ICORating-加密货币交易所安全报告（数字货币）（英文）-2018.10-9页

Exchange Security Report Summary

Core Content

This report evaluates the security of 100 cryptocurrency exchanges based on four main categories: Console Errors, User Account Security, Registrar and Domain Security, and Web Protocols Security. The goal is to identify potential vulnerabilities and assess the overall security posture of these exchanges.

Main Points

• Historical Context: Over the past 8 years, more than $1.3 billion in cryptocurrency has been stolen from hacked exchanges. Some exchanges have recovered, while others have gone bankrupt.
• Market Growth: The number of crypto exchanges has grown to over 200, with no single exchange being critical to the market's stability.
• Regulatory Environment: While some countries are introducing regulatory requirements, no exchange is fully protected from asset loss.

Key Categories and Findings

Console Errors

• Summary: Code errors are common in exchanges, with 32% having defects in their console systems.
• Detailed Findings:
  • 49% of exchanges have no console errors or warnings.
  • 68% of exchanges have no errors.
  • 32% of exchanges have code errors leading to operational defects.

User Account Security

• Summary: User account security is a major concern, with many exchanges lacking strong password policies and two-factor authentication (2FA).
• Detailed Findings:
  • 41% allow passwords with fewer than 8 symbols.
  • 37% allow passwords with only digits or letters.
  • 5% allow account creation without email verification.
  • 3% lack 2FA.
  • Only 46% of exchanges meet all four security parameters.

Registrar and Domain Security

• Summary: Domain and registrar security measures are generally weak, with few exchanges implementing best practices.
• Detailed Findings:
  • Only 2% use registry lock.
  • Only 10% use DNSSEC.
  • No exchange met all five security parameters.
  • Only 4% of exchanges used best practices in 4 out of 5 areas.

Web Protocols Security

• Summary: Web protocol security is also lacking, with only a small percentage of exchanges having all necessary security headers.
• Detailed Findings:
  • Only 10% of exchanges have all five headers.
  • 29% of exchanges have none of the headers.
  • Only 17 exchanges have a Content Security Policy (CSP) header.

General Exchange Security Rating

• Scoring System: Each exchange is scored based on the four categories, with a maximum of 100 points.
• Top Performing Exchanges:
  • Coinbase Pro: 89 points
  • Kraken: 80 points
  • BitMEX: 78 points
  • GOPAX: 78 points
  • CPDAX: 74 points
• Lowest Performing Exchanges:
  • OKCoin.cn: 15 points
  • Allcoin: 19 points
  • Tidex: 20 points
  • EXX: 24 points
  • BCEX: 24 points

Conclusion

• The report highlights significant security gaps across the evaluated exchanges.
• Most exchanges lack strong security measures, especially in domain protection and web protocol headers.
• Users are advised to invest in reliable exchanges, diversify their portfolios, and be cautious of potential security risks.