Liquid Exchange Attack: Can a Crypto Wallet Ever Be 100% Safe From Hacks?

Hacks are not uncommon in the cryptocurrency arena. The Liquid attack is interesting, however, because MPC – an advanced cryptographic technique in which the private key controlling funds is generated collectively by a set of parties, none of whom can see the fragments calculated by the others – appears to be the technology of choice among banks and blue chip companies looking to get into crypto.

Examples of MPC shops in demand include PayPal’s acquisition of Curv in March and Gemini’s acquisition of Shard X in June. The world’s leading custody bank, BNY Mellon, also cemented a partnership with MPC provider Fireblocks earlier this year.

Banks eyeing the cryptocurrency space probably see MPC as a desirable end-goal because the tech is configurable to their requirements and offers a more flexible, self-managed solution than simply handing over keys to a third-party custodian. 

MPC culpa?

However, the manner in which MPC wallets can be configured is where weakness can creep in, said Michael Shaulov, CEO of Fireblocks. This is known as a policy issue: in other words, human error. 

Liquid Exchange used MPC technology provided by Israel-based Unbound Security, according to two sources familiar with the arrangement. Unbound is a highly respected cryptography company, backed by the likes of Goldman Sachs and used by JP Morgan for key management within the bank’s Onyx suite of blockchain-based services.

A spokeswoman for Unbound said via email that the company was “unable to comment on items that fall outside of our remit.”

According to Fireblocks’ Shaulov, Thursday’s attack on Liquid was probably related to a previous hack into the exchange’s system back in November of 2020, where an attacker gathered data about the firm’s security setup.

“Although the attack was on their hot wallets that are based on MPC, my assumption is that this has nothing to do with MPC vulnerabilities,” Shaulov, an MPC expert (and advocate), told CoinDesk.

In Shaulov’s opinion, the policy was likely architected in such a way that the original hacker was able to bypass the exchange’s entire approval process and instruct the wallets to withdraw, without affecting the private key.

“In my business, nothing is zero percent,” Shaulov said. “But the chances that the hacker was able to figure something out with Unbound’s MPC protocol are very, very slim.”

Tal Be’ery, chief security officer of MPC-powered ZenGo wallet, shared that view. 

“Most likely it’s not the MPC, but some other problem,” he told CoinDesk via Telegram. “MPC enables users to effectively reduce the risk of key stealing by the factor of the different parties. So it can be 2X harder, 3X harder, etc., but not impossible.”

MPC alone is not enough

The attack on Liquid proves the thesis that MPC alone is not enough, according to Lior Lamesh, CEO and co-founder of GK8, an Israeli custody tech firm that uses MPC in combination with cold vaults, which are not connected to the internet.

Lamesh said hacking is about return on investment (ROI), and he estimates that on average, a hacker would need to invest a few million dollars to compromise a few internet-connected computers. MPC means that fragments of the key, instead of being located in one internet-connected computer, are located in two or three different internet-connected computers, Lamesh said.

The more shards, the more expensive the attack; but it remains a worthwhile pursuit for a crypto hacker targeting hundreds of millions of dollars.

“MPC is more secure than a hot wallet but is not enough by itself for banks who need to manage more than tens of millions dollars worth of crypto,” Lamesh said in an interview. “But it’s fine to manage, say, 2% or 3% of assets, while the majority of the assets will be managed in a cold vault where they are 100% safe since they’re never connected to the internet.”

Benjamin Powers contributed reporting.