Just now, @Gate_zh posted another update on the progress of the theft incident. Looks like they’re not planning to compensate users, just offering assistance in recovering funds (including legal aid and stuff). But the money is already being laundered, so this kind of assistance probably won’t recover much—it’s more about showing an attitude. Honestly, it’d be better if they negotiated something practical with the victims, like offering some compensation to smooth things over after the PR mishap. That way, both sides could more easily unite to go after the hackers and discuss responsibility for the financial losses. From the announcement, there are two points that align with my initial thoughts: 1. Current CEX facial recognition systems need to keep up with the rapid development of AI technology, as many of them are no longer secure. I asked some friends in this field, and they said Apple Face ID is still pretty hard to crack—it uses infrared dot projection, depth cameras, 3D modeling, and Secure Enclave, which current AI can’t handle. But many CEX platforms are still stuck with older methods like blinking, turning your head, or even uploading videos. These are more like KYC live verification and are much easier to bypass. At least Gate openly admitted their facial recognition system isn’t robust enough this time 2. The victim was likely targeted through deep social engineering or possibly by someone close to them. For example, Alipay’s old records and screen recordings from years ago are things that CEX platforms can’t access, and even former employees wouldn’t be able to deduce this. If the hacker could provide this kind of precise information, does it mean they had partial access to the victim’s Alipay account? The suspicious point I raised earlier about logging in from an old device and passing the passkey hasn’t been clarified yet. The victim claims their computer wasn’t tampered with, while Gate says there was a login. Both sides should communicate further to figure out where the discrepancy lies. I’ve seen cases before where someone’s partner secretly stole money, which is why I’m particularly curious about how the hacker overcame these physical barriers. This incident also reminded me to do a security check on all my old CEX accounts, making sure the registered email and phone number are ones I can receive alerts from immediately, and that each platform has a unique password. Of course, it’s still important to ⚠️ Protect your privacy, reduce your exposure, and avoid posting high-resolution photos and videos of yourself online. Who knows how powerful AI will get in the future? I’ll keep following this case.