5 Common Types of Blockchain Hacks

Blockchains can be targeted through a variety of different attack vectors.  In some cases, the problem is a failure by blockchain users to follow security best practices.  In others, the “vulnerability” lies in the design of the blockchain itself.  

Here are the five most common ways in which blockchain systems are attacked:

One of the most common types of blockchain hacks is for a user to lose control of their blockchain account because the secret keys associated with that account are compromised.  

On the blockchain, public key cryptography is used for identity management, so one of the main criteria for a transaction to be considered “valid” is for it to carry a valid digital signature.  A compromised private key allows an attacker to perform transactions with a user’s account.

Security best practices for private key management say that users should manage their own private keys and store them offline when not in use.  However, many users entrust their keys to cryptocurrency exchanges.  This makes it possible for their keys to be compromised if an attacker guesses their account password, performs a SIM swapping attack to steal multi-factor authentication (MFA) codes, etc.

On the blockchain, transactions are not immediately added to the digital ledger.  Instead, when transactions are broadcast to the blockchain network, they are stored by nodes in pools of unspent transactions.  When future blocks are created, the contents of these blocks are composed of the current contents of the unspent transaction pool.

This delay between the initial publication of a transaction and its inclusion in the digital ledger leaves the door open to frontrunning attacks.  In these attacks, an attacker observes a broadcast transaction and then submits their own version of that transaction (often with a higher transaction fee to increase the probability that it is processed first).

In a successful frontrunning attack, the attacker’s transaction is processed before the original one, often providing a profit to the attacker.  Ironically, frontrunning bots actually saved the day in one case, where they frontrun an attacker’s transactions to exploit a vulnerability in the DODO DEX smart contract.  By exploiting the vulnerability first and later returning the stolen value, the owners of these bots decreased the impact of this attack.

51% attacks are a built-in “vulnerability” of the Proof of Work consensus algorithm.  In a Proof of Work system, the creator of the next block on the blockchain is selected by majority vote (with hashpower counting as votes).  A 51% attack occurs when the attacker controls the majority of the votes.  This provides them with complete control over the contents of the blockchain because they can build a version of the blockchain faster than the rest of the network put together.

The best protection against 51% attacks is to have enough hashpower in a blockchain network that it is infeasible for an attacker to control the majority of it (Polkadot has an interesting approach to this).  

However, many smaller blockchains are trivially attackable using 51% attacks because the cost of a majority of the hashpower is so low.

Smart contracts are programs that run on top of the blockchain.  Smart contract platforms implement virtual machines (VMs) that run smart contract code in an emulated, deterministic environment.  This makes a decentralized computer possible because different nodes running the same code on identical VMs will always reach the same result.

Like any program, smart contracts can contain errors, and some of these errors will be exploitable vulnerabilities.  Many of the recent exploits of decentralized finance (DeFi) projects – such as the Fei and ForceDAO hacks – have exploited smart contract vulnerabilities.

The blockchain is a concept, but it’s implemented as software.  The blockchain works because each node in the network runs a program that follows set protocols to make the blockchain network work together despite being decentralized.

These programs – like smart contracts – can contain vulnerabilities that can be exploited by attackers.  Most major blockchains have had at least one software vulnerability that either led to a hack or was detected and remediated before it could be exploited.  

While, in many cases, the design of the blockchain is secure, an imperfect implementation can make it attackable.

Blockchain systems can be hacked in a variety of different ways, and the responsibility for protecting them lies with different parties in different cases.  In some instances, such as frontrunning and 51% attacks, the “vulnerability” is the design of the protocol.  In others, like compromised private keys, it is the responsibility of the blockchain user to follow security best practices.

However, in the case of software vulnerabilities – such as the ones that make smart contract and blockchain software exploits possible – the problem lies with the creator of the software.  A failure to undergo a comprehensive security audit (covering both the design and implementation of the system) before release can leave the project and its users vulnerable to attack.

To schedule a security audit of your blockchain project, get in touch with Halborn by emailing halborn@protonmail.com.