A newly discovered security flaw in the programming language PHP, coming after a string of hacking incidents targeting the financial sector, has prompted warnings that cryptocurrency exchanges need urgent security reviews.
Hwang Suk-jin, a professor at Dongguk University's International Graduate School of Information Security, said in an interview with Seoul Economic Daily on the 25th that "cryptocurrency exchanges trade around the clock and directly hold a portion of customer assets, so damage could be severe if a web server breach spreads into internal systems."
PHP is a programming language widely used to build websites. The recently discovered vulnerability allows an outside attacker to execute malicious code on a web server under certain conditions. If an exchange's web server is exposed to the flaw, there is a risk the breach could spread to internal systems.
Hwang also voiced concern about the automation of attacks using artificial intelligence. Automating tasks such as scanning for vulnerabilities and generating attack code is expanding both the speed and the scope of attacks, he said. "Exchanges need to urgently review vulnerable servers and apply security patches, while also tightening access controls between those servers and their trading and withdrawal systems," he said.
Cryptocurrency exchanges are especially hard-pressed to recover from a hack compared with conventional financial firms. Banks can limit the outflow of funds by freezing accounts or suspending transactions, but if an exchange loses control of private keys or withdrawal permissions, customer assets can be siphoned off to outside wallets. Blockchain transactions are difficult to reverse once confirmed, making stolen assets hard to recover.
"Attack methods are diversifying beyond the theft of private keys to exploiting internal administrator privileges, application programming interface (API) credentials, and weaknesses in third-party security solutions and partner firms, so existing cold-wallet storage ratios or perfunctory security checks are not enough," Hwang said. "Self-regulation and best-practice standards from the Digital Asset eXchange Alliance (DAXA) should serve as a minimum common baseline, but supervisory authorities need to build a tiered oversight framework matched to each exchange's risk level and business scale."