Analysis-Binance hack reveals crypto's uphill battle against hackers

By AJ Vicens and Hannah Lang

Nov 11 (Reuters) - An elite North Korean hacking group’s $6.3 billion theft from Binance is renewing scrutiny of a longstanding weakness in the cryptocurrency industry: hackers may need to compromise only one employee to get inside, while inconsistent security practices can allow them to turn that foothold into a massive theft.

The October 29 heist, described by experts as the largest cryptocurrency theft ever, unfolded in a matter of minutes after months of planning and preparation, according to Binance’s initial investigation.

Cybersecurity experts said the attack raises questions not only about how exchanges defend employees against sophisticated social engineering, but also about whether they have adequate internal controls to limit what an attacker can do once an employee’s computer or credentials are compromised.

Social engineering is a well-understood threat in the industry, said Jonathan Alexander, chief technology officer of S&P Global’s OpenZeppelin, a blockchain security provider. The bigger question, he said, is why exchanges do not have stronger internal safeguards and circuit breakers to prevent an attacker who breaches an engineer’s computer — like what happened at Binance — from escalating access and moving assets.