The lack of open communication between blockchain security companies requires urgent action.
After a wave of high-profile hacks, it’s high time to address the prevalence of multi-million dollar hacks. Even respected figureheads like Vitalik Buterin and Mark Cuban are not immune, having lost more than $1 million due to a hacked Twitter account and a hacked wallet, respectively.
Without a doubt, technical capabilities matter in securing funds from bad actors. However, there is a crucial component that is overlooked today: teamwork. If we are to successfully neutralize the risks of financial and reputational loss for the industry, communication and cooperation between blockchain security companies is necessary.
A prominent example: The lack of effective communication exacerbated the Curve hack this summer and should serve as an important wake-up call for the industry.
Read more: Mixin stops recording because the network suffers a $200 million loss due to a hack
Security experts faced challenges in quickly coordinating their actions, resulting in missed opportunities for effective execution. Multiple security teams operated independently to recover and protect users’ funds, causing redundant efforts and delayed response time. Due to the ambiguous nature of white hat hacking, certain security teams have requested explicit permission from Curve before attempting remediation. Consequently, the attacker managed to steal money before the coordinated white hat team could secure it.
Openly discussing exploits, vulnerabilities, and root causes is already the norm in traditional cybersecurity, as companies follow established protocols for responsible vulnerability disclosure.
Blockchain security companies can and should adopt similar practices and ensure they can communicate vulnerabilities responsibly to relevant projects and communities to minimize risks in the most efficient way.
Solid examples of streamlined communications that we see in more traditional cybersecurity include Europol, a criminal information and intelligence database that collects information about cybercrime and makes that information available to the broader public. Another example is the Common Vulnerabilities and Exposures (CVE), a publicly available database of known cybersecurity vulnerabilities.
Collaborating with security experts from competing companies, and not just colleagues, is a valuable approach, driven by an ethos of collaboration for the common good. One example of this already in action in the crypto space is the Seal 911 initiative, a collective of blockchain security experts working together to provide support from a Telegram group. To date, Seal 911’s coordinated response has helped prevent a $200,000 theft.
Resources that pool information allow the community to more effectively monitor vulnerabilities and respond accordingly. However, there is no such standardized process in Web3.
Read more: Mark Cuban loses almost $900,000 due to the fake MetaMask
Since the sector is still relatively emerging, this is not surprising. However, blockchain security companies must work together to create standardized protocols for common vulnerabilities across all Web3 projects – using traditional cybersecurity resources as templates.
Crypto cybersecurity practices are now simply lacking
Relying on white hat hackers in crypto has proven extremely valuable so far, saving individual projects millions in financial losses in preventing each hack. However, relying solely on white hat hackers is not an efficient all-encompassing strategy.
Executing a white hat strategy requires a costly on-chain procedure to transfer funds to a trusted third party, followed by the need for that trusted third party to return the funds to the protocol or to individual users.
While advertising a white hat bounty can entice the most skilled white hat hackers to quickly resolve security issues, it can also inadvertently give attackers hints that important or sensitive work is underway. This can spread disinformation, potentially creating confusion about whether the event is an external attack or an asset protection operation (carried out by internal teams). Solving safety problems publicly is not always the most effective solution.
Web3’s desire for anonymity, often due to regulatory pressure, can also create uncertainty, as it can be unclear how to contact a trusted person within a protocol. Vulnerabilities should ideally be communicated to the relevant parties first so that projects have a fair opportunity to correct them before disclosing the vulnerabilities to a wider audience. But the reality is that bad actors are often inadvertently tipped off at the same time, making the situation worse.
Collaboration should be embraced by blockchain security companies and experts. Only by working cohesively together can blockchain security companies establish best practices and standards for securing blockchain networks and decentralized applications.
Brian Pak is CEO and co-founder of ChainLight, an award-winning blockchain security company specializing in smart contract audits and on-chain monitoring. He has also co-founded Theori since 2016, a US-based offensive cybersecurity company, which he continues to lead and has now gathered trusted partners including Microsoft, Google and Samsung. Brian’s early career began when he co-founded and developed Kaprica Security and invented and patented the Skorpion Charger, an Android mobile charger that can detect malicious software without requiring user action. He has worked on research and development projects with the US Defense Advanced Research Projects Agency (DARPA). Brian is also the founder of the PPP (Plaid Parliament of Pwning) team that won DEF CON CTF, one of the most prestigious hacker competitions in Las Vegas, in 2013, 2014, 2016, 2017, 2019, 2022 and 2023. Brian graduated with a master’s degree in software security research from Carnegie Mellon University.