Blockchain Security Training Blockchain Wallet & Exchange Security 2 — Questions and Answers
Question 1: What is the key security difference between a 'hot wallet' and a 'cold wallet' used by cryptocurrency exchanges?
- Hot wallets use stronger encryption algorithms
- Hot wallets are internet-connected and thus more vulnerable to remote attacks (Correct answer)
- Cold wallets are faster for processing high-volume trades
- Hot wallets require hardware security modules (HSMs)
Correct answer: Hot wallets are internet-connected and thus more vulnerable to remote attacks
Hot wallets maintain an active internet connection for liquidity, making them the primary target for remote hacking attempts.
Question 2: Why do major exchanges keep the majority of user funds in cold storage rather than hot wallets?
- Cold storage is required by US financial regulations for all crypto firms
- Offline storage eliminates the remote attack surface for the bulk of assets (Correct answer)
- Cold storage wallets earn higher staking rewards
- Hot wallets cannot hold more than a fixed dollar amount
Correct answer: Offline storage eliminates the remote attack surface for the bulk of assets
Storing most assets offline means that even a full hot wallet compromise exposes only a small fraction of total funds.
Question 3: What security control do exchanges use to verify user identity and comply with anti-money laundering requirements?
- Zero-knowledge proofs
- Know Your Customer (KYC) verification (Correct answer)
- Ring signatures
- Stealth addresses
Correct answer: Know Your Customer (KYC) verification
KYC procedures require users to submit government-issued ID, enabling exchanges to satisfy AML/CFT compliance obligations.
Question 4: What is a 'rug pull' in the context of DeFi exchange security?
- A protocol upgrade that reduces transaction fees unexpectedly
- Developers draining liquidity pools and abandoning a project after raising funds (Correct answer)
- A smart contract bug that locks user funds permanently
- A front-running bot exploiting MEV on DEX trades
Correct answer: Developers draining liquidity pools and abandoning a project after raising funds
In a rug pull, malicious project founders withdraw all pooled liquidity, rendering investors' tokens worthless and pocketing the funds.
Question 5: What is the purpose of enforcing withdrawal address whitelisting on a centralized exchange account?
- It increases withdrawal processing speed by pre-authorizing addresses
- It restricts withdrawals to pre-approved addresses, limiting attacker options even after credential theft (Correct answer)
- It bypasses 2FA requirements for trusted addresses
- It reduces network fees by batching whitelist transactions
Correct answer: It restricts withdrawals to pre-approved addresses, limiting attacker options even after credential theft
Whitelisting means a compromised account can only send funds to pre-verified addresses, neutralizing the attacker's ability to redirect withdrawals.
Question 6: Which attack involves sending tiny amounts of cryptocurrency to many addresses to break the privacy of wallet owners through later transaction analysis?
- Replay attack
- Dusting attack (Correct answer)
- Sybil attack
- Timejacking attack
Correct answer: Dusting attack
A dusting attack sends microscopic 'dust' to target wallets so that when users move those funds the attacker can cluster and de-anonymize their transactions.
Blockchain Security Training Blockchain Wallet & Exchange Security 2
What is the key security difference between a 'hot wallet' and a 'cold wallet' used by cryptocurrency exchanges?