Liquid Exchange Attack: Can a Crypto Wallet Ever Be 100% Safe From Hacks?

Japanese cryptocurrency exchange Liquid Global saw close to $100 million of funds stolen in a hack on Thursday.

The firm said the attack targeted its multiparty computation (MPC) system of custody.

“This time, the MPC wallet (used for warehousing/delivery management of cryptographic assets) used by our Singapore subsidiary Quoine Pte was damaged by hacking,” the company said in a blog post on the incident, translated from Japanese by Google.

Hacks are not uncommon in the crypto world, but the Liquid attack was notable because MPC – an advanced cryptographic technique in which the private key controlling funds is generated collectively by a set of parties, none of whom can see the fragments calculated by the others – appears to be the technology of choice among banks and blue chip companies looking to get into crypto.

Deals for MPC companies show the demand for the technology. Those deals include PayPal’s acquisition of Curv in March and Gemini’s acquisition of Shard X in June. And BNY Mellon, the world’s leading custody bank, cemented a partnership with MPC provider Fireblocks earlier this year.

Read more: MPC Explained: The Bold New Vision for Securing Crypto Money

Banks eyeing the cryptocurrency sector probably see MPC as desirable because the technology can be configured to meet to their requirements and offers a more flexible, self-managed product than simply handing over keys to a third-party custodian.

MPC culpa?

However, the manner in which MPC wallets can be configured is where weakness, namely human error, can creep in, Fireblocks CEO Michael Shaulov said.

Liquid Exchange used MPC technology provided by Israel-based Unbound Security, according to two sources familiar with the arrangement. Unbound is a highly respected cryptography company that is backed by Goldman Sachs and used by JPMorgan Chase in its Onyx blockchain-based services.

A spokeswoman for Unbound said via email that the company was “unable to comment on items that fall outside of our remit."

According to Shaulov, Thursday’s attack on Liquid was probably related to a hack into the exchange’s system last November, when an attacker gathered data about the firm’s security setup.

“Although the attack was on their hot wallets that are based on MPC, my assumption is that this has nothing to do with MPC vulnerabilities,” Shaulov told CoinDesk.

Read more: This Crypto Custody Breakthrough Will Bring Banks Closer to Digital Assets

In Shaulov’s opinion, the exchange's security policy was likely designed in such a way that the original hacker was able to bypass its entire approval process and instruct the wallets to withdraw coins, without affecting the private key.

“In my business, nothing is zero percent,” Shaulov said. “But the chances that the hacker was able to figure something out with Unbound’s MPC protocol are very, very slim.”

Tal Be'ery, chief security officer of the MPC-powered ZenGo wallet, shared that view.

“Most likely it’s not the MPC, but some other problem,” he told CoinDesk via Telegram. “MPC enables users to effectively reduce the risk of key stealing by the factor of the different parties. So it can be 2X harder, 3X harder, etc., but not impossible.”

MPC alone is not enough

The attack on Liquid proves the thesis that MPC alone is not enough, according to Lior Lamesh, CEO and co-founder of GK8, an Israeli custody tech firm that uses MPC in combination with cold vaults, which are not connected to the internet.

Lamesh said hacking is about return on investment, and he estimates that on average a hacker would need to invest a few million dollars to compromise a few internet-connected computers. MPC means that fragments of the key, instead of being located in one internet-connected computer, are located in two or three different internet-connected computers, Lamesh said.

The more shards, the more expensive the attack, but it remains a worthwhile pursuit for a crypto hacker targeting hundreds of millions of dollars.

“MPC is more secure than a hot wallet, but is not enough by itself for banks who need to manage more than tens of millions dollars' worth of crypto,” Lamesh said in an interview. “But it’s fine to manage, say, 2% or 3% of assets, while the majority of the assets will be managed in a cold vault where they are 100% safe since they’re never connected to the internet.”

Benjamin Powers contributed reporting.