Last week, the wind of panic blew in the cryptocurrency ecosystem, following a cyberattack on the EGLD token. It marked the beginning of a new chapter for Elrond, the Romanian blockchain network.
The crisis started with reports of large transfers of EGLD and large swaps on the Maiar Exchange. As the company later stated, the attacker(s) had a window of opportunity of less than 36 hours, while a patch was being prepared – and that was all it took. Now the dust may have settled – vulnerabilities are fixed, most of the funds are recovered, and systems are live again – yet for Elrond and the crypto community, it brought up the need to rethink security approaches and architectures.
The Recursive reached out to experts from Southeast Europe to discuss cryptocurrency cybersecurity risks, as well as prevention and recovery strategies.
The recovery guidebook
While prevention is the mother of all ills, when a company is in the fire of an attack, having a recovery plan in place to follow diligently is just as important. A recovery plan and the capabilities that support it cannot be built overnight; it takes thorough planning and testing. In the end, this builds resilience, the ability to maintain robust and secure conditions for functioning of systems and services.
Recovery stands as a pillar for resilience. It needs to prove a proper response and adaptation capacity, to allow quick (preferably real-time) and firm overcoming of spontaneous and uncertain challenges.
“First, we need to consider that recovery itself is a capability that is developed and duly tested, before any incident happens. Because it is critical for the continuity of services and sometimes (as is the case of cryptocurrencies) even for saving the entire business,” Eugen Popescu, cybersecurity expert, author, and consultant in the H2020 IMPETUS Project, tells us.
So, what are the steps to building the capacity of recovery? Popescu mentions the following:
• Thorough planning with regards to resources, responsibilities, and processes to be deployed in case of disturbing incidents;
• Frequent training and exercising, to test and refine the recovery plans, capabilities, procedures, and understanding of all the accountable people involved in crisis management, as well as cooperation and synchronization capabilities;
• Development of agile human competencies and organizational capabilities, to support quick adaptation, innovation, risk management, and decision making processes.
“In the case of cryptocurrencies, recovery means stability and control, which in the end translate into trust. Since blockchains exist, thrive and revolve around trust, it needs to be cautiously protected,” Eugen Popescu adds.
Among the first steps after getting hit by an attack, companies should launch a full investigation. This should be followed by a detailed post-mortem and a patch of the vulnerability immediately afterwards, advises Kiril Nikolov, DeFi Strategy at Nexo, the Bulgarian-founded international crypto borrowing and exchange platform.
Protecting the user should be the number one priority. In the crypto realm, this means that the brunt of the hit should be taken by the equity and token holders, in order to restitute or compensate the users in the case of money loss. “This requires a strong treasury and/or even an investor network to take the hit and make sure there is no long-term loss of trust,” says Kiril Nikolov.
Along the same lines, how you communicate with the customers makes a big difference. “Timely and transparent customer communication from day one is a must for projects looking to retain customer trust in the unfortunate event of funds getting compromised,” Kiril Nikolov adds.
Why there is no formula for 100% safety guarantee
Can we build 100% safe blockchain-based systems and eliminate cryptocurrency cybersecurity risks? Some experts believe not. “Running consensus-based, public systems will generally be without 100% guarantee. Besides the finality aspects (the number of blocks after which a transaction can be considered final) there’s always the risk of human (programming) errors,” Felix Crisan, co-founder and CTO of Romanian blockchain crowdfunding platform Ronin, shares with The Recursive.
What’s more, some countermeasures in the case of an attack, such as the “pause” function built into most smart contracts these days, may be considered antithetic to the decentralization idea, since the functionality can be controlled by a single key (or, best case, a multi-sig setup), he adds.
“There are also risks introduced by the complexity of the virtual machine operating on the blockchain. From this point of view we could say that Ethereum is riskier than Bitcoin. Other risks come from the complexity of a particular smart contract (for instance, a general, battle-tested ERC20 contract is less risky vs. Compound or Aave or hundreds of other DeFi contracts),” Felix Crisan says.
The risk is amplified when considering the state of development of the technologies underlying crypto. It is still an emerging world.
“There’s a sort of Lindy effect in both time – the longer it has been since deployment, the safer a contract is, and volume – the risk attached to a smart contract decreases with the increase in TVL (Ed.note the total value locked is the overall value of crypto assets deposited in a decentralized finance protocol),” Ronin’s Felix Crisan explains.
The call for unity, standardization, and formal verification
When it comes to reducing cryptocurrency cybersecurity risks – and by that we understand minimizing vulnerabilities and their exploitation – a strong architecture of the system supporting the crypto assets will ensure trust from the inside.
Experts agree that crypto companies need to take a unitary and compact approach to cybersecurity. This will ensure there are “no weak and unprotected links in the overall technological architecture. Unity would also allow no gaps in assuming the responsibility and low times for response to incidents. It would support better investments for cyber capability development and more efficiency in capability deployment,” Eugen Popescu says.
“He further adds that to protect against outbound threats, in addition to classical cybersecurity measures, crypto platforms should set reliable trade-supporting rules and protocols, related to the confirmations at the level of the blockchain, that need to maintain data integrity, neutrality and persistence.
Flash loans, for instance, are a form of uncollateralized loans available to traders on some decentralized finance (DeFi) protocols. This type of loan allows traders to borrow unsecured loans from lenders without intermediaries. Here, “it’s not 100% obvious whether the flash loans enabled by many platforms are not net negative, enabling exploits previously impossible for only but the largest whales,” Kiril Nikolov signals, adding:
“Industry players should come together in identifying and improving major elements and interoperability issues. In addition, projects should come together when it comes to standardizing practices, libraries, and the logic that has been battle-tested on major platforms.”
In the future, the best and safest bet, according to Felix Crisan, is formal verification – running FV contracts on top of FB virtual machines running on public blockchains. With formal verification, which is based on mathematical methods, crypto companies check that a program or contract behaves as expected for all possible inputs, going beyond what the finite cases that testing can handle.
. . .
In a nutshell, while there may be no fail-safe approach to eliminate cryptocurrency cybersecurity risks at the moment, having a strong security architecture, a unitary approach, and a recovery and communication plan in place is essential to ensure resilience and maintain trust in the system. And as the technology matures, so should our ability to protect it against exploitation.
