Binance breach calls into question the security of cryptocurrency exchanges

This week, two high-profile security breaches, including the largest crypto theft in history, call into question the safety of storing funds in crypto exchange wallets.

A security incident that occurred on digital asset exchange Binance on Thursday affected approximately $6.3 billion in customer assets, making it the largest cryptocurrency theft in history.

Earlier in the day, prediction market platform Polymarket suspended trading on international exchanges after its third-party data provider was hacked, resulting in at least $2.7 million being drained from users’ wallets. The company’s international platform runs on the Polygon blockchain.

Experts interviewed by CNBC said security incidents at crypto exchanges are not surprising, especially in light of recent artificial intelligence hacking incidents.

Most of these experts even said that as the problem worsens, observers should expect more security incidents, at least in the short term.

Questions regarding the safety of users’ funds

“I think this is very dangerous,” said Tyler Moore, a cybersecurity professor at the University of Tulsa who has been watching the asset class for more than a decade. “I think you should be very careful about leaving large amounts of money on exchanges…There are no built-in protections in the event of an inevitable hack like this.”

For example, bank customers can rely on the Federal Deposit Insurance Corporation to insure deposits of up to $250,000 per depositor and per insured bank in the event of a financial institution failure.

Moore pointed out that there is no similar form of compensation available for funds lost from virtual currency exchanges.

Binance and Polymarket reassured users that affected investors will be fully bailed out. According to Ido Ben-Natan, CEO of blockchain security company Blockaid, this is a sign that users should have confidence in crypto exchanges.

“Actually, I don’t think any users are going to lose money,” he said. “Binance says it covers everything…Actually, I don’t think it’s a bad idea for users to put their money into these exchanges. These exchanges need to work hard to avoid being hit like this again.”

Bennatan said he believes there could be more hacks as AI changes the cybersecurity landscape, but that it will only strengthen the crypto industry.

As a result, crypto wallets could end up being a safer place to store funds compared to other options as the industry gains experience in how to deal with such attacks, Bennatan said.

Offshore platform vulnerabilities

Importantly, while Binance experienced security incidents on its offshore platform, it did not experience similar issues on its regulated, centralized US exchanges. The same was true for Polymarket’s domestic exchange.

US Regulated Platforms coinbase and robin hood was not affected by the Binance security breach, but both companies’ stock prices fell on Friday in the aftermath.

Appearing on CNBC’s “Squawk on the Street” on Friday, Commodity Futures Trading Commission Chairman Michael Selig, the federal regulator of derivatives, said the offshore nature of these cases was noteworthy.

“They don’t have the safeguards that we have in our financial markets,” he said. “We want to give these exchanges a federal option to register with the CFTC so they will be subject to the same types of cybersecurity safeguards that are in place in the market today.”

Brett Falk, a professor at the University of Pennsylvania and director of the Institute for Cryptographic Society, said U.S. regulations likely would not have prevented incidents like Thursday’s at Binance. Binance said in a post on X that the hack may have involved a DevOps engineer’s laptop.

“Most of the regulations don’t address the specific software stack that must be used to authenticate an individual,” Faulk said.

BInance later said in another social media post that its investigation had uncovered additional breaches, but did not say what they were.

Unique targets in a changing landscape

Falk echoed Bennatan’s argument that individuals are less likely to face losses and that it is better for traders to park their funds on exchanges with corporate financial backing than in self-custody wallets where no one can refund losses in the event of a hack.

Bennatan added that traders should feel safe based on how many incidents where companies like his catch don’t make the news. This is because security technology works and can often stop incidents before they develop into major incidents.

But in the changing cybersecurity landscape, cryptocurrencies could be a unique target for hackers, experts told CNBC. That’s because of how much liquidity individuals have immediate access to in the event of a successful breach.

That’s why Ryan Kirkley, CEO of blockchain infrastructure company Global Settlement Network, believes traders should be wary of leaving funds in uninsured wallets until financial firms upgrade their security infrastructure.

“I don’t think there is a common solution in the market right now where assets are truly secure,” Kirkley said.

“Unless you trade with a reputable, solid broker-dealer that provides asset insurance, you run the risk of plugging today’s assets into any ecosystem simply because there are so many unknowns,” he added.