Bytes And Barriers - Navigating Cybersecurity Threats In Digital Investment Platforms
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
BYTES AND BARRIERS: NAVIGATING CYBERSECURITY
THREATS IN DIGITAL INVESTMENT PLATFORMS
Sanskriti Chaudhuri, Amity Law School, Amity University Kolkata
ABSTRACT
The report of the 2019 Akamai State of the Internet shows that almost 50% cases of phishing where reported from the financial services sector. Thus, this shows that with the rapid development of technology the investment market has significantly incorporated the concept of digitalization. Through digitalization the investment platforms today are now able to offer accessibility, efficiency and scalability in a more enhanced manner thus revolutionising the financial market. However, just like the legal maxim goes of Ubi jus ibi remedium reflects that whenever there is a right, there is a remedy. Similarly, with advancement and advantage comes a lot of challenges in the digital investment market.
As individuals indulge more in financial transactions digitally, laying a lot of trust and reliance on the digital infrastructure the reality is far worse than their expectations where they are more vulnerable to a variety of cybersecurity threats like data breaches, phishing attacks, ransomware, and insider threats. This paper aims to explore the nature, impact, and finding potential suggestions that will help to mitigate these threats based on recent trends of cybersecurity threats.
INTRODUCTION
Kevin Mitnick a cybersecurity expert and author had rightly quoted that the digital economy thrives on trust, but that trust is only as strong as the cybersecurity protecting it. 1 The rise of digital investment platforms such as robo-advisors (online service which uses computer programs that helps to manage investments automatically with minimal human intervention), cryptocurrency exchanges (online platform where users buy, sell and trade in cryptocurrencies like Bitcoin, Ethereum or Tether and is similar to stock exchange and works on digital marketplace such as mobile apps or via desktop functions) and online brokerage services ( which facilitates the buying and selling of financial instruments like Equities, Bonds, NCDs, Derivatives, Stocks and ETFs through an online trading platform) has transformed how individuals and institutions engage with financial markets.
2 Now with the evolution of AI these platforms use advanced technologies like blockchain, and cloud computing to offer seamless investment opportunities. However, this digital transformation is now faced with a surge in cybersecurity threats which is posing risk to the sensitive financial data, investor assets, and market integrity. As per the statistics dated April 01, 2025, the global financial sector has faced significant unprecedented cyber risks, with cyberattacks doubling in frequency since the onset of the COVID-19 pandemic. The prime targets for cybercriminals are the digital investment platforms which are handling vast amounts of personal and financial information.
Therefore, it becomes essential to identify the primary cybersecurity threats which affect digital investment platforms, assess their impact on users and the broader financial ecosystem and propose mitigation strategies to strengthen platform resilience. 3
LITERATURE REVIEW
The intersection of cybersecurity and digital finance has resulted in significant scholarly attention in recent years. Several reports, blogs and articles reveal the following: I) Threat to Landscape: Studies show that the cyber threats are mostly driven by affordable hacking tools and AI-powered attack methods. Most cybercrimes like malware, phishing, and 1 Peris.ai - Cybersecurity, Strengthening The Human Firewall: Insights from Kevin Mitnick, LinkedIn (July 31, 2023), https://www.linkedin.com/pulse/strengthening-human-firewall-insights-from-kevin/.
2 Embroker Team, Must-Know Cyber Attack Statistics and Trends 2025, Embroker (Mar. 11, 2025),
https://www. embroker. com/blog/cyber-attack-statistics/. 3 Fabio Natalucci, Mahvash S. Qureshi & Felix Suntheim, Rising Cyber Threats Pose Serious Concerns for Financial Stability, IMF Blog (Apr. 9, 2024), https://www. imf. org/en/Blogs/Articles/2024/04/09/rising-cyberthreats-pose-serious-concerns-for-financial-stability. ransomware target the digital financial transactions. II) Risks related to Digital Transformation: Studies have also revealed that the shift from traditional investment infrastructure to cloud-based platforms and mobile applications has increased the vulnerability of attack surfaces highlighting the lack of adequate measures to counter such risks. III) Legal Regulatory Gaps: It is important to note that despite increased compliance requirements the Indian Courts lack adequate legislations to enforce cybersecurity standards specific to digital investment platforms.
IV) Trust breaches: Cyber incidents lead to significant financial and reputational losses therefore resulting in loss of trust and confidence of investors. 4
RESEARCH
METHODOLOGY
This study uses the qualitative research methodology which do not involve any collection or analysis of numerical data but involves understanding and analysis of legal frameworks, judicial interpretations and policy analysis. The study includes descriptive analysis wherein the overall understanding of the situation is taken and then evaluated to understand the effectiveness, loopholes and challenges in current laws and policies, that is, it is critically analysed. The study also involved focus on areas like reviewing of academic papers, industry reports, and case studies on cybersecurity in financial technologies, examination of recent cyber incidents involving digital investment platforms (e. g. , cryptocurrency exchange hacks, robo-advisor breaches) and incorporating current trends and strategies from cybersecurity professionals and financial regulators.
5 CYBERSECURITY THREATS IN DIGITAL INVESTMENT PLATFORMS Digital investment platforms face a diverse range of threats which are as follows: I) Data Breaches - In this type of cybersecurity threat the sensitive information of individuals
4 Alkesh Kumar Sharma, Navigating Cybersecurity Challenges
Safeguarding India's Digital Transformation in a Threatening Landscape, Fin. Express (Feb. 8, 2025), https://www.financialexpress.com/business/digitaltransformation-navigating-cybersecurity-challenges-safeguarding-indias-digital-transformation-in-a-threateninglandscape-3742706/. Karishma Asthana, Top 8 Cloud Vulnerabilities, CrowdStrike (Nov. 26, 2024), https://www.crowdstrike.com/enus/cybersecurity-101/cloud-security/cloud-vulnerabilities/.
5 Scribbr, Qualitative Research Methods, https://www.scribbr.com/methodology/qualitative-research/
like user credentials, account balances and history of transactions are accessed by breachers in an unauthorised way which results in identify theft, financial loss and regulatory penalties. For example, a breach exposing client data can lead to millions in fines under frameworks like GDPR. A case where such data breach has happened in cryptocurrency exchanges is the 2021 Binance incident. 6 II) Phishing and Social Engineering – Here deceptive tactics are used to trick users to reveal their login details or carry out fraudulent transactions and results in direct theft of funds and loss of trust of users. Phishing campaigns target mostly mobile app users and nowadays it is mostly done through AI. 7 III) Ransomware - This type of threat involves malicious software which encrypts platform data or systems and can only be decrypted on payment.
A ransomware attack on a trading platform could halt transactions and destabilize markets. 8 IV) Insider Threats - This type of threats involves malicious or negligent actions by employees or third-party vendors who have access to platform systems. This results in data leaks or system sabotage and are harder to detect due to legitimate access privileges. A recent case of insider threat was in 2023 which involved a disgruntled employee at a robo-advisor firm leaking client data. 9 V) Distributed Denial of Service (DDoS) Attacks - This type of threat involves an attacker who floods a network or website with traffic from multiple sources to overwhelm it and make it unavailable to legitimate users. This leads to trading interruptions and loss of user confidence and can coincide with market volatility to maximize disruption.
Recently, botnets in IoT devices have increased the scale and frequency of DDoS attacks. 10 VI) Advanced Persistent Threats (APTs) – It involves an intruder establishing an undetected
6 Investopedia, Could Google's New Quantum Chip Mean Your Bitcoin Could Soon Be Hacked?,
https://www.investopedia.com/can-quantum-computing-revolutionize-crypto-8759455 (Dec. 27, 2024). 7 NordLayer, 12 Most Significant 2023 Data Breaches, https://nordlayer.com/blog/data-breaches-in-2023/ (Oct. 8, 2024). 8 Metomic, The Biggest Financial Data Breaches in 2023, https://www.metomic.io/resource-centre/the-biggestfinancial-data-breaches-in-2023 (Oct. 8, 2024). 9 Md. Sadique Shaikh, Cyber Security Threats and Ways to Defend in Modern Society, 24 Heliyon e12737 (2024), https://www.sciencedirect.com/science/article/pii/S2405844024152231. A10 Networks, DDoS Attack on Dyn Reveals New Threat Actor Strategies, https://www.a10networks.com/blog/dyn-ddos-attack/). presence in a network in order to steal sensitive data over a prolonged period of time and could alter investment algorithms or falsify transaction records.11
REGULATORY
LEGAL FRAMEWORK
IN INDIA: There are several legislations in India governing cybersecurity threats which are as follows: I.
The Information Technology Act, 2000 is a significant legislation governing the aspects of cybersecurity in India and provides a legal framework for electronic transactions, protection of data, and cybersecurity addressing offenses related to unauthorized access, data breaches, and other cybercrimes. 12 II.
The Digital Personal Data Protection Act, 2023 governs the collection, processing, storage, and transfer of digital personal data in a secured manner and applies to both national and international entities who process data of individuals in India.13 III.
The National Cyber Security Policy, 2013 is a framework which aims to protect critical information infrastructure thus promoting cybersecurity awareness, and developing capabilities to counter cyber threats.14 IV.
Securities and Exchange Board of India (SEBI) Guidelines: SEBI which is the regulator for securities markets in India has issued the Cybersecurity and Cyber Resilience Framework (CSCRF) which is applicable to entities under its purview.15 V.
Reserve Bank of India (RBI) Directives: The RBI has made it compulsory to implement the Additional Factor of Authentication (AFA) for digital payments to enhance transaction security. Furthermore, the RBI plans to introduce exclusive domains like 11 Md. Sadique Shaikh, Cyber Security Threats and Ways to Defend in Modern Society, 24 Heliyon e12737 (2024), https://www.sciencedirect.com/science/article/pii/S2405844024152231. 12 Manvi Gupta & Ayush Gupta, Cyber Security Legal Framework in India – Overlaps, Problems and Challenges,
12 J. Bus. Mgmt. & Info. Sys. 11 (2025),
https://qtanalytics.in/journals/index.php/JBMIS/article/download/4934/2469/15486. DLA Piper, Data Protection Laws of the World: India, DLA Piper, Jan. 6, 2025, https://www.dlapiperdataprotection.com/index.html?c=IN&t=law. 14 Bharvi Shahi & Anand Raj Dev, Navigating India’s Digital Personal Data Protection Act: Critical Implications and Emerging Challenges, 3 Int'l J. Legal Socio. & Stud. Sci. 42 (2025), https://ijlsss.com/navigating-indiasdigital-personal-data-protection-act-critical-implications-and-emerging-challenges/. 15 Krishaank Jugiani, Cyber Security: India Must Update Digital Infrastructure, Legal Framework, CUTS CCIER, Feb. 14, 2023, https://cuts-ccier.org/cyber-security-india-must-update-digital-infrastructure-legal-framework/.
'bank.in' and 'fin.in' to mitigate risks associated with fraudulent websites.16 VI.
Digital India Act: This act is currently under consideration and aims to segregate and separate online intermediaries, including digital investment platforms, and establish a regulatory authority to enforce compliance and impose penalties for violations.17 VULNERABILITIES IN DIGITAL INVESTMENT PLATFORMS: There are several vulnerabilities in digital investment platforms which are as follows: I.
Insecure APIs and Poor Encryption Practices: Application Programming Interfaces (APIs) which are not securely configured and have poor encryption may expose platforms to unauthorized data access and manipulation thus making it easier for hackers to intercept and decipher sensitive information. II.
Platform Downtime and Outages: Technical failures or cyberattacks can lead to platform outages which therefore disrupts trading activities and causes financial losses for users. III.
AI-Powered Attacks: Attackers may use advanced techniques which includes artificial intelligence which automates and enhances cyberattacks thus making them more effective and harder to detect. IV.
Vulnerabilities in Decentralized Finance (DeFi) Platforms: DeFi platforms which is capable of operating without central intermediaries are particularly susceptible to coding errors and hacking. Blockchain transactions are irreversible which means that incorrect or fraudulent DeFi transactions cannot be easily corrected. In 2021, half of cryptocurrency crime was related to DeFi were attributed to developer incompetence and poorly enforced regulations. V.
Emerging Scam Techniques: New forms of scams such as “pig butchering,” involve building trust with victims over time before defrauding them which is often done DLA Piper, Data Protection Laws of the World: India, DLA Piper, Jan. 6, 2025, https://www.dlapiperdataprotection.com/index.html?c=IN&t=law. 17 Krishaank Jugiani, Cyber Security: India Must Update Digital Infrastructure, Legal Framework, CUTS CCIER, Feb. 14, 2023, https://cuts-ccier.org/cyber-security-india-must-update-digital-infrastructure-legal-framework/. through fake investment platforms.18
IMPACT
ANALYSIS
THROUGH CASE STUDIES: The impact of cybersecurity threats in digital investment platforms can be understood through the following cases: • Bybit Cryptocurrency Exchange Hack: In this case a Dubai based cryptocurrency exchange Bybit had experienced a security breach on February 2025 which resulted in theft of virtual assets worth approximately . 5 billion. The Federal Bureau of Investigation (FBI) had detected that this was done by Lazarus Group of North Korea known as Trader Traitor. It was found by the FBI that the hackers took advantage of the weaknesses of routine wallet transfer processes and by manipulating the transaction processes they were able to divert funds illegally. 19 • WazirX Crypto Exchange Breach: WazirX, which is the largest cryptocurrency exchange of India had suffered a significant cyberattack in July 2024 with over $200 million stolen in under two hours.
Upon investigation it was revealed that the breach was caused by North Korean hackers who had employed sophisticated tactics to infiltrate the platform. 20 • Paytm Mall Data Breach: Paytm Mall which is the e-commerce arm of the leading digital payments platform of India, Paytm, in 2020 experienced cybersecurity breach wherein hackers gained unauthorized access to the database of the company which therefore compromised personal data of millions of users. 21 18 Ayushi Singh, Cloud Computing Supply Chain Attacks – The Open-Source Effect, Voice&Data (Jan. 4, 2023), https://www. voicendata. com/cloud-computing-supply-chain-attacks-the-open-source-effect/. Security Challenges in the Cloud, Informatic, https://informatif. id/security-challenges-in-the-cloud/. Digital Supply Chain Attacks and Third-Party Risks, ManageEngine Log360, https://www. manageengine.
com/log-management/cyber-security/digital-supply-chain-attacks. html. 19 FBI Confirms Lazarus Hackers Were Behind . 5B Bybit Crypto Heist, BleepingComputer (Mar. 11, 2025), https://www. bleepingcomputer. com/news/security/fbi-confirms-lazarus-hackers-were-behind-15b-bybit-cryptoheist/. 20 WazirX Crypto Hack: North Korea's Involvement and International Responses, Business Standard (Jan. 15, 2025), https://www. business-standard. com/companies/news/wazirx-crypto-hack-north-korea-us-japan-southkorea-response-125011500597_1. html.
21 3.4 Million Accounts Were Compromised During August 2020 Paytm Mall Hack: Report, Hindustan Times
(Aug. 1, 2022), https://www.hindustantimes.com/technology/34-million-accounts-were-compromised-duringaugust-2020-paytm-mall-hack-report-101658917310718.html.
Capital One Data Breach: Capital One, a major financial institution had suffered a data breach affecting over 100 million customers in 2019. The breach was a result of a misconfigured web application firewall which allowed access to sensitive data in an unauthorised manner.22 • Bitfinex, a cryptocurrency exchange in 2016 was hacked resulted in the theft of approximately 119,754 Bitcoins which valued around $72 million at the time and it was found that the hackers had exploited the weaknesses present in the multi-signature security system of the platform.23
RECOMMENDATIONS
It is important to implement the following recommendations in order to curb the above risks: I.
Technological safeguards must be enhanced by incorporating strong encryption system, using machine learning algorithms to detect AI driven threats and ensure a mechanism where the users and devices used would be constantly checked and monitored to prevent any data breaches. II.
Regular audits, adequate employee trainings and test protocols must be developed to ensure that there is rapid and effective recovery from breaches. III.
The laws relating to cybersecurity especially the Information Technology act, the Digital Data Protection Act must be amended to govern cybersecurity threats driven by AI.
IV.
Educational campaigns and awareness programs must be conducted to ensure that people are aware about these cybersecurity threats. V.
Multi-factor authentication must be mandated in all digital investment platforms in order to prevent the occurrence of such cybersecurity threats.24
22 Brian Krebs, What We Can Learn from the Capital One Hack, Krebs on Security (Aug. 2, 2019),
https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/.
23 Decoding the Bitfinex BTC Return
A Legal and Ethical Conundrum, OneSafe Blog (Jan. 19, 2025), https://www.onesafe.io/blog/bitfinex-btc-return-controversy.
24 AI Cyber Security Laws in India, ResearchGate,
https://www.researchgate.net/publication/385469847_AI_Cyber_Security_Laws_in_India.
CONCLUSION
AND
ANALYSIS
Thus, to analyse the above we see from the various case studies that despite the compliance requirements and other regulatory mandates the cybersecurity threats continue to exist and there are chances that it might further increase in future as technological development is increasing. However, it is essential to understand that investment platforms require significant attention where these problems are to be addressed as the stakeholders who are majorly impacted are the investors. Therefore, to conclude, it is to note that a country will fall behind if it does not develop itself to the pace of technology, however with technology comes strong responsibility of utilising the technology and therefore the recommendations provided are essential for implementation to maintain a balance between digital use and data protection.