This article is the third in a four-part series exploring the differences between traditional IT security and blockchain security. Check out the first two articles in the series exploring the differences for node operators and application developers.
This article explores how user security differs between traditional IT and blockchain environments. While identical products and services may be hosted in traditional IT and blockchain environments, the differences between these ecosystems can have significant security implications for their users.
IT vs. Blockchain Security for Users
Traditional IT and the blockchain operate under very different philosophies. Many traditional IT systems are centralized and try to...
This article is the second in a four-part series discussing the differences between traditional IT security / cybersecurity and blockchain security. Check out the first article in the series discussing the differences for node operators.
This article focuses on the differences between application security (AppSec) for traditional applications and smart contracts. While the first blockchains, like Bitcoin, were not designed to support smart contracts, their invention dramatically expanded the capabilities of blockchain platforms. The ability to deploy code on top of the blockchain has been one of the main drivers of blockchain’s widespread adoption and success.
Traditional Development vs. Smart Contract...
Recent events like the FTX meltdown have sparked interest and conversations about how the incident could have been prevented. In the case of FTX, the primary problem was that the platform did not hold sufficient assets to cover its user deposits and liabilities.
What are Merkle Trees and Proofs?
Proof of Reserves and Proof of Liabilities can use Merkle trees to prove certain facts while keeping data anonymous. To understand how these schemes work, it is useful to understand Merkle trees first.
A Merkle tree is designed to securely summarize a set of data. This means that, given the root value of...
Blockchain is a rapidly-evolving technology with a great deal of interest and investment. Decentralized Finance (DeFi), in particular, has a great deal of money invested in it as well as a growing number of high-profile and expensive hacks. Beyond DeFi, many companies, both large and small, are investing heavily in blockchain technology.
As blockchain increasingly underpins major systems, securing this technology becomes increasingly vital. Financial systems built on the blockchain can suffer significant losses due to blockchain hacks. The use of blockchain for supply chain tracking and audit logging relies on the blockchain being immutable.
However, the widespread adoption of blockchain...
The most comprehensive ranked list of the biggest crypto hacks in history (Up until November 1, 2022. I suspect a larger one is just behind the corner)
It wasn’t easy digging through the entire history of cybercrime involving cryptocurrencies, but I wanted to get to the bottom of which ones were the biggest in terms of total value of the stolen digital assets at the time of the incident. Two of the entries occurred while I was conducting my research; that’s how I know this will be the most accurate and up-to-date list of the top 12 hacking incidents in...
$566M worth of BNB was stolen from Binance’s cross-chain bridge BSC Token Hub, but how they responded to the hack will be the most memorable part.
Decentralization is a hot button topic in web3, and Binance is (at the time of writing) the biggest crypto exchange by trading volume in the world.
The recent hack of Binance’s native cross-chain bridge BSC Token Hub revealed to the world what many early adopters of blockchain technology already knew: The BNB Smart Chain (formerly Binance Smart Chain) is not very "decentralized".
How did the BNB Smart Chain bridge get hacked, how did Binance stop it,...
Understanding how flash loans and governance work in DeFi to demystify the Beanstalk Farms Hack
The only way to understand how the Beanstalk Farms decentralized credit-based stablecoin protocol exploit happened is to first understand flash loans, which are a little known financial tool unique to the DeFi (decentralized finance) space, as well as governance.
A flash loan is, like it sounds, a very fast loan. It happens within a single blockchain transaction and no collateral is needed. Instead, the borrower needs to set up a series of trades using smart contracts that can all be executed at once, and they must...
Code reuse is considered best practice in software engineering. Reusing high-quality, secure code can speed development processes and often results in higher-quality code than software developed entirely from scratch. Additionally, the reuse of high-quality, audited libraries reduces security risks by decreasing the probability that new vulnerabilities will creep into the code base.
In open source communities such as the blockchain and crypto community, code reuse is even more strongly encouraged. Open-source code released with permissive licenses is intended to be reused in other projects.
However, this can also create security risks. Smart contracts and other software that reuses existing, open-source code...
One attacker and hundreds of copycats looted the Nomad bridge for over $190 million; few did the right thing.
Decentralization is a hot-button topic in 2022.
To some, it seems like the solution to a variety of issues plaguing the so-called web2 ecosystem, such as the monopolization of social media, the centralized control over the flow of information, and bad data privacy and data monetization practices. Proponents of distributed blockchain technology offer web3 as the decentralized solution to these problems, but web3 has some kinks to work out before it can replace the established infrastructure of web2.
One of those kinks involves...
Proving knowledge of a secret is the basis of password-based authentication systems. The assumption is that only you know your password. If this is the case, entering your password into a system proves your identity and grants you access to your account.
However, this approach doesn’t work as well on the blockchain, where everything stored on the digital ledger is publicly visible. Any password or other secret included within a blockchain transaction would be revealed to all nodes and users of the blockchain. This is where zero-knowledge proofs (ZKPs) come into play.
What is a Zero-Knowledge Proof?
A ZKP allows a prover...
The $611M Poly Network exploit is the largest crypto hack to date in terms of mark-to-market value and all the stolen funds were returned, but the identity of the hacker is still unknown.
Dubbed “Mr. White Hat” by the Poly Network security team, the anonymous perpetrator of the biggest crypto hack to date gave all the stolen crypto assets back within 15 days of the incident.
But how was the hack carried out? Why did they return the funds? And how did they manage to remain anonymous? We’ll explore these questions, but first..
What is the Poly Network?
The Poly Network is a...
Getting to the bottom of the exploit that led to one of the biggest hacks in the history of decentralized finance.
In order to understand the $160M Wintermute hack, we first need to understand algorithmic market makers and how they work in DeFi (decentralized finance), since that’s what Wintermute is.
Imagine you’re the developer of a crypto project and you expect to get your token listed on a large exchange, even a top 10 such as Kraken or Binance. It sounds great, but now you have a new problem because you’ll need to constantly ensure the exchange always has enough liquidity...
What Are Blockchains Layers 0, 1, and 2?
A blockchain is a complex, multi-layered system. Bitcoin, the original blockchain, maintained a distributed and decentralized digital ledger on top of a peer-to-peer network. Later blockchains, like Ethereum, added complexity by integrating smart contract functionality and the technology needed to support these programs that run on top of the blockchain.
In addition to these various layers within a blockchain, there is now the concept of Layer 0, 1, and 2 blockchain solutions. Each of these “layers” is intended to describe a particular function that has been added to or abstracted from the blockchain.
In...
A missing pile of Safemoon and other cryptocurrencies, accusations of broken promises, and then nothing.
When a high-profile cyber attack takes place and hundreds of millions of dollars are lost, usually a healthy balance is struck between safeguarding information to protect ongoing investigations and maintaining a level of transparent communication with the public.
In the case of BitMart’s security breach, they chose to keep a lot under wraps. We can still get a general idea of what happened and what went wrong from a string of statements they made early on.
This is the fullest story you’ll find on what happened with...
In recent years, many organizations have adopted more modern development practices, including Agile, Scrum, and DevOps. The goal of these new processes is to improve the pace and efficiency of development by streamlining the development process and using automation whenever possible.
One of the main shortcomings of most DevOps programs is that they overlook security, focusing on getting software released as quickly as possible. As a result, tens of thousands of vulnerabilities reach production each year, putting customers at risk. Additionally, fixing vulnerabilities in production is costlier than in the development and steals resources away from developing new software.
With the...