The lack of open communication between blockchain security firms requires urgent action.
Following a spate of high-profile hacks, the time to address the prevalence of multi-million-dollar hacks is severely overdue. Not even respected figureheads like Vitalik Buterin and Mark Cuban are immune, with over $1 million lost following a hacked Twitter account and wallet, respectively.
Without a doubt, technical capabilities matter in securing funds against bad actors. However, there is a critical component that is being overlooked in the present: teamwork. If we are to successfully neutralize the risks of financial and reputational loss to the industry, communication and collaboration between blockchain security firms is necessary.
As one prominent example, the lack of effective communication exacerbated the Curve hack this summer and should serve as an important wake-up call for the industry.
Read more: Mixin halts withdrawals as network suffers $200M loss in hack
Security experts faced challenges in rapidly coordinating their actions, resulting in missed opportunities for effective execution. Multiple security teams operated independently to recover and protect user funds, causing redundant efforts and a delayed response time. Due to the ambiguous nature of white hat hacking, certain security teams sought explicit permission from Curve before initiating any recovery efforts. Consequently, the attacker managed to steal funds before the coordinated white hat team could secure them.
Openly discussing exploits, vulnerabilities and root causes is already the norm in traditional cybersecurity, as firmsfollow established protocols for the responsible disclosure of vulnerabilities.
Blockchain security firms can and should adopt similar practices, ensuring that they are able to communicate vulnerabilities responsibly to relevant projects and communities to minimize risk in the most efficient way possible.
Solid examples of streamlined communication seen in more traditional cybersecurity include Europol, a criminal information and intelligence database that collates information on cybercrime, making this information available to the wider public. Another example is the Common Vulnerabilities and Exposures (CVE), a publicly available database listing known cybersecurity vulnerabilities.
Working alongside security experts from rival firms, not only with colleagues, is a valuable approach driven by an ethos of collaboration for the greater good. One such example already in action in crypto is the Seal 911 initiative, a collective of blockchain security experts working together to offer support from within a Telegram group. So far, Seal 911’s coordinated response has helped prevent a $200,000 theft.
Resources that pool information empower the community to more effectively monitor vulnerabilities and respond accordingly. However, there is no one such standardized process in Web3.
Read more: Mark Cuban loses nearly $900k on MetaMask fake
As the industry is still relatively nascent, this is not surprising. However, blockchain security firms should join together to create standardized protocols for common vulnerabilities for all Web3 projects — using the traditional cybersecurity resources as templates.
Crypto cybersecurity practices now are simply lacking
Relying on white hat hackers in crypto has proven extremely valuable up until now, saving individual projects millions in financial losses with each hack averted. However, relying on white hat hackers alone is not an efficient catch-all strategy.
The execution of a white hat strategy necessitates a costly on-chain procedure to transfer funds to a trusted third party, followed by the need for that trusted third party to return the funds to the protocol or individual users.
While advertising a white hat bounty can entice the most skilled white hat hackers to solve security issues quickly, it can also inadvertently provide attackers with hints that important or sensitive work is underway. This can propagate misinformation, potentially causing confusion about whether the event is an external attack or an asset protection operation (done by internal teams). Solving security issues publicly is not always the most effective solution.
Web3’s penchant for anonymity, often due to legal and regulatory pressure, can also create uncertainty, as it can be unclear how to contact a trustworthy person within a protocol. Vulnerabilities should ideally be communicated to relevant parties first, in order to allow projects a fair opportunity to correct them before disclosing vulnerabilities to a wider audience. Yet the reality is that bad actors are often tipped off inadvertently at the same time, making the situation worse.
Collaboration must be embraced by blockchain security firms and experts. Only by working together cohesively can blockchain security firms establish best practices and standards for securing blockchain networks and decentralized applications.
Brian Pak is CEO & Co-Founder of ChainLight, an award-winning blockchain security firm that specializes in smart contract audits and on-chain monitoring. He is also a co-founder of Theori, an established US-based offensive cybersecurity company, since 2016, which he still leads today, having now amassed trusted partners including Microsoft, Google and Samsung. Brian’s early career started when he co-founded and developed Kaprica Security, inventing and patenting the Skorpion Charger, an Android mobile charger that can detect malicious software with no user action required. He has worked on research and development projects with the Defense Advanced Research Projects Agency (DARPA) of the US. Brian is also a founder of the team PPP (Plaid Parliament of Pwning) which won DEF CON CTF, one of the most prestigious hacker competitions held in Las Vegas, in 2013, 2014, 2016, 2017, 2019, 2022 and 2023. Brian graduated with a Masters Degree in Software Security Research from Carnegie Mellon University.
