Deposit addresses are extremely vulnerable, making the process of moving digital assets complicated and tedious. Institutions who work with digital assets every day know that securely moving coin is time-consuming (and stressful). But there’s a reason why these complicated processes exist. The biggest reason is the lack of deposit address authentication on the blockchain.

To ensure that digital assets end up in the correct wallet, deposit addresses are one of the most important elements to secure. Even the smallest mistake or error in a deposit address (whether it’s intentionally caused by a malicious party or by a completely accidental fat-fingers blunder) results in irreversible asset loss.

Part 1 of this series will look at 3 of the main attack vectors associated with deposit addresses: cyber attacks, internal fraud, and human error. Check out part 2 for a deeper dive into some of the primary methods operations teams currently use to make asset transfers more secure.

1) Cyber Attacks

When a digital asset is sent to a counterparty, every step in the transfer process is vulnerable to attackers. Many examples from the past few years demonstrate the lengths hackers will go to in order to take advantage of these vulnerabilities.

In 2018, hackers breached StatCounter, a popular analytics platform (similar to Google Analytics) that has existed since 1999 with over 2 million member sites. By breaking into StatCounter, they managed to compromise the cryptocurrency exchange gate.io and steal bitcoins during the transfer process.

How did this breach work? Essentially, StatCounter adds JavaScript to webpages, allowing admins of those pages to retrieve analytics about how their site is being used. The hackers breached StatCounter and inserted their own JS into gate.io to replace the deposit address QR code, allowing them to redirect funds into their own wallets rather than the intended recipients’.

In recent years, we’ve also seen attacks based on:

• Messaging services – Intercepting and modifying deposit addresses while they’re being sent between counterparties (such as via email or Telegram)

• Chrome web extension fraud – Using a web extension to modify the content on an exchange’s webpage)

• Hijacked hardware wallets

• Malware on a counterparty’s computer – To modify the copy ‘n’ paste of a deposit address and send assets to the hacker’s wallet)

Cyber attacks are an enormous problem for institutions working with digital assets. Spoofing and man-in-the-middle attacks have grown more complex and harder to detect over the years.

2) Internal Fraud

External hackers alone have given security and operations teams more than enough reasons to adopt air-gapped technologies like hardware wallets. But the threats don’t stop there — internal fraud is an equally prevalent problem. In fact, Verizon’s 2015 data breach report found that about 50% of security breaches involved internal employees or contractors.

To speed up settlement many firms employ caching, whitelisting, or storing deposit addresses of counterparties they’re familiar with. One common method of doing so is with an Excel spreadsheet, from which traders use copy ‘n’ paste to retrieve a counterparty’s deposit address.

But if half of all security breaches are coming from internal actors, can we trust all employees and executives to perform this action accurately and without interference? This system doesn’t have any measures in place to prevent internal fraud; it’s as easy as editing a deposit address in a spreadsheet to send to one’s own wallet.

When it comes to internal fraud, not even cold-wallet solutions can stop deposit addresses from being compromised.

The sole purpose of the blockchain is to enable trustless execution. But with some of the methodologies we’re using today, this purpose is defeated. Again, it’s obvious why many organizations have come to rely on time-consuming methods (like test transfers) to limit the possibility of deposit address tampering.

3) Human Error

Beyond internal and external fraud, there’s another issue with how institutions use deposit addresses today: human error.

Fat finger errors result in assets being lost entirely. Traders can accidentally enter a counterparty’s Bitcoin blockchain deposit address while intending to exchange Ethereum, or just simply add extra 0s to the end of addresses.

For institutional teams transferring assets 50-100 times a day, mistakes are bound to happen. It’s the human condition—people can’t be relied on to double-check their work every time, without fail.

How do you mitigate these risks?

Evidently, there are a lot of vulnerabilities associated with deposit addresses, from hackers to internal fraud to simple human error.

In part 2 of this series, we go in-depth on some of the methods and technologies institutions are using today to make digital asset trading more secure. Keep reading here.