Preventing account takeover on centralized cryptocurrency exchanges in 2025
Summary: Trail of Bits published a white paper documenting account takeover attack vectors and defenses specific to centralized cryptocurrency exchanges, noting that platform design choices such as not supporting phishing-resistant MFA like U2F hardware keys, or not tracking user events to trigger in-app account lockdown prompts, invite attackers in. The Sift Q3 Digital Trust and Safety Index reported an 808% year-over-year increase in takeovers of financial (including crypto) accounts in 2023, and fewer than half of victims Sift surveyed were notified that any data loss or breach had occurred.
Why it matters: A 2016 RAND survey cited in the report found 68% of respondents who had financial information compromised suffered a median financial loss of $864, and an attacker who exfiltrates credentials or session tokens can sell them or hold them before funds ever move - so the window between compromise and theft may be one your monitoring never sees.
Read the original at Trail of Bits Blog ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026