Rewarding Hackers With Bug Bounties ‘Inherently Creates a Moral Hazard’ Says Expert
Publikováno: 7.12.2023
Rewarding hackers who agree to return a portion of the stolen funds not only “creates a moral hazard” but potentially “leads to more security breaches,” a Web3 expert has argued. The recent attacks on Kronos and Kyberswap, as well as the subsequent attempts to engage the hackers, are said to demonstrate why victims of attacks […]
Rewarding hackers who agree to return a portion of the stolen funds not only “creates a moral hazard” but potentially “leads to more security breaches,” a Web3 expert has argued. The recent attacks on Kronos and Kyberswap, as well as the subsequent attempts to engage the hackers, are said to demonstrate why victims of attacks should not rely on appeasing the exploiters.
Effectiveness and Importance of Code Audit
According to the latest Immunefi crypto losses report, cybercriminals successfully siphoned over $1.7 billion from decentralized and centralized digital asset exchange platforms in the first eleven months of 2023. The thefts have been carried out via hacking, phishing attacks, and outright fraud.
Such attacks have increased in their frequency and boldness over the past few months, leading many, including proponents of decentralized platforms, to question the effectiveness of code audits or how users’ funds are secured. Still, others like Davinder Singh, the CTO at the crypto platform Rocketx, concur with those who argue against rewarding hackers. According to Singh, rewarding hackers who agree to return a portion of the stolen funds “inherently creates a moral hazard.”
Although they are intended to help decentralized finance (defi) platforms improve their security and protect users from malicious attacks, Singh told Bitcoin.com News that offering such rewards “inadvertently incentivizes malicious actors and potentially leads to more security breaches.”
The recent attacks on Kronos and Kyberswap, as well as the subsequent attempts to engage the hackers, potentially demonstrate why exchange platforms should not rely solely on appeasing them. For instance, the malicious actor behind the Kyberswap exploit recently made several seemingly outrageous requests, including demanding full control over Kyber.
As reported by Bitcoin.com News, the hacker is seeking a more favorable arrangement than the Kyberswap team’s offer. This example could lend to the argument that defi platforms should be more focused on finding ways to prevent the attacks.
Tracking Hackers
However, Fraser Edwards, the CEO of the privacy-preserving payment network, Cheqd, told Bitcoin.com News that besides helping platforms recover some of the funds, the offer to reward hackers also helps exchange platforms identify perpetrators of the attacks.
“The offer and any response creates the chance of getting more information on the hacker which could give them away. E.g. do they communicate via specific channels or using usernames which could lead to a real identity? A good example here is how Ross Ulbricht of Silk Road was identified through his username/handle being linked across multiple forums, eventually to his real identity,” Edwards explained.
Meanwhile, Nikolay Angelov, Blockchain Head at crypto lender Nexo, insists that while bug bounties are useful in helping decentralized exchange platforms recover stolen funds, they also help cleanse the hackers’ money. Additionally, in some of the known high-profile cases in which hackers have agreed to return the stolen funds, the sum ultimately recovered has been less than 90%.
Declining User Confidence
When hackers can easily get away with stealing millions of dollars, this inevitably erodes confidence in digital asset platforms. To restore trust, Angelov said platforms must utilize “real-time software code inspections to prevent vulnerabilities.”
While the so-called white hat hackers may be motivated by the challenge or reward, state-backed hackers, on the other hand, have no desire to return the funds. Therefore, bug bounties may not be an effective way of attempting to recover funds. According to Angelov, operators who are at the receiving end of attacks orchestrated by state-backed actors such as the North Korean-affiliated Lazarus Group should “actively seek cooperation with government agencies to prevent stolen funds from entering their platforms.”
Singh, who shares similar sentiments, urged defi players to collaborate by sharing threat intelligence and adopting advanced defence strategies. He added:
“This collective effort is essential to safeguarding the decentralized financial ecosystem against sophisticated state-sponsored threats.”
What are your thoughts on this story? Let us know what you think in the comments section below.