I think the people who should be paying closest attention to the hack of Japan’s GMO 「お名前.com デスクトップクラウド」 are crypto traders running quant bots—not people who brush it off as a forex-industry joke.
This service is a VPS designed to run forex EAs on MT4/MT5. In an announcement on October 21, the company said a third party had gained unauthorized access and installed malware. As many as 26,739 servers may have been affected. All plans were taken offline, with no estimated recovery time. News reports later said the hackers obtained login credentials and placed random trades in accounts at dozens of brokerages, wiping out balances. They also demanded a ransom, which GMO refused to pay. The compensation plan is a flat 5,000 yen per person, plus verified losses.
5,000 yen. You read that right.
Put simply, if you leave your account password and API keys on a cloud desktop hosted by someone else, in an environment shared by thousands of people, your security is only as good as that hosting provider’s least competent admin. It’s exactly the same in crypto. How many people leave exchange API keys on cheap VPSs to run grid or arbitrage bots, with withdrawal permissions enabled and no bother to set up an IP whitelist?
Enable trading only—not withdrawals—for your API keys. Whitelist IPs. Manage the machine your bot runs on yourself. If something goes wrong, no one will be there to bail you out.
#APISecurity
This service is a VPS designed to run forex EAs on MT4/MT5. In an announcement on October 21, the company said a third party had gained unauthorized access and installed malware. As many as 26,739 servers may have been affected. All plans were taken offline, with no estimated recovery time. News reports later said the hackers obtained login credentials and placed random trades in accounts at dozens of brokerages, wiping out balances. They also demanded a ransom, which GMO refused to pay. The compensation plan is a flat 5,000 yen per person, plus verified losses.
5,000 yen. You read that right.
Put simply, if you leave your account password and API keys on a cloud desktop hosted by someone else, in an environment shared by thousands of people, your security is only as good as that hosting provider’s least competent admin. It’s exactly the same in crypto. How many people leave exchange API keys on cheap VPSs to run grid or arbitrage bots, with withdrawal permissions enabled and no bother to set up an IP whitelist?
Enable trading only—not withdrawals—for your API keys. Whitelist IPs. Manage the machine your bot runs on yourself. If something goes wrong, no one will be there to bail you out.
#APISecurity