Could Coinbase Be the Next Target for North Korean Hackers?

Coinbase, one of the largest crypto exchanges, appears to be in the crosshairs of North Korean hackers. In a recent Public Service Announcement, the Federal Bureau of Investigation (FBI) warned the cryptocurrency ecosystem of potential threats from the Democratic People’s Republic of Korea (DPRK). North Korean hackers, notorious for their extensive pre-operational research, have primarily targeted decentralized finance (DeFi) projects and exchanges (DEXs and CEXs). However, they have now shifted focus to firms associated with cryptocurrency exchange-traded funds (ETFs).

Bill Hughes, a prominent figure in the crypto space, expressed concerns on X (formerly Twitter) about the safety of ETF issuers, highlighting that DPRK’s interest in ETF custodians is a new development. Hughes pointed out that before targeting the crypto world, North Korean hackers spent years infiltrating banks globally, following the flow of money. With the increasing financial prominence of ETF issuers, they have now become a lucrative target.

“Going after ETF issuers is certainly different than their recent DeFi/CeFi/CEX targets, but I’m not sure it’s necessarily an escalation,” @tayvano_ commented, noting that while the shift in targets is noteworthy, it might not represent a broader strategic change.

Eleanor Terrett, a journalist with Fox Business, further underscored the gravity of the situation. She quoted Bill Hughes, emphasizing that Coinbase has become a significant target for DPRK hackers, given that 8 out of the 11 Bitcoin (BTC) spot ETFs and 7 out of the 9 Ethereum (ETH) spot ETFs are held in custody by Coinbase. This makes the exchange a prime target for cyberattacks.

In another post, Terrett criticized the SEC’s regulatory stance, specifically referencing the Staff Accounting Bulletin No. 121 (SAB 121). She argued that the SEC’s discouragement of federally regulated banks from taking custody of cryptocurrencies has centralized the custodian landscape, leaving a small number of firms, like Coinbase, more vulnerable to attacks. SAB 121, issued on March 31, 2022, provides accounting guidelines for firms holding crypto assets, requiring them to account for liabilities and assets at fair value, which increases the burden and risk for federally recognized banks.

The rising concentration of crypto ETFs under Coinbase’s custody has raised significant concerns about the platform’s ability to defend against sophisticated cyber threats from state-sponsored hackers like DPRK. As the crypto world watches closely, the question remains: does Coinbase have the necessary security infrastructure to safeguard these high-stakes assets?

source