Crypto exchange security whitepaper and Mitre ATT&CK; for bybit hacking

Security of Cryptocurrency Exchanges: Threats and Defenses

Cryptocurrency exchanges are frequent targets for cyberattacks, with billions of dollars stolen in recent years. High-profile exchange breaches in 2024 underscored the evolving threat landscape: attackers shifted focus from decentralized finance to centralized exchanges, exploiting weaknesses in key management and human security (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks) (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks). In May 2024, Japan’s DMM Bitcoin exchange lost 4,502 BTC ($305M) in one of the largest thefts at that time ([Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks](https://cybersecuritynews.com/crypto-hacking-in-2024/#::text=According%20to%20a%20Chainanalysis%20report%2C,breach%20that%20compromised%20its%20infrastructure)). Just two months later, India’s WazirX suffered a $235M hack despite advanced safeguards (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks). These incidents highlight the critical importance of robust cybersecurity measures at exchanges. This report examines major security threats to crypto exchanges – from technical attack vectors to social engineering and insider risks – and explores defenses and best practices. Real-world case studies (DMM Bitcoin 2024, WazirX 2024, etc.) are included to illustrate how attacks occur and how effective security and incident response can mitigate damage.

Structure: I first review two recent exchange hacks as case studies, then analyze key security concerns in sections: hot vs. cold wallet security, key management and multi-signature, API and withdrawal security, social engineering, infrastructure threats, insider threats and access control, and incident response. Throughout, technical and operational defenses are discussed in a professional, structured manner.

Case Studies: Recent Exchange Hacks

DMM Bitcoin Hack (May 2024)

In May 2024, DMM Bitcoin – a major Japanese exchange – was hacked, losing 4,502.9 BTC (worth over $300 million) in a single incident (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks). This breach was the one of largest exchange hack of 2024. DMM initially detected an abnormal transfer of thousands of BTC to an unknown wallet (Explained: The DMM Bitcoin Hack (May 2024)). Subsequent blockchain analysis showed the stolen funds were quickly split and laundered through mixers and cross-chain bridges (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks). DMM Bitcoin confirmed it had suffered a security breach but provided few technical details. It assured customers their deposits would be covered and froze certain services during the investigation (Explained: The DMM Bitcoin Hack (May 2024)).

While the exact root cause was not disclosed by DMM, experts suspect the attackers compromised the exchange’s private keys or signing infrastructure (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks) (Explained: The DMM Bitcoin Hack (May 2024)). The scale of the theft – thousands of BTC from what should have been secure wallets – suggests a failure in key management. Possibilities include a hot wallet private key exposure or insider misuse, or malware tricking an authorized system into signing a fraudulent transaction (Explained: The DMM Bitcoin Hack (May 2024)). Notably, all stolen funds came from a single wallet, indicating concentration of assets without sufficient safeguards. DMM stored a large amount of BTC in a wallet that was not adequately protected (e.g. lacking multi-signature or offline storage), making it a prime target. In the aftermath, DMM Bitcoin covered customer losses using internal reserves but announced it would cease independent operations, transferring users to another platform (SBI VC Trade) by 2025 (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks). This case underscores that even a prominent exchange can be crippled by a single breach if key security practices fail.

WazirX Hack (July 2024)

On July 18, 2024, WazirX, then India’s largest crypto exchange, was hacked for ~$235 million in various cryptocurrencies ($235M WazirX exchange hack has implications for India’s crypto industry) ($235M WazirX exchange hack has implications for India’s crypto industry). The attackers drained an Ethereum hot wallet that used a multi-signature setup – a security design that, on paper, should have prevented single-point failure. WazirX’s hacked wallet was a Gnosis Safe multisig requiring 4 of 6 signatures (four approvals needed for any transaction). Five keys were held by WazirX and one key by its custody service provider Liminal (Explained: The WazirX Hack (July 2024)). The wallet also had address whitelisting enabled, meaning it was supposed to only send funds to pre-approved addresses (Explained: The WazirX Hack (July 2024)). Furthermore, all WazirX signing keys were stored on Ledger hardware wallets for added protection (Explained: The WazirX Hack (July 2024)). Despite these measures, the hacker succeeded in illicitly transferring out almost all assets.

How the attack bypassed multisig: The attacker managed to change the smart contract implementation of the WazirX multisig wallet, essentially swapping in a malicious contract under the attackers’ control (Explained: The WazirX Hack (July 2024)). Eight days before the incident, the hacker deployed a malicious contract on Ethereum. Just minutes before the theft, they initiated a transaction to upgrade the multisig wallet’s contract to this malicious code ($235M WazirX exchange hack has implications for India’s crypto industry). Critically, this contract change required four valid signatures (three WazirX and one Liminal) – which the attacker already obtained. According to investigations, the attacker likely compromised the devices or interfaces of the key holders, tricking them into signing an “innocuous” transaction that in reality changed the wallet’s logic (Explained: The WazirX Hack (July 2024)) ($235M WazirX exchange hack has implications for India’s crypto industry). A user interface discrepancy in the custody platform may have hidden the malicious details, so the signers believed they were approving a normal transaction while actually authorizing the contract switch (Explained: The WazirX Hack (July 2024)). Once the multisig was effectively reprogrammed, the whitelist and multi-signature checks were nullified – the hacker’s contract allowed sending funds anywhere without further approval (Explained: The WazirX Hack (July 2024)) (Explained: The WazirX Hack (July 2024)). The attacker then drained $234.9M to their addresses (mixing the funds into ETH to obscure the trail) ([$235M WazirX exchange hack has implications for India’s crypto industry](https://cointelegraph.com/news/235m-wazirx-crypto-exchange-hack-india#::text=ImageSource%3A%20Cyvers%20Alerts)).

This WazirX hack is remarkable because the exchange had implemented advanced security (multisig, whitelisting, hardware keys) that exceeded industry norms, yet a subtle exploit in the operational process led to catastrophe (Explained: The WazirX Hack (July 2024)). It demonstrates that holistic security audits and careful implementation are vital – simply having multisig or hardware wallets is not enough if the workflows around them have logic flaws. The incident, attributed by analysts to the North Korean Lazarus Group, ultimately forced WazirX to suspend operations (it ceased activity the same day) (2024 WazirX hack - Wikipedia). The case highlights how social engineering and technical subterfuge can defeat even robust technical controls if humans are tricked into approving malicious actions.

Hot vs. Cold Wallet Security

(The Ultimate Comparison Between Hot vs Cold Wallets | Ready) Figure: Illustration of hot (online) vs. cold (offline) wallets for crypto assets. Hot wallets keep private keys on internet-connected systems, making them convenient but surrounded by more attack vectors (indicated by malware icons). Cold wallets store keys offline (e.g. hardware devices or paper), greatly reducing online attack surface.

A fundamental aspect of exchange security is how cryptocurrency funds are stored: “hot” wallets vs. “cold” wallets. A hot wallet is an online-connected wallet for day-to-day liquidity, enabling fast withdrawals and trades. In contrast, a cold wallet keeps private keys offline, typically in secure hardware or air-gapped systems, used for long-term storage. The security trade-off is clear – hot wallets offer convenience and accessibility, whereas cold wallets provide far stronger protection at the cost of immediacy (Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News). Because hot wallets are exposed to the internet, they are inherently more vulnerable to hacking, malware, and other online attacks (Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News). Cold wallets (offline) are isolated from network threats, so an attacker cannot directly breach them via the internet. However, cold storage is less convenient for an exchange, since moving funds in/out requires manual procedures.

Best practice: Given these dynamics, most exchanges minimize risk by keeping the majority of customer assets in cold storage and only a small float in hot wallets to service withdrawals. For example, an exchange might keep 90-95% of funds in offline multi-signature cold wallets and 5-10% in hot wallets for operational liquidity. This way, even if a hot wallet is compromised, losses are limited and the bulk of assets remain safe. The importance of this practice was tragically demonstrated by the Coincheck hack of 2018. Coincheck had stored $530M worth of NEM tokens in a single hot wallet with a single-signature key – no multisig, no cold storage – which hackers stole by obtaining the hot wallet’s private key (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet) (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet). Coincheck admitted the funds were kept in a simple hot wallet and not in a secure multisig cold wallet, a “deeply regrettable” lapse (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet). Had those coins been in cold storage or protected by multiple keys, the breach impact would have been far lower. Similarly in 2021, hackers stole $150M from BitMart’s hot wallets on Ethereum and Binance Chain, by using a stolen private key to those wallets ([Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News](https://news.trendmicro.com/2021/12/08/crypto-exchange-bitmart-loses-150-million-to-hackers/#::text=conducting%20its%20initial%20investigation%20into,users%20with%20its%20own%20funding)). BitMart’s cold wallets were unaffected, and the exchange was able to compensate users for the hot wallet loss (Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News). These cases reinforce that minimizing hot wallet balances and securing any necessary hot keys is crucial.

Just using cold wallets are not enough; they must be properly managed. Whenever an exchange needs to move funds from cold storage (e.g. to refill hot wallets or process large withdrawals), procedures must be in place to authorize and secure that transfer. Improper handling of a cold wallet (e.g. exposing it to a compromised computer while unlocking) could still lead to theft. Additionally, exchanges should segment funds across multiple wallets (don’t put all assets in one wallet), to reduce single points of failure. Cold storage should involve offline hardware devices or paper backups, secured in vaults with multi-person access controls.

In summary, hot wallets should only hold the minimal funds required for liquidity, and should be closely monitored and secured. The bulk of assets should reside in cold storage, protected from online threats. This layered approach limits the damage of any one breach. Hot wallet servers should also have stringent security hardening (firewalls, limited network access, monitored processes), since they are high-value targets. Many exchanges also insure their hot wallets up to a certain amount to cover losses in case of a hack. Overall, the hot vs. cold wallet strategy is the first line of defense in protecting user assets – rely on cold storage for safety.

Key Management and Multi-Signature Solutions

Proper key management – how private keys are generated, stored, and used – is the heart of exchange security. If an attacker gains access to an exchange’s private keys, they can steal the associated crypto. Thus, exchanges must employ robust controls to protect keys from both external attackers and malicious insiders. Key management encompasses technical measures (hardware security modules, encryption, multi-signature) and operational procedures (key ceremonies, access separation, backups).

Hardware Security Modules (HSMs) and secure enclaves: Many exchanges store private keys in HSMs or dedicated secure devices. These are tamper-resistant hardware that securely store keys and can sign transactions within the device, never exposing the raw key to the application server. For instance, an exchange might keep its cold wallet keys in an offline HSM in a vault, requiring quorum approval to use. Some exchanges like Coinbase have described splitting keys and distributing them geographically, so that no single location holds an entire key (Coinbase Custody is Officially Open For Business). In Coinbase’s custody system, private keys are split and stored offline in pieces, requiring a quorum of geographically distributed agents using cryptographic hardware to sign any transaction (Coinbase Custody is Officially Open For Business). This approach ensures no lone insider or single breach can yield full control – multiple independent parties and devices must cooperate. Such multi-party key management (related to multi-signature and newer threshold signature schemes) greatly raises the bar for attackers. Distribution is the key.

Multi-signature (multisig) wallets: Multisig is a powerful crypto-native security mechanism that requires multiple independent private keys to authorize a transaction. A common form is M-of-N multisig, where N keys exist and any M of them must sign to release funds. For example, a 3-of-5 multisig wallet might distribute keys among five different executives or systems, and at least three signatures are needed for any withdrawal. Multisig wallets eliminate the single point of failure of a normal single-key wallet – an attacker would need to compromise M different keys (held in different places) to steal funds (Explained: The DMM Bitcoin Hack (May 2024)). This was a lesson from the DMM hack: experts noted that using a multi-signature wallet or splitting funds into multiple accounts could have reduced the impact (Explained: The DMM Bitcoin Hack (May 2024)) (Explained: The DMM Bitcoin Hack (May 2024)). Multisig is widely considered a best practice for protecting high-value exchange wallets. Many major exchanges use multisig for cold storage. For example, Kraken reportedly uses a 4-of-5 multisig for its cold wallets, and Coincheck (post-hack) moved to multisig wallets for all assets after learning that lesson (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet).

In practice, multisig means no single employee or server holds all the power. Even if one key is stolen or one system is compromised, the funds cannot be moved without the other keys. This dramatically improves security. However, as WazirX showed, multisig is not perfect – if multiple key holders are tricked or compromised, it can still fail. In the WazirX case, the attacker managed to get 4 signatures on a malicious transaction by social engineering the key custodians (Explained: The WazirX Hack (July 2024)) (Explained: The WazirX Hack (July 2024)). This underscores that the implementation of multisig must be carefully managed (e.g. having out-of-band verification for transactions, and ensuring signers truly understand what they’re approving).

Operationally, exchanges should enforce strict procedures for key usage. Access to each key should be limited to authorized personnel, and ideally the keys are on hardware devices (like hardware wallets or HSMs) that require PINs and are kept offline. Key ceremonies (for generating and distributing keys) should be conducted securely and recorded. No single individual should ever control all private keys for an exchange’s wallets – that mitigates both insider risk and external compromise. Insider collusion would be required to misuse multisig funds, which is much less likely if keys are held by people in different roles or locations.

Exchanges are increasingly exploring multi-party computation (MPC) wallets as an alternative to traditional multisig. MPC allows multiple parties to collectively compute a signature without ever assembling the full private key in one place. This can achieve a similar decentralization of trust as multisig, sometimes with more flexibility across blockchain asset types. For example, Fireblocks (a custody tech provider) uses MPC to protect exchange keys such that multiple servers need to collaborate to sign, and a hacker would need to breach several independent systems simultaneously.

Key storage and backup: Keys (or key shares) in cold storage should be encrypted at rest and backed up in secure offline media. Backups ensure that even if an HSM fails or a device is destroyed, the keys aren’t permanently lost (which would lock users out of funds). However, backups themselves must be protected with equal rigor – an unencrypted backup or one accessible by too many people is another vulnerability. Often, exchanges will split a key into parts and give parts to different trusted entities for backup (so no single backup reveals the whole key).

In summary, rigorous key management is non-negotiable for crypto exchanges. The goal is to drastically reduce the chance that any one system breach or human error yields the keys. By using hardware protections, requiring multiple signatures, and splitting key control among multiple trusted parties, exchanges can defend against even highly sophisticated attackers. This layered approach played out positively in some cases – e.g., when KuCoin was hacked in 2020, the thieves got away with hot wallet keys, but KuCoin’s cold wallets (under multisig control) remained secure and the exchange recovered much of the funds through emergency responses (A Letter from KuCoin CEO: 2020, 2021 and Beyond) (Lazarus Group Pulled Off 2020’s Biggest Exchange Hack and Appears to be Exploring New Money Laundering Options - Chainalysis).

API Security and Withdrawal Controls

Cryptocurrency exchanges expose APIs (Application Programming Interfaces) for clients to trade programmatically and for internal microservices to communicate. These APIs, if not securely designed and monitored, can become attack vectors. Additionally, the process of initiating withdrawals – whether via UI or API – must have robust controls to detect and prevent fraudulent or bulk unauthorized transfers. API security and withdrawal security go hand in hand in preventing hackers from illicitly draining funds even if they compromise user accounts or exchange systems.

User API keys and abuse: Many active traders use API keys to access exchange services (for trading bots, portfolio management, etc.). API keys typically grant access to account actions like placing orders or withdrawing funds (if enabled). Attackers have learned to target these keys. If a hacker steals a user’s API key (through phishing, malware, or a leak at a third-party service), they can potentially trade on the account or even withdraw funds. A famous example occurred in March 2018 on Binance: hackers obtained a batch of users’ API keys via phishing (using a lookalike domain “bịnạnce.com” to steal logins) ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ). Instead of immediately withdrawing, the hackers executed a clever manipulation – they used the API access to place a flurry of market orders, pumping the price of an obscure coin (Viacoin) and then attempted to withdraw the profits from accounts they controlled ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ). Fortunately, Binance’s risk management detected the anomalous trading and froze all withdrawals within minutes, thwarting the heist ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ). The hackers ended up losing money on their pre-deposited Viacoin positions when Binance reversed irregular trades, and none of the compromised accounts lost funds to withdrawals ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ). This incident shows the importance of monitoring API usage patterns and having automated triggers to suspend withdrawals on suspicious activity. Binance’s systems noticed a huge spike in one coin’s trading and cut off outbound transfers, saving users from theft.

To secure APIs, exchanges should enforce strong user authentication (API keys tied to accounts that are protected by MFA and IP whitelisting), permissions scopes (e.g. a user can create a trading-only API key that cannot withdraw), and rate limits/anomaly detection. Many exchanges now allow users to whitelist IP addresses that can use their API key – if a key is leaked, the attacker’s IP might not be on the whitelist, preventing its use. Likewise, withdrawal via API often requires an extra step or 2FA confirmation unless the destination address is pre-approved.

Withdrawal controls: Beyond API-specific issues, exchanges must have general controls on withdrawals, because fraudulent withdrawals are the ultimate goal of most attackers. Even if an attacker compromises an exchange account (via stolen credentials or SIM-swapping the user’s phone for 2FA), effective withdrawal controls can prevent or limit theft. Key measures include:

• Two-factor authentication (2FA) for any withdrawal initiation. This is standard for web interfaces (e.g. email or SMS confirmation, authenticator app codes). Even via API, some exchanges require a separate API key with withdrawal permissions and may enforce 2FA if the API triggers a transfer.
• Address whitelisting: Users can set a list of withdrawal addresses, and the exchange will not send funds to any address outside the whitelist. Crucially, adding a new address to the whitelist should be a secure process (with an effective verification). This means if an attacker breaks into an account, they cannot redirect funds to their address unless they successfully add it and wait out any cooldown. WazirX, for example, had a whitelist on its multisig wallet (only allowing transfers to certain addresses), which the hacker had to bypass by altering the contract logic (Explained: The WazirX Hack (July 2024)) ($235M WazirX exchange hack has implications for India’s crypto industry). This shows whitelisting can be effective, but an attacker who gains deep access may try to disable it. Exchanges like Coinbase and Kraken support user withdrawal address whitelisting with time delays for new addresses – a strong safeguard against fast theft.
• Withdrawal limits and review: Exchanges often implement tiered withdrawal limits. For instance, unverified or new accounts might have low daily limits. High-value customers might have higher limits but also more scrutiny. Internally, exchanges may flag and manually review very large withdrawals or unusual patterns (e.g. an account suddenly emptying out to a first-time address). Automated risk engines can score withdrawal requests – if something looks abnormal (compared to the user’s history or known fraud patterns), the exchange can pause it and investigate. This has proven effective in several cases. For example, Coinbase in 2021 noticed a wave of unauthorized withdrawals from a small number of accounts and froze them – later it turned out attackers exploited a flaw in Coinbase’s 2FA SMS flow, but the impact was contained and Coinbase reimbursed affected users.
• Internal transfer checks: For movements from cold to hot storage, require multiple approvals. Many exchanges require multi-person sign-off to move funds out of cold storage. This is an operational control to complement technical multisig – e.g. even if a cold wallet is 3-of-5 multisig, you might require that the 3 keys used are held by people in different departments who each confirm the purpose of the transfer.

Another API-related threat is attacks on the exchange’s own backend APIs or authentication systems. For instance, if there’s a vulnerability in the API that allows bypassing authentication, an attacker might withdraw funds without actually logging in. Exchanges should secure their web and mobile APIs against typical web vulnerabilities (SQL injection, broken access control, etc.) by regular penetration testing and code review. Using secure coding practices and strong authentication (like OAuth with short-lived tokens) helps prevent an attacker from exploiting API endpoints.

A notable cautionary tale is the 3Commas API leak incident (2022): 3Commas, a third-party trading bot platform, had an API key database leak, which exposed many users’ API keys for exchanges like Binance and KuCoin. Attackers then used those keys to execute unauthorized trades and withdrawals on the linked exchanges, causing user losses. While this was not the exchanges’ fault per se, it shows that trusting third-parties with API keys expands the attack surface. Exchanges responded by urging users to disable affected keys and some reimbursed certain losses. The lesson is that API keys should be treated like passwords – and if users use them on external services, those services must be vetted for security.

Summary of defenses: To secure APIs and withdrawals, exchanges should implement principle of least privilege for API keys, robust user authentication (MFA, whitelisting, device profiling), transaction monitoring, and fail-safes (like kill-switches to halt all withdrawals if something massive and anomalous is detected). A layered approach is best. In the Binance 2018 case, even though hackers had API access and even bypassed 2FA on user logins, the "withdrawal risk engine and emergency response" prevented monetary loss ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ) ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ). On the other hand, if an attacker can somehow subvert those layers (as in the WazirX case by tricking the multisig process), the consequences are severe. Thus, constant refinement of these controls and learning from new attack patterns is necessary. Exchanges also often employ bug bounty programs to have white-hat hackers find API vulnerabilities before criminals do. By limiting what APIs can do without additional verification and by quickly detecting abnormal withdrawal behavior, an exchange can stop a thief in their tracks even after other defenses have failed.

Social Engineering Attacks Targeting Employees

Not all attacks on crypto exchanges are purely technical; many of the most damaging breaches begin with social engineering – tricking humans into giving access or information. Exchange employees and executives are prime targets for phishing, scams, and manipulation, because they often hold the keys (literally) to the exchange’s assets or critical systems. In recent years, state-sponsored hacking groups like North Korea’s Lazarus have aggressively targeted crypto firms’ employee with elaborate social engineering campaigns (FBI warns crypto firms of aggressive social engineering attacks) (FBI warns crypto firms of aggressive social engineering attacks). Defending against these human-targeted attacks requires not just technology, but also training, vigilant processes, and a security-first company culture.

Phishing and credential theft: The simplest form is phishing emails or messages to steal employee login credentials. Attackers might send an email that appears to be from a coworker or a trusted service, asking the employee to log in to a fake administrative portal. If the employee enters their username/password, the attacker captures them. In February 2023, Coinbase experienced an attempted breach where several employees received SMS messages urging them to log in due to an “important security alert” (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). One employee fell for the scam and entered their credentials into the fake site (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). The attacker then tried to use those credentials to access Coinbase’s internal systems. Fortunately, Coinbase had multi-factor authentication in place, which stopped the attacker from logging in with just the stolen password (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). The hacker then called the employee, impersonating IT support, and tried to get them to perform further actions on their workstation (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). By that point the employee grew suspicious and alerted Coinbase’s security team, who intervened within minutes (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). This incident shows how determined attackers can be – using multi-step social engineering (SMS plus phone call) – and how crucial it is for employees to be trained to spot odd requests. It also highlights the value of rapid incident response and layered authentication. Even though one lapse occurred (the employee entering credentials), additional controls (MFA, security monitoring) prevented a full breach (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed) (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed).

“Spear phishing” and targeted attacks: Spear phishing is a more tailored form of phishing, where attackers research specific individuals and craft personalized lures. For exchange staff, a common gambit is impersonating a recruiter or a potential business partner. The Lazarus Group is infamous for posing as recruiters for legitimate companies and targeting crypto employees on LinkedIn (FBI warns crypto firms of aggressive social engineering attacks). In one extreme example, Lazarus hackers approached a senior engineer at Sky Mavis (developer of Axie Infinity) with a very lucrative fake job offer in 2022. They sent a PDF purportedly containing a job offer – in reality it contained malware. When the engineer opened it, his computer was compromised, ultimately allowing the hackers to steal private keys to the Ronin bridge and abscond with $625M in crypto (Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie Infinity) (Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie Infinity). The FBI has warned that North Korean operatives research targets extensively and often impersonate contacts or recruiters with fluent English and deep knowledge of the crypto industry to gain trust (FBI warns crypto firms of aggressive social engineering attacks) (FBI warns crypto firms of aggressive social engineering attacks). Exchange employees have also been targeted with fake emails from regulators, law enforcement, or partner companies containing malicious links or attachments.

Another social engineering angle is pretexting – where an attacker pretends to be someone with a legitimate reason to ask for information. For example, an attacker might call the support team claiming to be a high-ranking executive who urgently needs a password reset or access to a system. Without proper verification protocols, support staff might be tricked into providing access.

Insider recruitment and bribery: In some cases, attackers may attempt to recruit insiders or bribe employees to collaborate. An employee might be offered money to plug in a malware-infested USB drive or to share their login credentials. Large criminal groups have tried to plant moles inside exchanges by having their operatives seek employment there (often hiding their identity). The geopolitical angle is noteworthy – reports have indicated North Korean IT workers have sought employment in crypto firms under false identities (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks). Once on the inside, they can quietly subvert systems or gather intelligence.

Defenses against social engineering: The first line of defense is security awareness training for all internal people in the corp. All staff members including CEO should be regularly educated about phishing techniques and taught to be wary of unsolicited messages, especially those urging urgent action or secrecy. Simulated phishing exercises can help reinforce good habits (e.g. scrutinizing sender addresses, not clicking unknown links, confirming requests through secondary channels). In exchanges handling billions, even senior executives need continuous training – anyone can be targeted.

Technical measures can bolster this: using hardware security keys (FIDO2/U2F) for authentication can prevent credential theft via phishing, because even if an employee enters credentials on a fake site, the phishers cannot clone a physical security key. Many exchanges now require security keys for employee accounts, especially for sensitive access. Email security gateways and spam filters can catch some phishing emails or flag external senders. Endpoint security software can sometimes detect malware if an attachment is opened.

Crucially, process design should assume people can make mistakes and thus build in verification. For example, if an employee receives a request to transfer a large sum or reveal a sensitive secret, there should be a policy that such requests are verified out-of-band (e.g. call the requester via an official phone number to confirm). Coinbase’s security team monitoring the situation and calling the employee within 10 minutes was an excellent example of how to respond and verify a suspicious event (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed).

For highly targeted approaches like fake recruiters, organizations can encourage a culture where employees inform the security team if they are approached with any unusual offers related to their work. It may be unrealistic to stop all communications, but having intelligence sharing is key.

Physical security and meetings: Social engineering isn’t only digital – an attacker might try to gain entry to an office by tailgating or showing fake credentials, then plug into the network. Exchanges should enforce physical access controls (badges, escort visitors, etc.) and train employees to politely challenge unknown persons in secure areas.

In sum, social engineering attacks prey on human nature – curiosity, trust, fear, greed – to bypass technological defenses. They have been the entry point for some of the largest crypto heists. Therefore, exchanges must foster an environment of “verify”. Employees should feel empowered to slow down and verify unusual requests, and not fear punishment for reporting potential scams or even for falling for one (reporting quickly can greatly reduce damage). Regular reminders of attackers’ tactics (sharing sanitized examples of real phishing attempts received) keep awareness fresh. Combining this human vigilance with strong technical access controls (MFA, endpoint lockdown, role-based access) creates a multilayered defense. As the FBI noted in 2024, these threats are sophisticated and hard to detect (FBI warns crypto firms of aggressive social engineering attacks) – so a proactive, educated workforce is one of the best countermeasures.

Infrastructure Threats: DDoS, DNS Hijacking, and Network Breaches

Beyond targeting wallets and people, attackers also strike at the infrastructure of exchanges – the servers, networks, and dependencies that keep an exchange online. Key infrastructure-focused threats include Distributed Denial of Service (DDoS) attacks, DNS and BGP hijacking, and intrusion into internal networks or cloud environments. While these may not always result in direct theft of crypto, they can cause downtime, user fund accessibility issues, and in some cases enable or exacerbate other attacks. Exchanges need resilient architecture and incident response to withstand such assaults.

DDoS Attacks: In a DDoS, an attacker floods an exchange’s servers or network with an overwhelming volume of traffic (or resource-consuming requests), aiming to disrupt service. Crypto exchanges have often been targets of DDoS – sometimes by cybercriminals attempting extortion (demanding ransom to stop the attack), sometimes by competitors or malcontents trying to sabotage, and occasionally as a smokescreen to distract from other intrusions. In February 2020, for example, Bitfinex and OKEx were both hit with large DDoS attacks within a day of each other (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt) (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt). Bitfinex was knocked offline for about an hour until they mitigated the attack and restored services (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt). The attack was intense enough to bypass some of Cloudflare’s protections, indicating the attackers had substantial botnet resources (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt). OKEx had a similar experience, temporarily suspending some activities while fending off the traffic (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt). Both exchanges recovered quickly and no funds were lost – but the incident shows how even top platforms must continuously enhance their DDoS defenses.

To defend against DDoS, exchanges employ services like Cloudflare or Akamai for traffic scrubbing, maintain redundant network paths, and use rate limiting. Auto-scaling infrastructure can help absorb volumetric attacks. It’s also important to have a response plan: during an attack, communicate with users (so they know the issue is being worked on) and coordinate with the ISP or DDoS protection provider in real-time. Some exchanges implement a “under attack mode” on their websites that presents a challenge (like a captcha) to filter out bots during an attack. While DDoS doesn’t directly breach security, prolonged downtime can erode user trust and cause financial losses through liquidations or missed trades, so it is a serious concern. In a few cases, DDoS has been paired with other attacks – e.g. hackers might trigger a DDoS to distract the security team while they attempt a hack elsewhere, or to exploit race conditions (For the B attack, attack A first).

DNS Hijacking and BGP Hijacking: These are attacks on the internet’s routing and naming systems, which can redirect traffic from the real exchange to a malicious server without the user realizing. In a DNS hijack, the attacker compromises the DNS records of the exchange’s domain – either by hacking the domain registrar account or manipulating DNS resolvers – so that the exchange’s URL directs to the attacker’s IP. For instance, in late 2020, attackers socially engineered a GoDaddy employee to transfer control of Liquid.com’s domain to them, temporarily hijacking DNS and gaining access to Liquid’s internal infrastructure (Liquid Hack: The Second Time Around | TRM Insights). Liquid later suffered a crypto theft of $90M in 2021, and the initial point of entry was traced back to that DNS hijack and subsequent compromise of internal systems ([Liquid Hack: The Second Time Around | TRM Insights](https://www.trmlabs.com/post/liquid-hack-the-second-time-around#::text=cryptocurrency%20exchange%20hack%20to%20take,to%20a%20DNS%20hijack%20attack)). This shows how DNS hijack can lead to a deeper breach: once the attackers controlled the domain, they could set up fake subdomains or intercept emails to reset passwords.

A BGP hijack is even lower-level: it involves taking over IP address routing. In April 2018, a well-publicized incident occurred with MyEtherWallet (a web wallet service). Attackers hijacked Border Gateway Protocol routes to reroute traffic meant for AWS DNS servers (Route 53) to their own server (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security). Essentially, they announced fake BGP routes that made a portion of internet traffic go to the wrong place, allowing them to serve a fake MyEtherWallet site via a malicious DNS response (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security) (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security). Users who tried to access MyEtherWallet during that window were quietly redirected to a phishing site (which had a self-signed TLS certificate warning, but some ignored it) (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security). By doing this, the attackers stole about $150,000 in Ethereum from users who entered their keys into the fake site (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security) (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security). While this attack targeted users of a wallet service, one can imagine the havoc if an exchange’s domain were similarly hijacked – users and even the exchange’s own API servers could be tricked.

Mitigations for DNS/BGP hijacking include using DNSSEC (to ensure DNS responses are signed and can’t be forged) and monitoring BGP routes to your IP spaces. Implementing HSTS (HTTP Strict Transport Security) and certificate pinning in clients can help detect impostor sites (in the MEW case, a certificate warning was the only clue of the attack (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security)). Exchanges should secure their domain registrar accounts with registry locks and out-of-band verification for changes, to prevent social engineering-induced transfers (as happened to Liquid). It’s also wise to use multi-factor auth on DNS administration accounts and limit who can make changes.

Cloud infrastructure and internal network breaches: Modern exchanges often run on cloud infrastructure (AWS, GCP, etc.) or complex data center setups. Attackers may probe these for misconfigurations – for example, an AWS S3 bucket left open that contains sensitive keys or credentials, or an exposed admin interface to a critical server. They may also attempt to exploit zero-day vulnerabilities in exchange servers. A stark example was KuCoin’s 2020 hack: it’s believed attackers had a long-running presence in KuCoin’s systems (an APT attack) and eventually obtained the private keys to KuCoin’s hot wallets (A Letter from KuCoin CEO: 2020, 2021 and Beyond). The CEO said the attacker “severely damaged our internal network, allowing them to bypass the security system… and obtain private keys of a few hot wallets.” (A Letter from KuCoin CEO: 2020, 2021 and Beyond). This implies the attackers might have exploited a server and moved laterally through the network. It highlights the need for strong internal segmentation – compromise of a web server should not easily lead to the wallet server. Networks should be partitioned, with firewalls limiting connections, and sensitive systems isolated.

Insider threats (discussed in the next section) also overlap here – an employee or contractor with legitimate access might abuse it or be coerced. For infrastructure security, applying zero trust principles is recommended: assume no user or system is inherently trusted, and require authentication and authorization checks even on internal connections. For example, if a developer workstation VPNs into the production network, it should only reach what is absolutely needed.

Exchanges should also keep all their software and dependencies up to date and apply security patches regularly. Many attacks (whether via phishing or direct hacking) eventually leverage a vulnerability in outdated software to escalate privileges.

Monitoring and detection: It’s critical to monitor DNS for unexpected changes, monitor certificates issued (via Certificate Transparency logs) for spoofed domains, and monitor network traffic for anomalies. In Liquid’s case, immediate detection of the DNS issue could have maybe limited subsequent damage. In internal networks, intrusion detection systems (IDS) and logs can alert to suspicious activity – e.g. an admin account logging in at odd hours or from an unusual IP, or a large data exfiltration. Some exchanges hire professional red teams to simulate these kinds of breaches and test the defenses.

Resilience and redundancy: Exchanges should prepare for infrastructure incidents by having redundancy. For instance, multiple DNS providers (so a single provider hijack doesn’t fully compromise the domain resolution), and fallback systems if one region goes down. Regular backup of servers and infrastructure as code can allow quick rebuilding if systems are wiped or ransomed.

In summary, infrastructure threats require exchanges to secure not just the crypto-specific parts, but their entire IT ecosystem. DDoS attacks call for robust network architecture and DDoS mitigation strategies. DNS/BGP hijacks demand vigilance and security at the registrar/ISP level, plus user-side protections like DNSSEC and HTTPS enforcement. Internal breaches necessitate strong host security, network segmentation, least privilege, and continuous monitoring. By hardening their infrastructure and having emergency plans (like traffic failover or manual trading halt procedures), exchanges can survive these attacks with minimal impact. Many top exchanges treat these issues as seriously as wallet security, recognizing that an attacker who can’t easily crack your crypto directly might instead attack the roads and maps that lead to it.

Insider Threats and Access Control Vulnerabilities

Not all threats come from the outside – some of the most damaging incidents have involved insiders or abuse of internal access. An “insider threat” is a malicious actor within the organization: it could be a disgruntled employee, a compromised staff member being coerced, or an ex-employee who retained access. Additionally, weaknesses in internal access controls (who can access what) can allow an external attacker who penetrates the perimeter to move freely and escalate privileges. Protecting against insider threats requires both human resource strategies (background checks, least privilege, separation of duties, employee offboarding) and technical enforcement (role-based access control, monitoring, and audit logs).

Malicious insiders – case in point: A striking example occurred with Cryptopia, a New Zealand exchange. In 2019, Cryptopia was hacked by external actors and later went into liquidation. During the cleanup in 2020, it was discovered that a former Cryptopia employee had secretly made a copy of numerous customers’ private keys before leaving the company, and later used them to steal about $170,000 NZD worth of crypto from the exchange’s wallets (Your keys, his coins — Cryptopia employee admits to stealing $172K in crypto ). He had actually raised security concerns about key management while at Cryptopia, and ironically took advantage of those flaws for personal gain (Your keys, his coins — Cryptopia employee admits to stealing $172K in crypto ). He was caught and pleaded guilty, but only after he’d already pilfered funds unnoticed for some time. This incident illustrates how insufficient internal controls over private keys enabled an insider to smuggle out key data. If private keys (or key shares) are accessible in a form that a single employee can copy (e.g. as unencrypted files or in memory), then an exchange is effectively trusting every person who can access those systems. Cryptopia should have had stricter data access policies and technical safeguards.

Another type of insider threat is privilege abuse: consider an employee with database access who decides to steal user data (emails, passwords) and sell it, or an admin who might divert small amounts of crypto to their own address hoping not to be noticed. While less common than external hacks, these scenarios can cause significant damage to reputation and user trust.

Compromised insiders: Sometimes an insider isn’t willingly malicious but is compromised by an external party. Attackers might bribe or blackmail an employee to gain access. For example, there have been cases outside crypto where IT admins were paid to install malware on their company’s network. In crypto, one fear is attackers targeting key custodians. If an attacker knows which employees control keys (or approve withdrawals), they might target those individuals with extortion. This is where operational security (OPSEC) is important – exchanges often keep the identity of key holders secret and may rotate duties to avoid making anyone a single point of failure.

Access control vulnerabilities: These refer to flaws in how internal permissions are set up. If too many people have broad access to critical systems, or if accounts aren’t properly revoked when someone leaves, it creates openings. A vivid example is the collapse of Mt. Gox in 2014, which some analyses suggest was partly due to poor segregation – auditors found that a Mt. Gox developer’s workstation was infected with malware that stole the wallet keys, possibly because sensitive keys were accessible outside secure servers. Similarly, FTX’s failure in 2022 (though fundamentally a fraud) was worsened by an almost nonexistent internal control: private keys and critical passwords were stored in plain text in an insecure manner, and practically no separation existed between roles. That is an extreme case of what not to do.

From a defensive standpoint, exchanges should enforce Least Privilege: each employee or service gets the minimum access necessary for their role, and nothing more. For instance, a customer support agent shouldn’t have the ability to withdraw funds or access wallet systems; a developer might have access to development systems but not production keys; a database admin can manage the database but cannot transfer funds, etc. High-risk operations (like moving cold storage funds) should require involvement of multiple people (this is both a multi-signature and a process requirement).

Distribution of duties is key. The person who can initiate a transaction should not be the same person who solely approves it. This principle is applied in multisig (requiring multiple key holders), but also in administrative actions – for example, if an engineer wants to deploy new code to the trading engine, perhaps a second engineer must review and approve the deployment.

Strong identity management: All internal accounts (for employees, contractors, system accounts) should use robust authentication (preferably hardware MFA as discussed). After the Coinbase employee phishing attempt, Coinbase reinforced use of hardware security keys across internal systems (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). Additionally, SSO (Single Sign-On) solutions can help centrally control and monitor access – if integrated with HR, the moment someone is terminated in HR records, their SSO account can be automatically disabled across all services.

Continuous monitoring and auditing: Exchanges should log all privileged actions: access to servers, queries on sensitive databases, use of admin credentials, etc. Automated systems can flag if an account starts doing something unusual (like if a junior employee account suddenly queries the entire user database at 2am). Regular audits of permissions can catch “permission creep” (where someone accumulates more access over time than they need). Auditors should review: who has access to the keys? Who can log into critical servers? Are there any shared accounts (which are risky; each person should have an individual account for accountability)?

Offboarding and key rotation: Ensure that when an employee leaves or is reassigned, their access is promptly revoked. In the Cryptopia case, the ex-employee walked away with a cache of private keys. Strict exit procedures (return hardware, disable accounts immediately, change any shared secrets they knew) are essential. It may also be prudent to rotate certain keys or passwords that a departing privileged employee had knowledge of, just in case they had malicious intentions.

To conclude, insider threats are mitigated by rigorously enforcing least privilege, monitoring, and fostering a security-aware culture. No single actor (human or machine) should have unchecked ability to move funds or alter critical systems. By dividing authority, even if one insider goes rogue or is compromised, they cannot unilaterally wreak havoc. Combined with background vetting and quick removal of access when people change roles or leave, these practices greatly reduce the risk from within.

Incident Response and Post-Breach Mitigation

Despite all preventive measures, breaches can still occur – no system is 100% impenetrable, especially against well-funded adversaries. What differentiates a catastrophic exchange hack from a contained incident often comes down to how the exchange responds in the aftermath. Incident response (IR) refers to the processes and actions taken once a security incident is detected, and post-breach mitigation involves steps to limit damage, recover assets if possible, and prevent future incidents. A well-handled incident can preserve user trust and even enable partial fund recovery, whereas a poor response can compound the harm.
(Bybit did it well, because they were responsible, but I give them 3.5 out of 10)

Immediate detection and action: Time is critical during a breach. Exchanges should have 24/7 security monitoring on their systems and blockchain transactions so that suspicious activity is noticed quickly. When Binance was hacked in May 2019 (7,000 BTC stolen from a hot wallet), they immediately noticed the unauthorized withdrawal transaction (it triggered alarms since it was a single large transfer exceeding normal limits) (Binance Hacked: $40 Million worth of Bitcoin stolen but funds are SAFU). Binance’s response was swift – they froze all withdrawals platform-wide as soon as the breach was confirmed, to stop any further outflows (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance). Similarly, Coincheck in 2018, upon realizing $530M NEM was stolen, halted all withdrawals and trading while they assessed the situation (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet). This containment step is crucial to prevent the attacker from stealing more if they have lingering access, and to prevent a panic bank-run by users that could complicate matters.

Secure the environment: The IR team’s first mandate is to secure any remaining systems – e.g. rotate keys that might be compromised, isolate affected servers, and ensure the attack is not still in progress. In the WazirX hack, by the time they realized it, the wallet was already drained; but they immediately suspended all crypto and fiat withdrawals on the platform to lock everything down ($235M WazirX exchange hack has implications for India’s crypto industry). Exchanges often put the site in maintenance mode during a major incident.

Communication: Transparent and timely communication with users and the public is key to maintaining trust. Hacked exchanges should quickly announce the basics (that a security incident occurred, what is known, what steps are being taken) – ideally before rumors spread. Binance’s CEO (CZ) tweeted that “funds are SAFU” (safe) right after their hack, indicating they would cover the losses (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance). He also did an AMA to address community questions soon after (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance). This openness likely helped Binance retain user confidence. In contrast, slow or misleading communication can damage an exchange’s reputation even more than the hack itself. Users understand that attacks happen; they want to see that the exchange is handling it responsibly.

Preserve evidence and investigate: Exchanges should immediately pull together a forensic investigation team. This might involve internal security engineers and external experts (many exchanges partner with blockchain analytics firms and cybersecurity firms for incident response). Key tasks include: analyzing server logs to determine the attack vector, tracing stolen funds on the blockchain, and identifying any indicators of compromise (malware, breached accounts, etc.). Preserving log data and not inadvertently destroying evidence during recovery is important for understanding what happened. Law enforcement should be engaged early for major thefts – agencies like the FBI or international cybercrime units have specialized experience in crypto investigations. For example, after the Bitfinex 2016 hack, blockchain analysis eventually led to arrests years later and recovery of a large portion of the bitcoins (the DOJ seized over $3.6B in 2022 from individuals laundering the Bitfinex funds). Such outcomes are only possible with thorough tracing and law enforcement cooperation.

Fund tracing and recovery: One advantage for defenders in crypto is that blockchains are transparent. Right after a hack, exchanges often work with blockchain analytics companies (Chainalysis, Elliptic, TRM Labs, etc.) to trace where the stolen crypto goes. In the DMM Bitcoin hack, analysts followed the BTC as it was split among addresses and noted a portion went to an entity called “Huione Guarantee” tied to cybercrime (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks). Exchanges worldwide can be alerted to blacklist those addresses. Sometimes, as in the Poly Network hack (2021), public outreach and negotiations led the hacker to return funds (that was a peculiar case where the hacker was "white hat"). More routinely, stolen funds get laundered through mixers and cross-chain swaps; still, tracing can eventually deanonymize some of it or catch the culprits when they try to cash out.

Exchanges have also sought help from blockchain communities – after the Coincheck NEM hack, the NEM developers implemented tracking flags on the stolen NEM, marking them so exchanges could recognize the stolen coins (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet) (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet). This doesn’t prevent movement, but it made laundering that stash harder. Cooperation across the crypto industry (other exchanges, token issuers, miners for possible chain reorg in extreme scenarios) can sometimes help in mitigation. Notably, when Binance was hacked, CZ considered (but ultimately decided against) attempting to coordinate a Bitcoin chain rollback to recover the funds – this idea was scrapped due to trust and feasibility concerns, but it shows the kinds of discussions that happen post-hack.

User protection and compensation: A top priority is deciding how to handle user losses. Ideally, exchanges will compensate affected users in full, either through insurance, emergency funds, or drawing on company reserves. This is critical for legal and reputational reasons. Binance famously had its SAFU (Secure Asset Fund for Users) – an insurance fund – which it tapped to cover the entire $40M loss, so no user lost money (Binance Hacked for 7000 BTC during Security Breach) (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance). This move was highly praised and solidified Binance’s standing. BitMart in 2021, after losing $150M to a hack, also pledged to use its own funds to compensate all users ([Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News](https://news.trendmicro.com/2021/12/08/crypto-exchange-bitmart-loses-150-million-to-hackers/#::text=in%20another%20statement%20released%20two,users%20with%20its%20own%20funding)) (Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News) (and they did gradually restore balances). Having such rainy-day funds or insurance is an important business decision for exchanges.

In cases where an exchange cannot immediately cover losses, they may take other measures. For example, Bitfinex in 2016 (120k BTC hack) issued BFX tokens to affected users representing their losses, and over time redeemed those tokens as they earned profits, eventually making users whole. It was an innovative approach to avoid collapse and showed commitment to repayment. Smaller exchanges that suffer devastating hacks sometimes choose to shut down if they cannot compensate (e.g., after the Mt. Gox hack, Mt. Gox went bankrupt; after the DMM and WazirX hacks, those exchanges wound down operations under regulatory pressure).

If an exchange does collapse, incident response shifts to protecting whatever assets remain and working with authorities in bankruptcy proceedings to return funds to users as much as possible.

Security review and remediation: After immediate issues are handled, a breached exchange must conduct a comprehensive post-mortem and improve its security before resuming normal operations. Binance, after their hack, suspended withdrawals for a week specifically to do a thorough security overhaul and patch any vulnerabilities (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance) (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance). They reportedly upgraded their 2FA systems, risk rules, and API security as a result. Similarly, an exchange in the aftermath might hire external auditors to audit their systems, and implement any recommended changes (e.g. tighter firewall rules, new SOC monitoring tools, rotating all secrets). Lessons learned are documented and fed back into the security program. In many cases, the very fact of a hack can spur an exchange to reach a much higher security standard than before – essentially hardening themselves so it doesn’t happen again in the same way.

Public accountability: Publishing a transparent incident report (once legal investigations allow) can help restore trust. Users appreciate knowing what exactly happened and what fixes have been made. For instance, Coinbase publicly blogged about the attempted phishing incident, detailing how they responded and that no funds were lost, which reinforced confidence in their security posture (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed) (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). In contrast, if an exchange is secretive or vague, users may fear lingering issues.

In summary, incident response is where all the preparedness (or lack thereof) becomes visible. A robust IR plan ensures that when the alarm goes off, everyone knows their role: technical teams race to contain and investigate, management communicates to users and coordinates externally, and plans to recover services and funds are set in motion. Exchanges that have survived hacks (like Bitfinex, Binance) did so by quickly compensating users and strengthening their defenses, often coming out more secure than before. Exchanges that handled it poorly often lost their business. Therefore, having a tested incident response plan – including simulations of major hacks – is just as important as having strong preventive controls. As the saying goes in security, “It’s not if you get breached, but when.” By accepting that reality, crypto exchanges can prepare to react swiftly and effectively, minimizing damage and maintaining the trust of their users even under some serious circumstances.

Conclusion

Securing a cryptocurrency exchange requires a comprehensive strategy balancing technical security measures with operational controls and vigilant processes. On the technical side, robust wallet architecture (favoring cold storage and multisig), stringent key management (HSMs, key shard separation), hardened APIs, and resilient infrastructure can thwart or limit most external attacks. Equally important are the human factors: continuous training against social engineering, strict internal access controls with least privilege, and a strong security culture to guard against insider threats. The case studies of DMM Bitcoin and WazirX in 2024 showed that even advanced defenses can be undone by subtle weaknesses – underscoring that security is an ongoing process of review and improvement.

Exchanges should operate under the assumption that motivated adversaries (including nation-state hackers) will target them, and thus adopt a defense-in-depth approach. No single safeguard is sufficient; multiple layers (preventive and detective) are needed so that if one fails, others stand. For example, if an employee is phished, 2FA and withdrawal limits should still prevent a large theft. If a hot wallet key is compromised, multisig and limited hot funds should prevent total loss. And if all that fails, an effective incident response can still prevent disaster and aid recovery.

In the volatile and high-stakes world of crypto, an exchange’s security is fundamental to its credibility. Major crypto exchanges are increasingly aligning with security best practices akin to traditional financial institutions, implementing measures like routine security audits, ISO 27001 certifications, and compliance checks that also bolster security (e.g. travel rule compliance requiring better identity management, which incidentally can reduce fraud). While compliance (KYC/AML) is often separate from cybersecurity, it can intersect – for instance, robust identity verification can deter account takeovers and insider collusion for money laundering. But the core focus remains on preventing hacking, fraud, and unauthorized access.

The attacks of recent years have provided painful lessons, but also clear guidance on defenses: Use cold storage and multisig to minimize crypto exposure, protect and monitor all keys, secure APIs and verify withdrawals with multiple checks, educate and test employees relentlessly, harden network and cloud infrastructure, limit trust in any single individual, and prepare for the worst with incident response and insurance. Exchanges that implement these multilayered controls are far less likely to be the next headline. Those that do not – as history shows – eventually learn that lesson the hard way.

As hackers continue to evolve their methods, exchanges must remain ever-vigilant and adaptive. Security is an arms race with no finish line – but with the right practices and culture, exchanges can stay one step ahead and keep customer funds safe even amidst relentless cyber threats.

References

1. Chainalysis – “Crypto Hacking in 2024 – $2.2B Stolen, North Korean Hackers Behind 61%”, CyberSecurityNews (Oct 2024). Highlights shift in 2024 with centralized exchanges becoming prime targets, citing DMM Bitcoin ($305M) and WazirX ($234.9M) hacks and noting private key compromises were the top attack vector (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks) (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks).

2. Chainalysis – “DPRK’s DMM Bitcoin exploit”, Chainalysis Blog (2024). Details the May 2024 DMM Bitcoin hack where 4,502 BTC ($305M) were stolen by compromising the exchange’s infrastructure and private keys ([Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks](https://cybersecuritynews.com/crypto-hacking-in-2024/#::text=According%20to%20a%20Chainanalysis%20report%2C,breach%20that%20compromised%20its%20infrastructure)). DMM covered losses but decided to shut down, migrating users to SBI VC Trade (Crypto Hacking in 2024 - $2.2 Billion Stolen, North Korean Hackers Behind 61% of Attacks).

3. Halborn – “Explained: The DMM Bitcoin Hack (May 2024)”, Halborn Blog (June 2024). Analyzed possible causes since DMM did not disclose details. Suggests likely exposed hot wallet key or compromised signing process (via social engineering or malware) as potential root causes (Explained: The DMM Bitcoin Hack (May 2024)). Emphasized lessons: use multi-sig and cold wallets to protect high-value accounts (Explained: The DMM Bitcoin Hack (May 2024)).

4. Halborn – “Explained: The WazirX Hack (July 2024)”, Halborn Blog (Aug 2024). Describes how WazirX’s 4-of-6 multisig (5 keys WazirX, 1 key Liminal) was defeated. The attacker tricked three WazirX signers and one Liminal signer into approving a transaction that switched the wallet’s implementation to a malicious contract, bypassing the multisig and whitelist (Explained: The WazirX Hack (July 2024)) (Explained: The WazirX Hack (July 2024)). Notes that WazirX had “checked all the boxes” on paper, so this attack highlights need for holistic security audits (Explained: The WazirX Hack (July 2024)).

5. Cointelegraph – “$235M WazirX exchange hack has implications for India’s crypto industry” by S. Jagati (Jul 22, 2024). Confirms North Korean Lazarus Group suspected. Provides a timeline: attacker funded a wallet via Tornado Cash, deployed a malicious contract 8 days prior, then used it to change WazirX’s Gnosis Safe contract with 4 signatures just before the hack ($235M WazirX exchange hack has implications for India’s crypto industry). Cyvers CTO Meir Dolev explains the attacker likely compromised WazirX endpoints or did a UI hijack on Liminal to trick signers ($235M WazirX exchange hack has implications for India’s crypto industry) ($235M WazirX exchange hack has implications for India’s crypto industry).

6. Cointelegraph – “Coincheck: Stolen $534M NEM Were Stored On Low Security Hot Wallet” by J. Buck (Jan 26, 2018). Reports that Coincheck had 523M NEM ($534M) in a single-signature hot wallet with a stolen private key ([Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet](https://cointelegraph.com/news/coincheck-stolen-534-mln-nem-were-stored-on-low-security-hot-wallet#::text=Coincheck%3A%20Stolen%20%24534%20Mln%20NEM,On%20Low%20Security%20Hot%20Wallet)) (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet). No multisig was used for NEM, unlike Coincheck’s other assets, which the exchange admitted was a security oversight (Coincheck: Stolen $534 Mln NEM Were Stored On Low Security Hot Wallet).

7. Trend Micro – “Crypto Exchange BitMart Loses $150 Million to Hackers” (Dec 8, 2021). Describes BitMart’s hack: the attackers stole $150M from two hot wallets (ETH and BSC) using a stolen private key ([Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News](https://news.trendmicro.com/2021/12/08/crypto-exchange-bitmart-loses-150-million-to-hackers/#::text=conducting%20its%20initial%20investigation%20into,users%20with%20its%20own%20funding)). BitMart confirmed other assets were safe and that it would compensate affected users from its own funds (Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News). Also explains hot vs cold wallet difference and that hot wallets carry greater risk for convenience (Crypto Exchange BitMart Loses $150 Million to Hackers | Trend Micro News).

8. Trend Micro – “Large-Scale Heist of Cryptocurrency Exchange Binance Fails” by F. Mercado (Mar 9, 2018). Details the attempted Binance hack: phishers obtained API keys from users via a lookalike domain and, in a 2-minute window on Mar 7, 2018, used those API keys to place massive buy orders on VIA/BTC, pumping Viacoin’s price 10,000% ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ) ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ). Withdrawal attempts of the illicit profits were made immediately, but Binance’s risk management detected the irregular activity and halted all withdrawals almost instantly ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ). The hackers’ accounts (preloaded with VIA) were frozen, leaving the hackers at a loss and affected users’ funds safe ( Large-Scale Heist of Cryptocurrency Exchange Binance Fails | Trend Micro (US) ).

9. The Hacker News – “Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed” by R. Lakshmanan (Feb 21, 2023). Coinbase disclosed an attempted breach targeting employees. Multiple staff got fake SMS messages prompting login; one employee entered credentials on a phish site (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). MFA prevented the attacker from accessing systems (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). The attacker then called the employee posing as IT; the employee grew suspicious and Coinbase’s security team intervened within 10 minutes (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed) (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). No funds were lost; only some employee directory info was exposed (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed). Coinbase credited its “cyber controls” (MFA, monitoring) for preventing further damage (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed) (Coinbase Employee Falls for SMS Scam in Cyber Attack, Limited Data Exposed).

10. Bleeping Computer – “FBI warns crypto firms of aggressive social engineering attacks” by S. Gatlan (Sept 3, 2024). FBI warning that North Korean hacking groups (Lazarus) are extensively targeting crypto company employees with sophisticated social engineering, including well-researched phishing that often involves fake job offers or investment opportunities (FBI warns crypto firms of aggressive social engineering attacks) (FBI warns crypto firms of aggressive social engineering attacks). They impersonate known contacts or recruiters, speak fluent English, and leverage detailed personal info to build credibility (FBI warns crypto firms of aggressive social engineering attacks) (FBI warns crypto firms of aggressive social engineering attacks). The goal is to trick employees into downloading malware or giving up access, ultimately to steal crypto assets.

11. Decrypt – “Two Bitcoin exchanges suffer DDoS attacks in a matter of hours” by D. Phillips (Feb 28, 2020). Reports that Bitfinex and OKEx were hit with major DDoS attacks within the same 24-hour period (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt) (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt). Bitfinex was offline for under an hour before mitigation; OKEx was down for a few hours. Bitfinex noted it uses “intelligent load balancing and Cloudflare DDoS protection,” but the attack still caused issues, implying a very high volume attack (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt) (Two Bitcoin exchanges suffer DDoS attacks in a matter of hours - Decrypt). Both exchanges increased protections and resumed operations later that day.

12. TRM Labs – “Liquid Hack: The Second Time Around” (Aug 19, 2021). Describes the Aug 2021 Liquid exchange hack ($90M stolen) and references an earlier incident: in late 2020, Liquid’s domain registrar (GoDaddy) was socially engineered to transfer control of the domain, enabling a DNS hijack attack ([Liquid Hack: The Second Time Around | TRM Insights](https://www.trmlabs.com/post/liquid-hack-the-second-time-around#::text=cryptocurrency%20exchange%20hack%20to%20take,to%20a%20DNS%20hijack%20attack)). That 2020 DNS hijack allowed attackers to compromise Liquid’s internal network (the first known case of a major exchange breach via DNS social engineering) (Liquid Hack: The Second Time Around | TRM Insights). Liquid’s 2021 hack involved the attacker gaining access to warm wallets; it’s likely the foothold from the DNS incident contributed.

13. Help Net Security – “MyEtherWallet users robbed after successful DNS hijacking attack” by Z. Zorz (Apr 25, 2018). Explains how attackers stole funds by hijacking BGP routes to corrupt DNS for MyEtherWallet. They rerouted traffic for AWS Route 53 DNS servers via a server in Chicago, allowing them to serve a phishing version of MyEtherWallet for 2 hours ([MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security](https://www.helpnetsecurity.com/2018/04/25/myetherwallet-dns-hijacking/#::text=MyEtherWallet,DNS%20service)) (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security). Users who ignored a TLS certificate warning and logged in had their private keys stolen, resulting in $150k in ETH theft ([MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security](https://www.helpnetsecurity.com/2018/04/25/myetherwallet-dns-hijacking/#::text=Unknown%20attackers%20have%20managed%20to,com)) (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security). MEW clarified that its own security wasn’t breached – the attack exploited internet infrastructure (BGP/DNS) vulnerabilities (MyEtherWallet users robbed after successful DNS hijacking attack - Help Net Security).

14. Cointelegraph – “Your keys, his coins — Cryptopia employee admits to stealing $172K in crypto” by T. Wright (Jul 5, 2021). Reports that a former Cryptopia employee copied users’ private keys onto a USB during his tenure and later, after the exchange had gone into liquidation, used those keys to withdraw about NZD 245k ($172k) in crypto from dormant wallets ([Your keys, his coins — Cryptopia employee admits to stealing $172K in crypto](https://cointelegraph.com/news/your-keys-his-coins-cryptopia-employee-admits-to-stealing-172k-in-crypto#::text=A%20former%20employee%20of%20the,copy%20of%20users%E2%80%99%20private%20keys) ). He pleaded guilty to theft and “theft by person in a special relationship.” The employee had earlier raised concerns about key security to management, then took advantage of the weak controls by keeping a cache of keys (Your keys, his coins — Cryptopia employee admits to stealing $172K in crypto ). The theft was noticed by Grant Thornton auditors when they saw unauthorized withdrawals from old wallets (Your keys, his coins — Cryptopia employee admits to stealing $172K in crypto ).

15. CoinDesk – “Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance” by N. De (May 7, 2019). Binance revealed a “large scale security breach” where hackers obtained a variety of user API keys, 2FA codes, and possibly other info, allowing them to withdraw 7,000 BTC ($41M) in one go ([Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance](https://www.coindesk.com/markets/2019/05/07/hackers-steal-407-million-in-bitcoin-from-crypto-exchange-binance#::text=that%20a%20,published%20in%20the%20security%20notice)). The hackers used sophisticated tactics and patiently waited to execute the attack. Binance froze withdrawals immediately and initiated a security review to shore up vulnerabilities (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance). Importantly, Binance announced it would use its Secure Asset Fund for Users (SAFU) – an emergency insurance fund – to cover the entire loss so that users were not affected (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance). The SAFU fund, financed by 10% of trading fees and stored in cold storage, ensured no customer funds were lost (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance) (Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance). This response (halting withdrawals, conducting a week-long security overhaul, and reimbursing via SAFU) was applauded as a textbook incident response that maintained user confidence.

MITRE ATT&CK Style Checklist for Crypto Exchange Security and apply for the recent the biggest theft

1. Initial Access

• Phishing & Social Engineering
  • Security awareness training
  • Simulated phishing campaigns
  • Hardware MFA for all internal systems
  • Email gateway filtering
  • Endpoint protection
• Supply Chain Compromise
  • Vet third-party API integrations
  • Isolate third-party services
  • API key least-privilege
• Exploiting Public-facing Applications
  • Regular vulnerability scans
  • Prompt software patching
  • Web application firewall (WAF)

2. Execution

• Malware Deployment
  • Endpoint Detection and Response (EDR)
  • Application whitelisting
• Malicious Smart Contract Execution
  • Smart contract audits
  • Verify smart contract upgrade processes with multisig checks
  • User Interface audits for wallet interactions

3. Persistence

• Malicious Account Creation
  • Enforce KYC
  • Monitor unusual account activities
  • Account lifecycle management
• Backdoor Smart Contract Code
  • Continuous monitoring of smart contracts (if possible)
  • Multisig enforced code upgrades

4. Privilege Escalation

• Exploitation of Misconfigured Privileges
  • Principle of least privilege (PoLP)
  • Regular privilege audits
  • Separation of duties
• Compromise of Administrative Credentials
  • Hardware-based MFA
  • Admin account isolation and rotation
  • Privileged Access Management (PAM) systems

5. Credential Access

• Phishing for Credentials
  • Mandatory security keys for authentication
  • Awareness training reinforced by phishing tests
• Key Management Flaws
  • Use HSM for key storage
  • Multi-party computation (MPC) or multisig wallets
  • Regular key ceremony audits
  • Geographic key distribution

6. Discovery

• Internal Network Enumeration
  • Network segmentation
  • IDS/IPS monitoring
  • Zero Trust principles applied internally

7. Lateral Movement

• Exploiting Internal API Vulnerabilities
  • API security testing
  • Strong multiple authentication
  • Access control lists (ACL) and IP whitelisting

8. Collection

• Unauthorized Key Extraction
  • Restrict direct access to private keys
  • Secure offline backups with quorum controls
  • Key management software audits

9. Exfiltration

• Unauthorized Fund Withdrawal
  • Withdrawal address whitelisting
  • Transaction monitoring & anomaly detection
  • Tiered withdrawal limits
  • Require manual approval for high-risk withdrawals

10. Command and Control

• DNS/BGP Hijacking
  • DNSSEC implementation
  • Registrar account protections (multi-factor, registry lock)
  • HSTS enforcement
  • Real-time route monitoring

11. Impact

• Denial of Service (DDoS)
  • DDoS mitigation services (Cloudflare, Akamai)
  • Redundant and scalable architecture
  • Under-attack mitigation modes
• Theft of Funds
  • Minimal hot wallet exposure
  • 90-95% cold storage policy
  • Insurance for assets
  • Emergency compensation funds (e.g., SAFU Fund)

12. Incident Response & Mitigation

• Incident Detection and Response
  • 24/7 SOC with defined incident playbooks
  • Rapid freezing of assets & withdrawals upon breach detection (if possible)
  • Transparent communication strategy
• Forensic Investigation
  • Blockchain transaction tracing
  • Server and log analysis
  • Engage law enforcement early
• Recovery and Compensation
  • Clear plan to reimburse customers (insurance/fund reserves)
  • Alternative compensation methods (tokens, gradual reimbursements)
• Post-Incident Security Enhancement
  • Post-mortem report publication
  • External security audits post-incident
  • Rapid remediation of discovered vulnerabilities

Apply it to the biggest theft

The $1.5 billion theft from Bybit in February 2025 stands as the largest cryptocurrency heist to date, attributed to the North Korean state-sponsored Lazarus Group. Analyzing this incident through the MITRE ATT&CK framework for crypto exchange security reveals critical areas of concern (matthewsu, 2025; Jackson, 2025; CoinMarketCap, 2025; Huang & McMillan, 2025; Team, 2025; Doye, 2025) :

1. Initial Access

• Supply Chain Compromise
  • Issue: Attackers compromised a developer's machine associated with SafeWallet, a multisignature wallet service used by Bybit. This breach allowed them to inject malicious code into SafeWallet's infrastructure(CoinMarketCap, 2025).
  • Reason for Concern: Compromising a third-party service provider can grant attackers indirect access to the primary target, bypassing direct security measures.

2. Execution

• Malicious Smart Contract Execution
  • Issue: The injected malicious code manipulated the user interface presented to Bybit's wallet signers, deceiving them into authorizing unauthorized transactions(CoinMarketCap, 2025).
  • Reason for Concern: Even with secure smart contract protocols, compromised interfaces can lead to unauthorized executions(matthewsu, 2025).

3. Persistence

• Backdoor Smart Contract Code
  • Issue: Attackers altered the smart contract logic within SafeWallet, ensuring continued access and control over transaction approvals(CoinMarketCap, 2025).
  • Reason for Concern: Persistent backdoors allow attackers to maintain long-term unauthorized access, increasing potential damage.

4. Privilege Escalation

• Compromise of Administrative Credentials
  • Issue: By compromising SafeWallet's infrastructure, attackers effectively escalated privileges, gaining control over Bybit's multisignature wallet operations(matthewsu, 2025).
  • Reason for Concern: Elevated privileges enable attackers to execute high-impact actions, such as large fund transfers.

5. Defense Evasion

• Cross-chain Bridges for Laundering
  • Issue: Post-theft, the stolen assets were laundered through decentralized exchanges and cross-chain bridges, complicating tracking efforts(Team, 2025)
  • Reason for Concern: Utilizing multiple platforms and chains hinders asset recovery and obfuscates transaction trails.

6. Discovery

• Internal Network Enumeration
  • Issue: Attackers likely conducted reconnaissance within SafeWallet's infrastructure to identify and exploit vulnerabilities.
  • Reason for Concern: Understanding internal architectures enables attackers to craft precise and effective attack strategies.

7. Lateral Movement

• Exploiting Internal API Vulnerabilities
  • Issue: Manipulation of SafeWallet's APIs facilitated unauthorized transaction approvals.
  • Reason for Concern: Exploiting internal APIs can allow attackers to move laterally within systems, accessing broader functionalities.

8. Collection

• Unauthorized Key Extraction
  • Issue: Through the compromised infrastructure, attackers effectively extracted control over transaction signing keys(matthewsu, 2025).
  • Reason for Concern: Access to signing keys permits unauthorized transactions and fund transfers.

9. Exfiltration

• Unauthorized Fund Withdrawal
  • Issue: Attackers transferred approximately 401,000 ETH, valued at nearly $1.5 billion, to addresses under their control(Team, 2025)
  • Reason for Concern: Large-scale unauthorized withdrawals can destabilize platforms and erode user trust.

10. Command and Control

• DNS/BGP Hijacking
  • Issue: While not explicitly reported, compromising SafeWallet's infrastructure could involve manipulating network protocols to maintain control(CoinMarketCap, 2025).
  • Reason for Concern: Control over network protocols can facilitate persistent access and data interception.

11. Impact

• Theft of Funds
  • Issue: The heist resulted in the loss of $1.5 billion in digital assets, marking the largest crypto theft to date(Doye, 2025).
  • Reason for Concern: Significant financial losses can lead to insolvency and loss of stakeholder confidence.

12. Incident Response & Mitigation

• Incident Detection and Response

  • Issue: Bybit detected the unauthorized transfer during a routine operation and initiated emergency protocols(Huang & McMillan, 2025).
  • Reason for Concern: Timely detection is crucial to mitigate damage and initiate recovery processes.

• Forensic Investigation

  • Issue: Investigations traced the breach to a compromised developer machine associated with SafeWallet (CoinMarketCap, 2025).
  • Reason for Concern: Identifying the attack vector is essential for remediation and future prevention.

• Recovery and Compensation

  • Issue: Bybit replenished user funds by securing reserves through loans and asset purchases, ensuring full backing of client assets(CoinMarketCap, 2025).
  • Reason for Concern: Ensuring user assets are protected maintains trust and platform stability.

• Post-Incident Security Enhancement

  • Issue: SafeWallet rebuilt and reconfigured its infrastructure, implementing enhanced security measures post-incident(CoinMarketCap, 2025).
  • Reason for Concern: Strengthening security post-incident is vital to prevent recurrence and restore confidence.

    References

1. Jackson, D. (2025, March 3). How North Korea Pulled Off the $1.5B Bybit Hack—Crypto’s Biggest Heist. TechRepublic. https://www.techrepublic.com/article/bybit-hack-north-korea-crypto-heist-2025/

2. CoinMarketCap. (2025, February 27). Bybit Hack Forensics Show North Korean Hackers Stole $1.5 Billion in Largest Crypto Heist by Exploiting SafeWallet Developer. CoinMarketCap Academy; CoinMarketCap. https://coinmarketcap.com/academy/article/bybit-hack-forensics-show-north-korean-hackers-stole-dollar15-billion-in-largest-crypto-heist-by-exploiting-safewallet-developer

3. matthewsu. (2025, February 23). The Bybit Incident: When Research Meets Reality - Check Point Research. Check Point Research. https://research.checkpoint.com/2025/the-bybit-incident-when-research-meets-reality/

4. Doye, L. (2025, February 28). Bitcoin value TANKS in $1trillion market shock after world’s biggest $1.5bn crypto heist…as FBI confirms pr... The US Sun. https://www.the-sun.com/money/13648917/bitcoin-value-tanks-worlds-biggest-crypto-heist-north-korea/

5. Team, C. (2025, February 24). Collaboration in the Wake of Record-Breaking Bybit Theft. Chainalysis. https://www.chainalysis.com/blog/bybit-exchange-hack-february-2025-crypto-security-dprk/
   ‌

6. Huang, V. G., & McMillan, R. (2025, March 6). How the Biggest Crypto Hack Ever Nearly Destroyed Bybit, the World’s No. 2 Exchange. WSJ; The Wall Street Journal. https://www.wsj.com/finance/currencies/how-the-biggest-crypto-hack-ever-nearly-destroyed-the-worlds-no-2-exchange-ee273a3a