Crypto wallets, the applications that allow users to manage their private keys and crypto assets on the blockchain are an important part of the ecosystem. While there are multiple types of wallets offering different levels of security and convenience, one particular type gets a lot of interest, both for right and wrong reasons. These are hot wallets, the simplest of wallets that play a huge role in driving the crypto industry.
For those who are unaware, hot wallets are crypto wallet applications that always stay connected to the internet and maintain private keys online. Designed by choice, these wallets are meant to facilitate quick transactions with minimal authorization requirements, making them ideal for traders and crypto platforms handling huge transaction volumes.
Why opt for a Hot Wallet?
The crypto market is known for its volatility, causing constant fluctuations in the asset value. For someone like a crypto trader whose earnings are dependent on profitably leveraging these fluctuations, every second spent executing a transaction makes a difference. As a result, they need wallets that offer the convenience of executing quick transactions with the involvement of the least number of steps. Similarly, crypto exchanges and trading platforms need to maintain a wallet infrastructure that meets the demands of thousands of traders who are part of their ecosystem.
Hot wallets form an indispensable part of crypto trading infrastructure as they meet all these requirements, viz. speed, and convenience. However, the always-online presence of private keys on the hot wallet also leaves it vulnerable to various threats that constantly threaten the crypto industry.
The Vulnerabilities of Hot Wallets
The normal course of operation of hot wallets involves various factors, each of them contributing to the vulnerability of hot wallets to both external and internal threats.
Online Private Keys
Hot wallets that are part of the crypto platforms’ infrastructure are always live to enable uninterrupted deposits and withdrawals by users. With the private keys of these wallets always online, cybercriminals and hackers get plenty of time to explore any gaps in the security to gain access. They have a higher probability of succeeding with various combinations of sustained attacks. Once they successfully gain access to the private keys, they can control all the funds that are stored in such compromised wallets and transfer them wherever they like.
Risks Associated with Manual Refill Process
The possibility of the private keys getting compromised by hackers’ actions forces platforms to maintain limited liquidity to minimize risk exposure. As a result, platforms choose to periodically replenish the hot wallets whenever liquidity falls below a certain threshold by adopting a manual refill process.
The manual refill process requires constant monitoring of hot wallets by dedicated teams who are responsible for moving funds from the platform’s warm or cold wallets to provide a seamless user experience. The size of the wallet refill team and the number of hot wallets managed by them means multiple people can have access to the private keys. The sharing of private keys among the team members reduces accountability and presents an inviting opportunity for any of them to work individually or in collusion with external actors to steal the assets.
Phishing and Malware Attacks
Most hot wallets use a simple authentication process which not only reduces the time taken to execute transactions but also makes it a bit simpler for cybercriminals to compromise these security features and steal funds. If they can’t attack directly, they can go after those with authorization to gain access to these wallets. Phishing, Social engineering, and Malware attacks are common methods to encourage employees and users to unknowingly divulge their credentials to cybercriminals, making it easier for them to steal the funds.
Effect of Hot Wallet Vulnerabilities
Now, let us consider the effects of hot wallet vulnerabilities on the operations of crypto platforms. The most devastating effect of these vulnerabilities is felt when someone ends up successfully exploiting them. In that event, the result will be devastating both in terms of loss of funds and reputation. Hackers may siphon the entire holding in the hot wallet with no one being the wiser.
We have many examples from the past where hot wallet vulnerabilities have proven to be costly. Be it the Binance hack on May 7, 2019, that led to the loss of over 7000 BTC, the Coincheck hack in 2018 leading to losses worth $574 million, or the more recent $200 million Bitmart hack in December 2021, they all have caused considerable damage to the respective platforms and investors.
Risk Mitigation in Anticipation of Threats
The constant threat of hot wallets being compromised forces the platforms to take extra precautions to minimize potential risks. Some of these steps include
– Capping the maximum balance held in hot wallets at all times to a small percentage of total available funds to meet operational requirements
– Constant monitoring and periodic replenishment of hot wallets whenever the balance reaches a minimum threshold
– Storing most of the funds in cold wallets or other secure infrastructure, to be withdrawn only when necessary to fund the hot wallets
– Enhanced security features including multi-factor authentication and multisig support wherever possible.
While these steps are neither comprehensive nor foolproof, it helps organizations keep their risk exposure to a minimum. However, the current process of protecting funds from hot wallet vulnerabilities also proves to be costly due to the extensive manpower requirements for constant monitoring and refilling. It also introduces more human intervention than desired, which by itself could introduce new risks driven by human error or greed.
The best way to overcome these additional security loopholes is through automation to bring down human intervention to the bare minimum. Secure automation in addition to other best practices will help platforms manage hot wallets without worrying about risks arising from the human factor while keeping the manpower requirement and costs low.
Liminal is one of the leading enterprise crypto infrastructure solutions platforms that help organizations with digital asset self-custody needs. One of its products, the Liminal Smart Wallet Refill helps platforms automate refill schedules using a multisig Smart Refill wallet while retaining complete control over the entire process. Backed by HSM devices, the Smart Refill Wallet keys are never exposed in plain text while signing transactions ensuring easy key holder management and refill process. Key authority assignment on Liminal follows a familiar process that is similar to conventional authorization policies used on AWS IAM and Azure Active Directory Permissions enabling conventional cloud teams that are part of the organization to manage the process. With Smart Refill, the platforms are assured of constant hot wallet monitoring and refills round the clock, in compliance with its refill policies without the need for dedicated manpower.
If you wish to give Liminal Smart Refill a try, then fill out this form and we will reach out to you.
Do follow our blog and social media channels to keep yourself updated.
by Liminal
