Exchange security remains exposed.

Chainalysis reported a recent breach where attackers drained approximately $35 million in ~15 minutes by accessing private keys tied to an exchange's hot wallets.

They report: "Hot-wallet compromises are becoming one of the most expensive and frequent risks facing custodians and exchanges today."

This type of breach only happens for a few reasons.

1. Private keys were accessible on an online system.

- Hot wallets store keys on systems connected to the internet, so if an attacker gains access to this surface in any way, they can use the key as if they were the exchange.

2. Signing system not isolated.

- If the signing process lives in the same system the attacker gained access to, it enables them to move funds at will.

3. There was no hardware security module (HSM) or multi-factor control.

- An HSM adds (required) complexity in approval steps so that breaching the server alone would not have been enough to move funds.

Insurance coverage isn't static, but rather varies by jurisdiction. Many exchanges outside of the US operate with minimal protection, which adds complexity when it comes to hacks and compromises.

As adoption increases, the security behind the way we handle money should as well. We can't prevent every breach, but a disaster recovery plan helps reduce the blast radius when these types of events occur.