TOP-100 EXCHANGES BY CYBERSECURITY SCORE #3 AND COMBINED SCORE (MARCH 2020)

It is obvious that in the modern economy cyber security is one of the most crucial issues requiring proper maintenance. Especially in the crypto exchanges industry since over $282 million were stolen in 11 hacks from crypto trading platforms in 2019 according to a report by Chainanalysis. Although the total amount stolen is much smaller than in 2018 the number of attacks significantly increased. Therefore CER continues to monitor and assess the cyber security of crypto exchanges.

In the current Analysis CER used the list of 236 spot crypto exchanges from CoinGecko with Trust Score available as of 24.03.2020. 

The initial Cyber Security Score (CSS) methodology was described in the first report and the updates are highlighted in the second report. For the current report the methodology was slightly adjusted by altering weight coefficients of certain parameters and changing the calculation of Password Requirements for more balanced results. 

Statistics

The CSS results from results showed that only 19 crypto exchanges (8%) out of 236 gained “good” scores of over 8 points and higher (see fig 1). 

While the vast part of the sample (148 crypto exchanges, 62.8%) scored moderately (6 to 8 points), 69 crypto exchanges (29.2% out of total) totaled lower than 6 points.

Just like in the previous CSS report the Bug Bounty availability appeared to be weakest parameter again (see fig. 2)

Missing HTTP headers is the second weakest parameter as 76.7% of exchanges miss 4+ headers out of 7 (see fig. 3)

And another notable weakness is the presence of captcha during the sign-up and sign-in process on the trading platforms. 97 of exchanges (41.1%) don’t have captcha at all (see fig. 4).

The results for Password Requirements are way better than in the previous report due to altered methodology. Nevertheless some crypto exchanges treat this parameter irresponsibly as 13.56% of them scored 1 or 0 points. And in one particular case the platform allowed to create a 1-symbol password.

New CSS Top-100 Spot Exchanges

Table 1 below provides the list of Top-100 out of 236 sample spot crypto exchanges by CSS total results. It also contains sub-scores for Server Security, User Security, Crowdsourced Security and Historical Cases.

Table 1. Top-100 crypto exchanges by CSS results

Combined Score

Cyber Security is one of the most important parameters one should consider while evaluating crypto exchanges. But Cyber Security alone doesn’t give the full view of the trading platform’s grade. For more balanced evaluation other parameters should be assessed. Therefore CER calculated the Combined Score by adding CSS and CoinGecko’s  Trust Score equally weighted. Fig. 5 shows the distribution by Combined Score results. 

Fig. 5. Distribution of Combined Score.

In the table 2 below one can find the list of Top-100 crypto exchanges by Combined Score.

Table 2. Top-100 crypto exchanges by Combined Score 

Conclusions

As apparent from CSS results only 8% of trading platforms scored favorably (8 points and higher) and over 29.2% of them received fair results (below 6 points). These figures are once more highlighting the need for cyber security enhancement in the industry.As an answer on a demand for complex versatile ranking of crypto exchanges CER integrated CSS and CoinGecko’s Trust Score. The Combined Score provides a more comprehensive and multifaceted rating of cryptocurrency trading platforms. We believe that the approach of combining different assessment methodologies will help users to better evaluate the grade of crypto exchanges. Exchanges representatives can get details about their exchange rating by leaving a request in our contact form.