according toCoinMarketCapaccording to

However, for cryptocurrency exchanges, their focus is on profitability, brand and ecological layout, which is specifically reflected in traffic acquisition, transaction depth and industrial layout. Security and risk control are more like cost items that cannot be quantified effectively. Therefore, the degree of attention and investment ratio are far from enough.

secondary title

Security risks

At present, the biggest security risk of centralized cryptocurrency exchanges lies in their weak online protection system. In the traditional financial market, in addition to the online protection system, stock exchanges and futures exchanges are also protected by systematic security networks (such as local area networks and offline networks), coupled with strict legal regulations and national tracing systems, Both increase the attack cost of hackers.

The centralized cryptocurrency exchange integrates multiple role functions (such as customer acquisition, trading, clearing and settlement, etc.), but has only one layer of online protection system. Once hackers break through, there is almost no way to fight back.

The security risks of cryptocurrency exchanges are mainly reflected in multiple links such as network bandwidth, account system, payment system, and business matching system.

1. Network bandwidth

Network bandwidth is vulnerable to a Distributed Denial-of-service Attack (DDoS). DDoS attack, also known as flood attack, is a network attack method in which hackers generate a large number of "legal" requests through puppet machines or simulate multiple users' continuous access and occupation of network resources. Its purpose is to exhaust the target network or system resources until the service is interrupted, resulting in the inaccessibility of normal users.

2. Exchange account system

Hackers use phishing websites, terminal reverse cracking, implanting Trojan horses, fraud, brute force, backdoors, and credentialing to steal accounts from cryptocurrency exchange accounts and transfer users' digital assets.

3. Exchange payment system

To prevent hacking, centralized cryptocurrency exchanges usually store more than 95% of assets in cold wallets. However, in order to maintain the normal use of daily functions such as payment, a hot wallet is essential. The security risks related to hot wallets will be specifically developed in the following digital wallet business scenarios.

The external business interface and background management system of the cryptocurrency exchange are not perfect, or there may be loopholes in business logic. Hackers can attack these logical loopholes to implement illegal operations, such as stealing user information and data, and selling user assets.

secondary title

How to deal with these security risks?

1. Build a security team

The security team of the cryptocurrency exchange needs to account for 13% of the total number of the team, and 17% of the budget needs to be spent on ensuring the safe operation of the cryptocurrency exchange and establishing a comprehensive security mechanism. When Odaily interviewed the security chain SECC, the initiator Qian Keming also suggested that each exchange should establish its own security team, or at least have a CTO who understands the risks of the exchange.

2. "Hot and cold wallet" isolation

Using the "hot and cold isolation" mechanism, 95% of the currency value is stored in the cold wallet, and only 5% is reserved for cash withdrawal, etc., so as to reduce the amount of possible losses.

3. Independent third-party review

Hire an external security team and collaborate on external password audits, multi-signature wallets, 2-step verification, and more.

4. Perform multiple tests