1. Home
  2. Data

Data

Crypto companies aim to build trust within future products and services

Companies are taking new approaches to building trust within Web3 and crypto products.

The cryptocurrency ecosystem underwent a turbulent year in 2022. Criticism inside and outside of the crypto industry was fueled following the collapse of FTX, Celsius, Three Arrows Capital and the Terra ecosystem. 

A number of losses have been recorded from these events. Blockchain analytics firm Chainalysis released a report in December of last year, which noted that the depegging of Terra’s stablecoin, Terra USD Classic (USTC), saw weekly-realized losses peak at $20.5 billion. Findings further show that the subsequent collapse of Three Arrows Capital and Celsius in June 2022 saw weekly-realized losses reach $33 billion.

While these events may have resulted in a loss of trust within the crypto ecosystem, it’s important to point out that blockchain technology and cryptocurrency have not failed. To put this in perspective, Dan Morehead, chief operating officer at ​​Pantera Capital — an American hedge fund specializing in cryptocurrency — stated in a Dec. 19, 2022 letter to investors:

“The narrative that blockchain skeptics and some regulators and politicians are pumping out misses the point. The collapse of FTX had nothing to do with blockchain technology. It’s not crypto that failed. Bitcoin and all the other protocols worked perfectly.”

To Morehead’s point, companies within the crypto and blockchain sector continue to build and release products, despite recent events. In fact, a number of projects are focused more than ever before on instilling trust within products.

Companies aim to ensure trust 

Paul Brody, global blockchain leader at EY and an Enterprise Ethereum Alliance board member, told Cointelegraph that he senses a renewed respect for the value of rules, regulations and the idea that the rule of law has a role to play within the crypto sector. “The narrative that ‘code is law’ doesn’t seem to come up so much anymore in discussions,” he said.

Given this, Brody believes that auditors, regulators and mathematical proofs will play a critical role in building trust with transparency within the crypto sector:

“I think we can look forward to a future where not only will code be published, but firms will publicly appoint external auditors and welcome regulatory inspections. I think there’s also a role for more standardization of how firms in this industry report their data.”

To Brody’s point, a number of crypto companies have started placing an emphasis on audits and data reporting. For example, Jordan Kruger, co-founder of Vesper Finance and head of decentralized finance (DeFi) at Web3 infrastructure layer Bloq, told Cointelegraph that her firm has been subject to a number of audits since launching in 2021.

“It has undergone more than fifty independent audits across the multiple smart contracts that comprise its pools and strategies,” she said.

Recent: What is institutional DeFi, and how can banks benefit?

Kruger noted that while this has been important for Vesper’s users, regular audits should be viewed as a contribution to the DeFi ecosystem as a whole. “Our focus on software quality means that when other DeFi protocols integrate with us, they can partially draft behind Vesper’s significant investments in auditing.” This is an important point, as DeFi protocols witnessed some of the largest hacks and scams in 2022. Regular smart contract audits may have prevented some of these from occurring.

In addition to audits performed on DeFi protocols, the nonfungible token (NFT) sector is starting to implement audits, particularly when it comes to the phygital offerings, or physically-backed NFTs. For example, Jake Spinowitz, head of community at Courtyard — an NFT marketplace that enables collectors to trade and store physical collectibles — told Cointelegraph that Courtyard arranges third-party audits of its custodied items to ensure trust and transparency.

Moreover, Spinowitz explained that Courtyard is working with the security provider Brinks to safeguard physical assets that are tied to digital twins. “When tasked with safeguarding someone’s prized physical possessions, there should ideally be a proven ability to securely vault, handle, and transport those assets (to mitigate risk further, all physical collectibles we vault are insured at market value),” he said.

The combination of audits, along with using a legacy security institution, may serve as a successful model for phygital projects moving forward. This could certainly be useful, as a number of phygital platforms have expressed concerns regarding the redemption and storage process of physical NFT assets. 

While auditing and data reporting may become standards within the cryptocurrency ecosystem, protecting user data will also become critical. Sandy Carter, senior vice president and channel chief at Web3 domain provider Unstoppable Domains, told Cointelegraph that her firm is allowing domain owners to control the information they share.

“For example, our login feature gives you the option to share off-chain profile data to earn rewards from your favorite DApps or display your domain on a leaderboard. The data you share is completely opt-in,” she explained. Moreover, Carter noted that Unstoppable Domains recently changed the way domains are minted. “All domains will now be automatically minted on the blockchain, as opposed to Unstoppable’s database,” she said.

Chris Castig, co-founder of Console.xyz — a Web3 chat platform — told Cointelegraph that Web3 principles focused on trust must ensure a minimum impact that any one human, group, or institution can have on the users of the app. As such, he explained that platforms like Console allow users’ social graphs, which include their followers, network and more, to live on the blockchain. He elaborated:

“We use smart contract and NFT integrations so that social graphs live outside of our app and on the blockchain. That means that if your community ever wanted to leave Console, it’s easy to find a new home somewhere else. You own your community, not us.” 

Castig further noted that his company uses Ethereum Name Services (ENS) for identity rather than user names. “ENS names (.eth) or any equivalent decentralized identity like (.btc, .tez, etc) can be used to replace usernames and passwords on your site,” he said. In turn, an additional layer of user privacy and trust is achieved. 

“On a social site where I’m interacting with other people, my ability to use a consistent username across sites communicates trust to other users. Using my own ENS name also means I own my identity, not the humans behind the app,” Casting said.

Will crypto ideals remain with additional trust built in? 

While regular audits, data reporting and transparent privacy measures may become the norm for many crypto projects moving forward, some could be wondering if this will impact the trustless nature of cryptocurrency

Although this is a legitimate concern, Brody explained that the trustless nature of crypto is no longer feasible. “It was somewhat achievable in the early days of pure crypto when you could self-custody and everything you needed to know was on-chain. Yet, the moment we moved past pure crypto into real-world assets and complex smart contracts, that became impossible,” he said.

Recent: Redeeming physical NFTs: Easier said than done?

Brody added that now the cryptocurrency ecosystem should be aiming “not for ‘trustless’ crypto and blockchain, but rather decentralized and regulated crypto.” If implemented correctly, Brody believes that all of the benefits promised by crypto will still be achievable. He said:

“Decentralization means that there’s no single firm that can become a gatekeeper or monopolist. Regulation means that we can see, understand, and compare between firms and partners and figure out who is worthy of our trust.”

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

Hackers Hit Romanian Hospital, Demand Bitcoin Ransom

Hackers Hit Romanian Hospital, Demand Bitcoin RansomA hospital in Romania has been targeted in a ransomware attack with the perpetrators seeking payment in cryptocurrency to decrypt its database. The hack prevents the medical institution from reporting to the country’s health insurance fund in order to receive due funding. Botoşani Hospital Blackmailed for Bitcoin, Romanian Media Reports The Saint Gheorghe Recovery Hospital […]

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

Twitter data breach: Hacker put 200M users’ private information up for grabs

The hacker had demanded $200,000 to return the breached data back in December but warned that if their conditions are not fulfilled, they will release the data for free.

200 million Twitter users’ private information, including their email addresses, was put for sale after a breach exposed 400M users’ private information in the last week of December 2022.

The hacker behind the December breach has earlier demanded $200,000 from Twitter in a bid to return the stolen data and warned if the demand is not fulfilled, the data will be released for free. The latest set of data posted on the hacker forum has been traced back to the same breach from December 2022.

Researchers at Privacy Affairs confirmed that the leaked data set on the hacker forum is the same from December. The 200 million number, in this case, resulted from the removal of duplicates. The released data set doesn’t contain phone numbers. The researchers warned that these data sets could be used to initiate social engineering or "doxing" campaigns.

The data set was originally 63GB, but after removing duplicates and compressing the files, the size of the latest data set was reduced to 4GB and free to download. 

The hacker also noted that the analysis of original file dates and account creation dates “strongly suggest" that this was collected from early November 2021 through December 14, 2021.

Related: LastPass data breach led to $53K in Bitcoin stolen, lawsuit alleges

Many users on Twitter demanded that the social media platform looks into security as these hacks put activists and whistleblowers in danger.

Some of the popular and known names and entities include Sundar Pichai, Donald Trump Jr., SpaceX, CBS Media, the NBA, and the WHO. The data breach vulnerability has been patched now, but tracing back to the hack, it seems the same vulnerability was used for another exploit in July 2022.

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

LastPass data breach led to $53K in Bitcoin stolen, lawsuit alleges

A class action is seeking damages from the password manager following a data breach in August 2022.

A class action lawsuit has been filed against password management service LastPass following a data breach from Aug. 2022.

The class action was filed with the U.S. district court of Massachusetts on Jan. 3, by an unnamed plaintiff known only as “John Doe” and on behalf of others similarly situated.

It alleges that the data breach of LastPass has resulted in the theft of around $53,000 worth of Bitcoin.

The plaintiff claimed he began accruing BTC in Jul. 2022 and updated his master password to more than 12 characters using a password generator, as recommended by the LastPass “best practices.”

This was done to enable the storage of private keys in the seemingly secure LastPass customer vault.

When news of the data breach broke, the plaintiff deleted his private information from his customer vault. LastPass was hacked in Aug. 2022, with the attacker stealing encrypted passwords and other data, according to a December statement from the company.

Despite the quick action to delete the data, it appeared to be too late for the plaintiff. The lawsuit read:

“However, on or around Thanksgiving weekend of 2022, Plaintiff’s Bitcoin was stolen using the private keys he stored with Defendant [LastPass].”

“The LastPass Data Breach has, through no fault of his own, exposed him to the theft of his Bitcoin and exposed him to continued risk,” it added.

The suit claims that victims have been put at increased substantial risk of future fraud and misuse of their private information, which may take years to manifest, discover, and detect.

LastPass is being accused of negligence, breach of contract, unjust enrichment, and breach of fiduciary duty, however, the figure sought in damages was not specified.

Related: 'Third-party incident' impacted Gemini with 5.7 million emails leaked

According to cybersecurity researcher Graham Cluley, the stolen data includes unencrypted information including company names, user names, billing addresses, telephone numbers, email addresses, IP addresses, and website URLs from password vaults.

In December, LastPass admitted that if customers had weak Master Passwords, the attackers may be able to use brute force to guess this password, allowing them to decrypt the vaults.

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

Global Cryptocurrency Trade Volumes Saw a Significant Decline in December 2022

Global Cryptocurrency Trade Volumes Saw a Significant Decline in December 2022According to statistics, daily cryptocurrency trade volumes have dropped significantly during Dec. 2022. On Jan. 1, data shows that $22.95 billion was traded in the last 24 hours, compared to double that amount, $54.78 billion, two weeks earlier. On November 8, 2022, 54 days prior, amid the FTX collapse, global cryptocurrency trade volumes were approximately […]

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

Blockchain analytics unable to prevent FTX-level illicit schemes

Blockchain tracker Whale Alert has attempted to scan FTX’s historical balance checks to find out whether it was possible to spot the collapse sooner.

Data transparency has been a focal point for the crypto industry, but the FTX fiasco has shown that centralized exchanges (CEX) are not transparent enough. So far, crypto analytics firms are apparently not capable of tracking transactions to prevent collapses like FTX.

All Bitcoin (BTC) transactions are available publicly on-chain, which enables tracking such transactions when sending crypto from one address to another. However, this is not the case when it comes to interacting with a centralized crypto exchange.

Cointelegraph spoke with executives at blockchain intelligence firms, including Chainalysis, Nansen and Whale Alert, to learn more insights about tracking illicit CEX transactions on-chain.

According to Chainalysis, a major blockchain data platform that cooperates with many governments across the world, there is currently no on-chain tracking tool that could trace funds through a CEX.

“Chainalysis — or any other blockchain analysis tool — can’t trace funds through a centralized service, because the way that these services store and manage funds deposited by users inherently makes further tracing inaccurate,” a spokesperson for Chainalysis told Cointelegraph.

“Even if you could trace through a centralized exchange, on-chain analysis alone cannot reveal fraudulent intent behind transactions,” Chainalysis’ representative noted. The spokesperson stressed that Alameda’s leaked off-chain balance sheet was the first thing to reveal that something was wrong.

While blockchain analysis can track deposits on CEXs, there is no chance to access their liabilities, according to Nansen analyst Andrew Thurman. “FTX halted withdrawals when they still had in excess of a billion in various digital assets; we now know they had a far greater sum in liabilities,” he said.

Thurman also argued that a proof-of-reserves (PoR) model — the increasingly popular effort of CEXs to prove transparency — is “only a half measure, but it’s a good one.”

Despite blockchain analysis having limited opportunities in tracking illicit transactions by CEXs so far, some monitoring services still try to prove that the industry has chances to prevent issues like FTX crash one day.

“We are currently doing historical balance checks on our known FTX addresses — deposit and other related addresses — to determine if this could have been spotted sooner,” Whale Alert co-founder and CEO Frank van Weert told Cointelegraph in November.

Whale Alert has since had to abandon the project because the platform did not have enough resources to properly do the scan of about two years of data. “It takes quite a bit of computing power which we did not have available,” the CEO said.

Weert also noted that “it is possible to track exchanges,” but platforms like Coinbase and FTX make it a bit more complex to track incoming coins as they don't use hot wallets. He added that exchanges are “extremely reluctant to cooperate,” with many of them declining to comment on Whale Alert’s findings for "security" reasons.

Related: What blockchain analysis can and can't do to find FTX's missing funds: Blockchain.com CEO

Whale Alert CEO emphasized that the entire crypto industry is responsible for the collapse of FTX, stating:

“So far the industry's focus has been on profit rather than proper infrastructure. The only way to recover from the mess is to gain the public's trust again on the basis of proper transparency, which does not come from Merkle Tree audits.”

According to some industry executives, blockchain analysis platforms are not interested in catching illicit players on-chain in the first place.

“First, blockchain analysis doesn’t really do anything, and second, they are not focused on fraud and suspicious transactions at the exchange level. Their customers are the exchanges and you don’t bite the hand that feeds you,” Bitcoin proponent Samson Mow told Cointelegraph.

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

Russia to Ban Banks From Using Messengers Like Telegram to Contact Customers

Russia to Ban Banks From Using Messengers Like Telegram to Contact CustomersFinancial institutions in Russia will not be able to communicate with clients through instant messengers based outside the country, local media revealed. A new law passed by the State Duma also prohibits banks from using chats to send personal data and payment documents. Bill Restricts Russian Banks and Brokers From Sending Sensitive Information Through Foreign […]

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

LastPass attacker stole password vault data, showing Web2’s limitations

LastPass users with weak master passwords may need to change the individual passwords they stored with the service.

Password management service LastPass was hacked in August 2022, and the attacker stole users’ encrypted passwords, according to a Dec. 23 statement from the company. This means that the attacker may be able to crack some website passwords of LastPass users through brute force guessing.

LastPass first disclosed the breach in August 2022 but at that time, it appeared that the attacker had only obtained source code and technical information, not any customer data. However, the company has investigated and discovered that the attacker used this technical information to attack another employee’s device, which was then used to obtain keys to customer data stored in a cloud storage system.

As a result, unencrypted customer metadata has been revealed to the attacker, including “company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.”

In addition, some customers’ encrypted vaults were stolen. These vaults contain the website passwords that each user stores with the LastPass service. Luckily, the vaults are encrypted with a Master Password, which should prevent the attacker from being able to read them.

The statement from LastPass emphasizes that the service uses state-of-the-art encryption to make it very difficult for an attacker to read vault files without knowing the Master Password, stating:

“These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass.”

Even so, LastPass admits that if a customer has used a weak Master Password, the attacker may be able to use brute force to guess this password, allowing them to decrypt the vault and gain all of the customers’ website passwords, as LastPass explains:

“it is important to note that if your master password does not make use of the [best practices the company recommends], then it would significantly reduce the number of attempts needed to guess it correctly. In this case, as an extra security measure, you should consider minimizing risk by changing passwords of websites you have stored.”

Can password manager hacks be eliminated with Web3?

The LastPass exploit illustrates a claim that Web3 developers have been making for years: that the traditional username and password login system needs to be scrapped in favor of blockchain wallet logins.

According to advocates for crypto wallet login, traditional password logins are fundamentally insecure because they require hashes of passwords to be kept on cloud servers. If these hashes are stolen, they can be cracked. In addition, if a user relies on the same password for multiple websites, one stolen password can lead to a breach of all others. On the other hand, most users can’t remember multiple passwords for different websites.

To solve this problem, password management services like LastPass have been invented. But these also rely on cloud services to store encrypted password vaults. If an attacker manages to obtain the password vault from the password manager service, they may be able to crack the vault and obtain all of the user’s passwords.

Web3 applications solve the problem in a different way. They use browser extension wallets like Metamask or Trustwallet to sign in using a cryptographic signature, eliminating the need for a password to be stored in the cloud.

An example of a crypto wallet login page. Source: Blockscan Chat

But so far, this method has only been standardized for decentralized applications. Traditional apps that require a central server don’t currently have an agreed-upon standard for how to use crypto wallets for logins.

Related: Facebook is fined 265M euros for leaking customer data

However, a recent Ethereum Improvement Proposal (EIP) aims to remedy this situation. Called “EIP-4361,” the proposal attempts to provide a universal standard for web logins that works for both centralized and decentralized applications.

If this standard is agreed upon and implemented by the Web3 industry, its proponents hope that the entire world wide web will eventually get rid of password logins altogether, eliminating the risk of password manager breaches like the one that has happened at LastPass.

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

Consumers are crypto-curious — One in five own digital currency: Accenture

An end-of-the-year report from Accenture showed that despite traditional payment methods dominating many markets, consumers are curious about crypto.

Over the last year, the crypto space has endured lasting market volatility and scandals, which have negatively affected consumer trust in the industry. However, an end-of-the-year report from Accenture revealed that consumers are still holding crypto — and for the long term.

According to Accenture’s 2022 Global Consumer Payments report, while many consumers still prefer traditional payment methods such as cash or credit card, one in five surveyed consumers now own a cryptocurrency.

For those that hold crypto, 28% say the choice to enter the crypto space is due to long-term investment. This is followed by 22% of consumers saying their choice to step into crypto was out of “curiosity” about the space.

Other alternative reasons were related to alternative financial options and cross border payments:

“A lack of standardization and the complexity of harmonizing regulations across jurisdictions may impede usage of CBDCs for cross-border transactions.”

The report also highlighted that the effects of recent volatility in the cryptocurrency market could “slow down their adoption, at least until the market becomes more regulated.”

Currently, only 23% of respondents said they trust crypto wallets to provide a secure environment for payments and purchasing.

It also mentioned central bank digital currencies (CBDCs) as an alternative payment method in the future. However, there are still many complications to be worked out.

The survey reached 16,000 customers in 13 countries across Asia, Europe, Latin America and North America in August and September 2022.

Related: Bringing community-based solutions to crypto lending can solve trust issues

Despite the hesitation, the recent market brought out next-generation payment methods that are on the rise. In addition to cash, card, check and e-commerce, this includes digital wallets, crypto, biometrically authenticated payments and metaverse payments.

The latter will particularly come into play as the metaverse and interactions in digital reality become more commonplace.

For now, however, the report concludes that 58% of consumers are still hesitant to transact in the metaverse due to a lack of trust in the available payment providers. This does not mean consumers are not curious.

Another recent report from Capgemini says that over 90% of consumers are curious about the metaverse and how it can transform their online experience.

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA

Software Firm Consensys Partners With Paypal, Metamask Users Can Use Payment Processor to Buy ETH

Software Firm Consensys Partners With Paypal, Metamask Users Can Use Payment Processor to Buy ETHOn Dec. 14, the Ethereum software firm Consensys announced that the company has teamed up with the payment processing giant Paypal. The integration allows Metamask wallet users to purchase ethereum via Paypal from within the Web3 wallet application. Consensys Teams up With Payments Giant Paypal According to Consensys, Metamask users can now purchase ethereum (ETH) […]

Latam Insights: El Salvador’s Bitcoin Debt Idea, Milei’s MAGA