A new Ernst & Young report has found that more than 10% of the $3.7 billion raised in ICOs has been stolen due to cyber-attacks. According to the report, hackers are stealing up to $1.5m in ICO proceeds a month.
Arseny Reutov, blockchain security expert at Positive.com has commented on the findings and what ICOs should be doing to protect themselves.
ICOs provide a huge opportunity for scammers and attackers as they are essentially taking advantage of the promise of people making a huge return from relatively low investment. Unfortunately, this report shows the financial loss being inflicted is devastating when viewed at scale.
The reality is, the second a company goes public with an intention to do an ICO, it is waving a huge flag to cyber criminals that it is both valuable and also in a very vulnerable phase of its company growth. This research is proof that ICOs are not doing enough to protect themselves.
There are some very basically things that ICOs could and should address to improve their security posture. Firstly, it is absolutely vital that the underlying code of the smart contract is purged of any vulnerabilities through development - once this goes live it cannot be changed. Secondly, organisations must ensure that the web applications their ICO use are being monitored and protected in real time - all the security of the blockchain means nothing if a hacker can misdirect funds from the web page.
Finally, there is the human factor. A major risk here is that open source intelligence will be used target members of the team - our own research suggests that every ICO has a team member who's password can be found online. ICOs must do everything within their power to stop investors being tricked by phishing attacks. This is the hardest thing to secure, the only solution is to educate investors on the risks and warning signs and communicate as effectively as possible on official channels, to avoid investors being duped.
This could potentially be a linchpin moment for the future of ICOs - they could disappear as quickly as they emerged. If ICOs are to prove themselves as a viable fundraising option, they must address the issue of security urgently.
