims-to-boost-economy-with-digital-id-on-blockchain?leadSource=uverify%20wall" target="_blank" rel="noreferrer noopener">Bloomberg reported</a> Sunday.



It comes as South Korea — one of the most digitally developed countries globally — seeks to bolster economic growth following the pandemic. The country was among the most <a href="https://www.bloomberg.com/news/articles/2022-03-17/how-south-korea-is-beating-covid-despite-600-000-new-cases-a-day" target="_blank" rel="noreferrer noopener">significantly impacted</a> among developed nations.



According to a recent <a href="https://unctad.org/webflyer/why-robust-digital-identity-systems-are-essential-fostering-trade-and-development" target="_blank" rel="noreferrer noopener">report</a> by the United Nations Conference on Trade Development, the pandemic accelerated the shift toward digitization. As such, cybersecurity concerns are front and center in an increasingly hostile environment safe storage of sensitive data.



Blockchain-based IDs are one attempt to alleviate some of that strain placed on countries seeking to bolster their defense against cyberattacks which have, at times, wreaked havoc across <a href="https://www.interpol.int/fr/Actualites-et-evenements/Actualites/2022/INTERPOL-Working-Group-highlights-cyber-threats-across-the-Americas" target="_blank" rel="noreferrer noopener">Europe</a>, <a href="https://abcnews.go.com/Technology/cyberattacks-reported-us-airports/story?id=91287965" target="_blank" rel="noreferrer noopener">the US</a> and <a href="https://www.abc.net.au/news/2022-10-14/optus-says-customers-do-not-need-new-passports-after-data-breach/101538178" target="_blank" rel="noreferrer noopener">Australia</a>.



The initiative will leverage the benefits of storing user data in a decentralized manner while keeping citizens’ phone data, including how and where they use their digital IDs, private from the government, per the report.



South Koreans rank as some of the most technologically-savvy individuals across the globe.



Research conducted by the Organization for Economic Cooperation and Development’s Program for International Student Assessment in 2011 showed its younger generation topped other nations for use of <a href="https://www.oecd.org/education/educationkoreatopsnewoecdpisasurveyofdigitalliteracy.htm" target="_blank" rel="noreferrer noopener">online learning</a>.



South Korea also ranks at the top for <a href="https://www.statista.com/statistics/321408/smartphone-user-penetration-in-south-korea/" target="_blank" rel="noreferrer noopener">smartphone ownership</a>, with roughly 96% of all Individuals of any age owning at least one smartphone and using it at least once per month. The US stands at roughly 80% on the same metric.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

South Korea To Roll Out Blockchain-based Identity: Report

Brian Nibley

<div id="highlights-block_61ddc7f9edcd5" class="highlights">
 <ul>
 <li>The launch of the Inter-Blockchain Communication protocol (IBC) in early 2021 shifted attention to implementing shared security, which began testing in the fourth quarter of 2021</li>
 <li>This allows newer, smaller blockchains to “rent” security from more established networks</li>
 </ul>
 
</div>



Proof-of-stake (PoS) networks are secured by validators who stake tokens on the network to validate transactions and produce blocks. The overall security of a PoS network, then, will roughly be in proportion to the total market cap of the token, because the more tokens being staked, the higher the cost of attacking the network.



The market cap of a PoS network is somewhat analogous to the hash rate in a proof-of-work (PoW) network. The higher the hash rate, the more difficulty an attacker would have in trying to take over the network by controlling the majority of its mining power. Similarly, the higher the market cap of tokens on a proof-of-stake network, the more resources it would take for an attacker to control enough tokens for a successful attack.



<h3 class="wp-block-heading">Ways to attack a PoS network</h3>



While a 51% attack requires controlling 51% of the hash rate of a proof-of-work network, proof-of-stake networks can be attacked even if a bad actor controls less than a majority of the network’s resources.



“If you control one-third of a network, you can do censorship attacks, meaning you can prevent certain transactions from being executed… if I control two-thirds of the network, I can control governance and pass a proposal for a malicious upgrade or drain the community pool with a spend proposal. There are various ways that can be leveraged for nefarious means,” says <a href="https://twitter.com/billyrennekamp" target="_blank" rel="noreferrer noopener">Billy Rennekamp</a>, Cosmos Hub Lead at the <a href="https://interchain.io/" target="_blank" rel="noreferrer noopener">Interchain Foundation</a> and member of the Board of Management.



This makes shared security even more important. Part of what makes PoS networks difficult to attack is the cost of acquiring all those tokens. To buy one-third of the Cosmos’ ATOM token would cost about $2.3 billion, let alone the price impact it would have if suddenly someone started buying up that many tokens.



But if your network is just starting out and only has $1 million or $10 million in market cap, a lone whale wouldn’t have much trouble conducting an attack. And it’s not always feasible to wait for wider adoption of a token before building decentralized applications that could necessitate large transactions on a regular basis. That’s where shared security comes in.



<h3 class="wp-block-heading">ShareInterchain security: Cosmos&#8217; take on Shared Security</h3>



What does shared security look like in Cosmos?



“The Cosmos network, Interchain Foundation, Tendermint Inc, the different contributors for the last 4 to 7 years — depending on how you see the start of the project — have always been working on the most valuable use of our time,” says Rennekamp. “So again with PoS, it began just building Tendermint. Then it moved to the Cosmos SDK, making it easy to build application-specific blockchains, and then it shifted to IBC, making it possible to connect these blockchains.”



After the successful launch of the Inter-Blockchain Communication protocol (IBC) in early 2021, attention has shifted to the implementation of interchain security which began testing in the fourth quarter of 2021.



<blockquote class="wp-block-quote">“Interchain security is the ability to use one staking token across multiple networks to secure those networks,” says Rennekamp.</blockquote>



This allows newer, smaller blockchains to “rent” security from more established networks. The ability to do this can be helpful when expecting large transactions to occur on a PoS blockchain that doesn’t have much market cap behind it.&nbsp;



For example, if someone wants to send $20 million of tokens through a blockchain secured by just $10 million in value of tokens staked, then the operators of that chain “would be incentivized to steal the tokens if they’re being logical game-theory participants,” explains Joe Dirtay of Cosmos.



ATOM, which <a href="https://www.coingecko.com/en/coins/cosmos" target="_blank" rel="noreferrer noopener">CoinGecko tracks</a> as the 18th &nbsp;largest cryptocurrency with a market cap of around $11.5 billion, is in a good position to provide this kind of security to other networks. “Building a highly secure network means getting a high-value token, in the most straightforward way, although the problem is actually much more nuanced than that,” says Rennekamp.



Thanks to the Cosmos Hub, developers can not only create and connect their own blockchains but also rent the security they need for building bigger and better applications.







<hr class="wp-block-separator"/>



This content is sponsored by Cosmos. To read more Cosmos content, check out <a href="https://cms.blockworks.co/how-the-interchain-sustainability-mission-plans-to-change-the-world-with-ibc/" target="_blank" rel="noreferrer noopener">How the Interchain Sustainability Mission Plans to Change the World with IBC.</a>

Cybersecurity