Author: Gu Yu, ChainCatcher

If in the past few years, what the cryptocurrency industry feared most was a bug in the blockchain smart contract, now project teams may worry more about an employee attending what seems like a normal online interview or partner meeting and downloading insecure software.

On October 29, the world’s largest cryptocurrency exchange Binance encountered an unprecedented security incident. Attackers infiltrated through multiple stages and ultimately controlled the exchange's internal wallet signing system, affecting approximately $6.34 billion in digital assets.

This attack was not a traditional smart contract vulnerability exploitation. According to Binance's preliminary investigation report released on November 3, attackers previously gained access to the core system step-by-step through fake job interviews, malware, compromised employee devices, and internal AI tools.

Notably, this is not an isolated incident.

In September, Bitget suffered a security incident involving approximately $387.5 million, where attackers breached key wallet infrastructure backend systems and bypassed authorization controls to complete asset transfers; in October, Ledger's hardware wallets distributed through certain Southeast Asian channels were implanted with malicious components, leading to stolen user assets; and in the first half of this year, projects like Kelp DAO and Drift Protocol also experienced attacks amounting to hundreds of millions of dollars.

From smart contracts to centralized exchanges, from employee computers to hardware wallet supply chains, it seems the cryptocurrency industry is facing a comprehensive security crackdown across the entire industry chain.

1. The largest losses from vulnerabilities are no longer in the code

In the first decade after the birth of the cryptocurrency industry, discussions about "security" largely revolved around whether "on-chain smart contracts have vulnerabilities," which pertains to the very foundation of blockchain technology. However, most attacks and damage now come from outside smart contracts.

According to CertiK's report for the first half of the year, the largest category of loss was wallet breaches: 33 incidents, $444 million, with an average loss of over $13 million per incident. Phishing was second, with 63 incidents, $366 million. Although code vulnerabilities occurred 204 times, they accounted for only 11.5% of the losses.

"What concerns me most is not the total amount but the shape of the losses," said CertiK co-founder and CEO Gu Ronghui in an interview with Forbes. Nearly half of the losses in the first half of the year were concentrated in the incidents of Kelp DAO and Drift Protocol, totaling about $577 million, "both of which stemmed from operational and infrastructure-level mistakes, not traditional code vulnerabilities."

His explanation is straightforward: "Compared to finding bugs in the code, attacking key management, multi-signature governance, and operational infrastructure yields far greater returns."

This pathway has been repeatedly demonstrated this month. Ledger's issue was not at the chip level but with the vendors—devices were compromised before being delivered to users; Ngrave's issue was not with the wallet but with the notification service provider being hijacked, followed by phishing; Polymarket's problem was not within its own system but in a script from a performance monitoring firm in the UK; Bloom Trading's issue stemmed from a remote code execution vulnerability in a third-party module; on October 31, at least 12 to 15 DeFi website domains were replaced with counterfeit sites in the same batch of DNS hijacking.

Governance is no exception. X100 was seized of $4.85 million through flash loans and governance takeover; Hifi Finance lost about $1 million due to a malicious proposal submitted by an address funded by Tornado Cash; Yapeswap's governance attack was even simpler—setting the quorum to zero.

Data reveals the direction of the shift in attack patterns: Ari Redbord, global policy head at TRM Labs, noted that attacks targeting infrastructure and keys accounted for only 15% of all incidents but caused 76% of the losses.

But more troublesome than "where did the money go" is what happens after it is gone. For most projects, once attacked, the trust of users and the market cannot be restored, even for long-established renowned projects.

In November last year, Balancer lost $128 million in less than half an hour due to rounding errors in its v2 composable stable pools, involving six chains. This August, this once $7 billion managing protocol announced it would gradually shut down. The team acknowledged in an open letter that they had underestimated the impact of this vulnerability on subsequent adoption: every subsequent cooperative communication had to start with explaining that vulnerability, resulting in longer decision cycles and smaller collaboration scales.

The cost of a vulnerability extends far beyond the stolen amount. The question arises: given the clear costs, why hasn’t the defense line thickened accordingly?

2. Technology is advancing, but attacks are running faster

Such a dire situation prompts deep reflection: with technological advancements, the cryptocurrency industry should be becoming increasingly secure, so why is it becoming less secure instead?

AI is one of the most notable factors. In the past year, AI has developed rapidly, with various models flourishing, and while numerous cryptocurrency companies are incorporating AI into their daily workflows, hacker groups are becoming even more adept at utilizing AI.

In an assessment on October 29, Microsoft stated that among eight North Korean hacker organizations it tracked, three have integrated AI into their daily operations, with another four rapidly expanding their use. They use generative models to batch-fake recruiting companies, customize interview scripts, and even directly assist in vulnerability mining.

The founder of Slow Fog, Yu Xian, mentioned a case: Moonwell was robbed of $1.78 million, and the problematic code bore the "Co-Authored-By: Claude Opus 4.6" tag—generated by AI and directly merged into the production environment.

Security researcher Stacy Muur candidly stated, "Cryptocurrency security is completely doomed," and "We are entering a rather serious cyber arms race"; Bankless co-founder Ryan Sean Adams warned that AI is granting hackers "dark superpowers," and "we are running out of time." CZ also stated, "The AI industry has not yet managed to ensure that defensive capabilities are launched ahead of attacking capabilities"; the industry can only "use AI to fight against AI."

A more cutting-edge risk is Agents. Gu Ronghui predicts: "An AI Agent with wallet access is essentially a new type of high-privilege key holder. The difference is that its decision-making process may be manipulated by external inputs, and these abnormal humans may be able to detect it; an Agent without sufficient security constraints may not recognize them." CertiK recorded an early prototype: in June, a well-known arbitrage bot JaredFromSubway was misled by a counterfeit arbitrage pool deployed by attackers, which automatically approved a malicious contract, resulting in a loss of approximately $7.5 million.

However, attributing everything to AI overlooks another half of the answer. The structural inadequacy of safety investment in the industry is also a core factor. Cryptocurrency projects generally emphasize marketing over security, and audit reports often quickly become invalid after on-chain upgrades; the lazy screening logic of "looking at audits, checking TVL, comparing APY" has completely failed.

The observations of Dragonfly partner Haseeb Qureshi provide another perspective: by 2026, the amount stolen in DeFi is projected to be approximately $1.89 billion annually, lower than in 2025. While the number of attacks has increased, the scale of each attack has decreased faster—attackers are increasingly turning to small protocols and abandoned projects because large protocols have completed more fortifications. This precisely illustrates that the threats have not diminished; rather, the defensive resources are highly uneven: top institutions can afford to build defenses, while long-tail projects are left exposed.

The uneven distribution of defensive resources is only one side; the other side consists of adversaries who do not operate according to the cost structures of startups—namely, North Korean hackers operating as state machinery.

According to Chainalysis statistics, North Korean-related hackers are expected to steal about $2.02 billion in 2025, with a cumulative total of about $6.75 billion over the years. This isn’t a ragtag army; it is an operation system with a national budget, patience, and month-to-month planning—reports from UN expert groups explicitly link cryptocurrency theft to funding for North Korean ballistic missile and nuclear weapons development. When attackers are state actors and the defenders are startup companies, the nature of this war has changed.

Additionally, new standards are creating new attack surfaces. In the Binance case, attackers leveraged the EIP-7702 account abstraction authorization mechanism to delegate execution logic of hot wallets to malicious contracts—every step forward in innovation expands the attack surface.

The number of places needing fortification is increasing, while the windows for fortification often only arise after incidents occur.

3. The industry re-discusses "security"

Binance's preliminary investigation report on November 3 revealed embarrassing details, detailing how hackers conducted social engineering attacks. The report also stated that since 2026, Binance's security team has detected and prevented 57 suspected cyber threats related to North Korea, using methods ranging from fake job postings, malware disguised as popular development tools, to tampered software packages and fake video conferencing applications.

Discussions in the industry quickly shifted from "who did it" to another question: after an employee is deceived and a computer is compromised, what other defenses can prevent losses from expanding? The same line of questioning applies to other cases this month—Ledger's vendors, Polymarket's third-party scripts, the batch of DNS hijacking on October 31, with initial points of entry not located within their own systems.

CoinEx founder Yang Haipo categorized this as three mistakes that could have been avoided: the development and operational environment were not sufficiently isolated, production operations lacked a second verification, and signing participants did not conduct independent verification. His sharpest remark was that if parties only trust upstream requests, "even adopting a multi-signature architecture may behave no differently from a single-signature"—these measures do not require complicated technology; what is lacking is discipline. AltLayer founder YQ's assessment is similar: such attacks have exceeded the coverage of smart contract audits, and defenders must understand the complete workflow between employee terminals, internal tools, and production clusters.

However, simplifying the incident as "a few low-level mistakes" is equally dangerous. Slow Fog founder Yu Xian warned that only after actually encountering attacks can one see how intelligence collection, malware evasion, trust chain utilization, lateral poisoning, and risk control circumvention combine; this is an APT process; "methods that seem rough, in the right target and working scenarios, can still lead to severe consequences." BitsLab co-founder Luis is more direct: screen locks cannot block the backend malware once implanted on devices; the asymmetric costs of offense and defense are already significant, and AI will continue to amplify this asymmetry.

Both sides ultimately agree on the conclusion: security can no longer be something delivered by an audit report before going live. Gu Ronghui stated that the industry is now facing not "how to prevent a single vulnerability from being exploited," but a protective system covering the entire asset lifecycle, ensuring that even if a segment is compromised, the losses can be contained. Yu Jianing pointed out that a management model based primarily on pre-deployment audits is no longer adequate; continuous assessment, real-time monitoring, and emergency response need to be integrated into regular governance.

Further out, the only part of this round of incidents that can be considered good news is that on October 31, the FBI attributed the attack to North Korea's TraderTraitor operation, with the Secret Service and IRS Criminal Investigation Division releasing hundreds of involved addresses and urging THORChain node operators, instant exchange platforms, DeFi protocols, and blockchain analysis companies to intercept related transactions; issuers like Tether and Circle collectively froze about $3 billion. When one exchange encounters a problem, the entire industry's clearing and issuance processes can be mobilized within hours.

However, collaboration changes the distribution of losses after they occur, not the probability of losses happening. CertiK statistics show that in the first half of the year, the total funds frozen or returned across the industry amounted to $115 million, accounting for 8.8% of the $1.31 billion lost; Binance's recovery rate this time is astonishingly high, primarily because what was stolen was stablecoins, while Bitcoin and Ethereum without issuers still remain in the attacker's hands, amounting to about $2.4 billion.

Conclusion

From smart contract vulnerabilities to employee device breaches, from third-party service providers being compromised to AI-assisted infiltrations, from governance attacks to the long-term schemes of North Korean hacker organizations, the cryptocurrency industry is experiencing a profound change in attack patterns.

AI has further reduced the preparation costs for attacks, while specialized attack organizations have continuously increased the scale and persistence of attacks. Meanwhile, the long-standing insufficient investment in security by project teams has created more opportunities for these attacks.

A project's withdrawals may be paused in time, an anomalous transaction may be frozen by stablecoin issuers, and an attack may only result in user data leaks and internal system permission breaches. But all these events signify that almost all cryptocurrency projects have lost control over their security boundaries.

Blockchains can guarantee that transaction records are immutable but cannot ensure that the individuals initiating transactions are not deceived or that the keys signing those transactions have not been stolen. When attackers begin to bypass code and directly target individuals and organizations, the cryptocurrency industry needs to rethink what true security really means.

If in the past decade, the cryptocurrency industry's most significant innovation was establishing a value transfer system that does not require trusting third parties, then in the next decade, the industry must answer another question: how to truly protect user assets and trust in an environment filled with untrustworthy participants?

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。