Security breaches at cryptocurrency exchanges have been a persistent problem in the industry. From the infamous Mt. Gox hack to last month's Zaif incident, exchanges have frequently lost funds despite the growing value of crypto assets. A detailed new report from ICOrating.com reveals the extent of lax security practices that pervade many exchanges, including several supposedly top-tier platforms.
54% of Exchanges Have at Least One Security Vulnerability
The ICO listing and analysis site profiled 100 exchanges whose daily trading volume exceeds $1 million and found that 54% of them are lacking in one or more security areas. Key findings include:
- 41% of exchanges allow passwords with fewer than 8 characters
- 37% allow passwords consisting of only digits or only letters
- 5% allow account creation without email verification
- 3% lack two-factor authentication (2FA)
- Only 46% meet all four basic security parameters
Domain and Registrar Security: Only 4% Achieve Best Practices
ICOrating also examined registrar and domain security measures, such as registry locks and DNSSEC (Domain Name System Security Extensions). These protections help prevent DNS cache poisoning attacks, which have been used to target platforms like MyEtherWallet. The results were concerning:
- Only 2% of exchanges use a registry lock
- Only 10% use DNSSEC
- Only 4% of exchanges meet best practices in 4 out of 5 domain security areas
Coinbase and Kraken Top the List; Okcoin Ranks Lowest
ICOrating published a comprehensive security score table for all 100 exchanges, with a maximum possible score of 100. No exchange managed to score above 90, but Coinbase came closest with 89 points, followed by Kraken (80), and Bitmex and Gopax tied for third (78). Other notable rankings include Cobinhood (8th), Ethfinex (12th), Bittrex (13th), and Binance (17th).
At the bottom of the list is Okcoin.cn, scoring just 15 out of 100. Other poorly performing exchanges include Mercatox (25), the hacked Zaif (29), and Bithumb (34).
While previous attempts have been made to rate exchange security, ICOrating.com's report is the most detailed to date. It does not cover every aspect—such as dynamic IP verification or withdrawal checks—but it provides a snapshot of the overall security health of the crypto exchange landscape, showing there is room for improvement across the board.
Users are advised to consider security scores and practices when choosing a platform to trade on, as exchanges with robust measures are less likely to fall victim to hacks.