As many of you may have heard recently, many major cryptocurrency exchanges such as Kraken, Poloniex and many others experienced scalability issues as a result of a large influx of users in the past month. These scalability issues can be attributed to a lot of reasons but perhaps one of the most critical flaws is that some of these exchanges are still monolithic applications built with a technology stack that is in some cases severely outdated.
A monolithic application is one in which the user interface (frontend) and the business logic (backend) reside in the same codebase. This is different from a decoupled application in which the frontend and backend are separately developed and integrated in the final stages of development. Many established companies today in early stages started out as monolithic application. For example, Facebook was originally a monolithic application created with PHP, MySQL, and Apache.
Your application (or cryptocurrency exchange) shouldn't have a single point of failure. Having a single codebase with both your user interface and business logic is analogous to having all of your Bitcoin stored in a single wallet address. If your server fails, or your wallet gets compromised you're essentially screwed.
Using the website BuiltWith we are able to gain some insights as to what technologies that the Poloniex exchange uses and measure the risks that they may pose.
Although BuiltWith was only able to detect frontend related technologies and was not able to detect exactly which language they use on the backend, but potential traders should also be informed that Poloniex's backend has had issues in the past.
Cloudflare experienced multiple security problems earlier this year. The Cloudbleed exposed sensitive data through a memory of leak of millions of cloudflare users.
1/3 IMPORTANT NOTICE: Due to the widespread impact of Cloudflare's recently-discovered parser bug #cloudbleed…
- Poloniex Exchange (@Poloniex) February 24, 2017
2/3 …we highly recommend that all users change their password and enable 2FA immediately.</p - Poloniex Exchange (@Poloniex) February 24, 2017
3/3 This affects far more sites than Poloniex, including other exchanges. It is imperative to use unique passwords and 2FA for all services.
- Poloniex Exchange (@Poloniex) February 24, 2017
Cloudflare quickly addressed the issue in the weeks after, but given the nature of the field of security there is nothing to say that the attack could happen again. Bittrex, and Kraken also use Cloudflare for DDoS and DNS protection.
Both Kraken and Poloniex were attacked over the past couple of days by a distributed denial of service attack (DDoS). A DDoS occurs when multiple requests (millions) are made on a specific endpoint with the intention of bringing it down. As stated before Cloudflare is supposed to provide protection against these type of attacks, apparently Cloudflare wasn't enough to keep these exchanges up.
DDoS; we're working to mitigate.
- Poloniex Exchange (@Poloniex) May 9, 2017
Nginx reports security vulnerabilities here. There haven't been any major vulnerabilities to Nginx to my knowledge in the past but traders should be wary of this as well as many exchanges utilize the service.
Never store a large amount of your cryptocurrency on exchanges. Definitely look in to using cold storage options. Cold storage are client-side wallets such as hardware wallets or paper wallets. Here is a list of some of the most popular solutions
Popular Hardware Wallets
Popular Paper Wallet / Client-side Solutions
Personally I am a big fan of MyEtherWallet because you can generate client-side wallets for your Ethereum/tokens as well as connect to your own local node.
Stay safe Np