The security logic of the cryptocurrency industry has been completely rewritten

*Author: Gu Yu, ChainCatcher*

If in the past few years, the biggest fear in the crypto industry was a bug in blockchain smart contracts, now project teams may be more concerned about an employee participating in what seems to be a normal online interview or partner meeting and downloading unsafe software.

On October 29, the world's largest cryptocurrency exchange, Binance, experienced an unprecedented security incident. Attackers gained control of the exchange's internal wallet signing system through multi-stage infiltration, affecting approximately $6.34 billion worth of digital assets.

This attack was not a traditional smart contract vulnerability exploit. According to Binance's preliminary investigation report released on November 3, the attackers previously gained access to the core system step by step through fake job interviews, malware, compromised employee devices, and internal AI tools.

More notably, this is not an isolated incident.

In September, Bitget faced a security incident involving approximately $387.5 million, where attackers bypassed authorization controls to transfer assets after breaching the backend systems of key wallet infrastructure; in October, Ledger's hardware wallets leaked through some Southeast Asian distribution channels were implanted with malicious components, resulting in user asset theft; and in the first half of this year, projects like Kelp DAO and Drift Protocol also suffered attacks amounting to hundreds of millions of dollars.

From smart contracts to centralized exchanges, from employee computers to hardware wallet supply chains, the crypto industry seems to be facing a security siege that covers the entire industry chain.

### I. The Biggest Losses Are No Longer in the Code

In the first decade of the crypto industry's existence, discussions about "security" mostly revolved around whether "on-chain smart contracts have vulnerabilities," which is fundamental to blockchain technology. However, most attacks and damages now come from outside smart contracts.

In CertiK's report for the first half of the year, the category with the largest losses was wallet intrusions: 33 incidents, $444 million, with an average loss of over $13 million per incident. Phishing ranked second, with 63 incidents totaling $366 million. Although code vulnerabilities occurred 204 times, they accounted for only 11.5% of the losses.

"What concerns me most is not the total amount, but the shape of the losses," said Gu Ronghui, co-founder and CEO of CertiK, in an interview with Forbes. Nearly half of the losses in the first half of the year were concentrated in the Kelp DAO and Drift Protocol incidents, totaling about $577 million, "and both stemmed from operational and infrastructure-level mistakes, not traditional code vulnerabilities."

His explanation is straightforward: **"Compared to finding vulnerabilities in code, attacking key management, multi-signature governance, and operational infrastructure offers much higher returns."**

This path has been repeatedly demonstrated this month. The issue with Ledger was not in the chip but with the distributors—devices were compromised before reaching users; Ngrave's issue was not with the wallet but with the notification vendor being hijacked, followed by phishing; Polymarket's issue was not with its own system but with a script from a UK website performance monitoring company; Bloom Trading's issue was due to a remote code execution vulnerability in a third-party module; on October 31, at least 12 to 15 DeFi websites had their domain names swapped out in the same batch of DNS hijacking.


Governance is no exception. X100 was taken over through a flash loan combined with governance, resulting in a loss of $4.85 million; Hifi Finance lost about $1 million due to a malicious proposal submitted by an address funded by Tornado Cash; the governance attack on Yapeswap was even simpler—setting the quorum to zero.

Data reveals the direction of the shift in attack patterns: Ari Redbord, global policy director at TRM Labs, pointed out that attacks on infrastructure and keys accounted for only 15% of all incidents but caused 76% of the losses.

However, more troublesome than "where the money was lost" is what happens after the loss. For most projects, once attacked, user and market trust is irreparably lost, even for well-established projects.

In November last year, Balancer lost $128 million in less than half an hour due to rounding errors in its v2 composable stable pool, involving six chains. In August this year, this once $7 billion managing protocol announced a gradual shutdown. The team admitted in an open letter that they had underestimated the impact of the vulnerability on subsequent adoption rates: every collaboration communication thereafter had to start with an explanation of that vulnerability, resulting in longer decision cycles and smaller collaboration scales.

The cost of a vulnerability is never just the stolen amount. The question arises: since the cost is so clear, why hasn’t the defense line thickened accordingly?

### II. Technology Is Advancing, But Attacks Are Outpacing It

Such a severe situation inevitably raises the question: with technological advancements, the crypto industry should be becoming more secure; why is it becoming less secure instead?

AI is one of the most notable factors. In the past year, AI has developed rapidly, with various models flourishing. While countless crypto companies have integrated AI into their daily workflows, hacker groups have become increasingly adept at utilizing AI.

In an assessment on October 29, Microsoft stated that among the eight North Korean hacker groups it tracks, three have integrated AI into their daily operations, and four are rapidly expanding their usage. They use generative models to mass forge recruitment companies, customize interview scripts, and even directly assist in vulnerability exploitation.

Yuan Xian, founder of Slow Mist, mentioned a case: Moonwell was hacked for $1.78 million, and the problematic code bore the tag "Co-Authored-By: Claude Opus 4.6"—generated by AI and directly merged into the production environment.

Security researcher Stacy Muur bluntly stated, "Crypto security is completely finished," and "we are entering a rather serious cybersecurity arms race"; Bankless co-founder Ryan Sean Adams warned that AI is granting hackers "dark superpowers," and "our time is running out." CZ also stated, "The AI industry has not yet achieved a defense capability that outpaces attack capabilities," and the industry can only "use AI to combat AI."

An even more advanced risk is the Agent. Gu Ronghui's judgment is: "An AI Agent with wallet access essentially represents a new type of high-privilege key holder. The difference is that its decision-making process may be manipulated by external inputs, and these abnormal humans may be able to detect it; an Agent without sufficient security constraints may not be able to recognize this." CertiK recorded a prototype: in June, the well-known arbitrage bot JaredFromSubway was induced by a fake arbitrage pool deployed by attackers, automatically approving a malicious contract, resulting in a loss of about $7.5 million.

However, attributing everything to AI misses half the answer. The structural inadequacy of security investment in the industry is also a core factor. Crypto projects generally prioritize marketing over security, and audit reports often become ineffective quickly after on-chain upgrades. The lazy filtering logic of "looking at audits, checking TVL, comparing APY" has completely collapsed.

Haseeb Qureshi, a partner at Dragonfly, offers another perspective: in 2026, the annualized amount stolen in DeFi is about $1.89 billion, lower than in 2025, with an increase in the number of attacks but a faster decline in the scale of each attack—attackers are increasingly turning to small protocols and abandoned projects because large protocols have completed more fortifications. This precisely indicates that the threat has not diminished; rather, defense resources are highly uneven: leading institutions have the capital to build defenses, while long-tail projects are left exposed.

The uneven distribution of defense resources is only one side; the other side's adversaries do not operate according to the cost structure of startups, but rather as state machinery in the form of North Korean hackers.

According to Chainalysis statistics, North Korean-linked hackers stole about $2.02 billion in 2025, with a cumulative total of about $6.75 billion over the years. This is not a disorganized group but a system of operations with a national budget, patience, and planning on a monthly basis—the UN expert group's report explicitly links crypto theft to funding for North Korea's ballistic missile and nuclear weapons development. When the attackers are state actors and the defenders are startups, the nature of this war has changed.

Moreover, new standards are creating new attack surfaces. In the Binance case, attackers exploited the EIP-7702 account abstraction authorization mechanism, allowing hot wallets to delegate execution logic to malicious contracts—every step forward in innovation expands the attack surface.

**The areas that need to be reinforced are increasing, while the windows for reinforcement often only appear after incidents occur.**

### **III.** The Industry Re-discusses "Security"

Binance's preliminary investigation report on November 3 revealed its internal issues, detailing the specific methods hackers used to carry out social engineering attacks. The report also disclosed that since 2026, Binance's security team has detected and prevented 57 suspected cyber threats related to North Korea, with methods ranging from fake recruitment and malware disguised as popular development tools to tampered software packages and fake video conferencing applications.

Industry discussions quickly shifted from "who did it" to another question: after an employee is deceived and a computer is compromised, what other defenses can prevent the loss from expanding? The same inquiry applies to other cases this month—Ledger's distributors, Polymarket's third-party scripts, and the batch of DNS hijacking on October 31, with entry points not within their own systems.

Yang Haipo, founder of CoinEx, attributed it to three avoidable mistakes: insufficient isolation between development and operational environments, lack of second-level verification in production operations, and failure to independently verify signing participants. His sharpest remark was that if all parties only trust upstream requests, "even if a multi-signature architecture is adopted, it may behave no differently from a single signature"—**these measures do not require complex technology; what is lacking is discipline.** YQ, founder of AltLayer, shares a similar judgment: these types of attacks have exceeded the coverage of smart contract audits, and defenders must understand the complete workflow between employee terminals, internal tools, and production clusters.

However, simplifying the incident to "a few basic mistakes" is equally dangerous. Yuan Xian, founder of Slow Mist, cautioned that only after an attack can one see how intelligence gathering, evasion of malicious code, exploitation of trust chains, lateral poisoning, and risk control circumvention combine; this is an APT process. "What appears to be rough tactics can still lead to serious consequences in the right target and work scenario." Luis, co-founder of BitsLab, was more direct: a lock screen cannot stop back-end malware implanted on devices; the cost of offense and defense is already asymmetric, and AI will continue to amplify this asymmetry.

The two factions actually agree on the conclusion: security can no longer be delivered by the audit report before going live. Gu Ronghui stated that the industry is no longer facing "how to prevent a single vulnerability from being exploited," but rather a protective system that covers the entire asset lifecycle. Even if a certain link is breached, losses must be controlled locally. Yu Jianing pointed out that a management model focused on pre-deployment audits is no longer adequate; continuous assessment, real-time monitoring, and emergency response need to be incorporated into regular governance.

One layer further out is the only part that can be considered good news from this round of incidents. On October 31, the FBI attributed the attack to North Korea's TraderTraitor operation, and in conjunction with the Secret Service and the Criminal Investigation Division of the IRS, announced hundreds of involved addresses, calling on THORChain node operators, instant exchange platforms, DeFi protocols, and blockchain analysis companies to intercept related transactions; issuers like Tether and Circle collectively froze about $3 billion. When one exchange encounters an issue, the entire industry's clearing and issuance processes are mobilized within hours.

However, collaboration changes the distribution of losses after they occur, not the probability of losses happening. CertiK reported that in the first half of the year, the total amount of funds frozen or returned across the industry was $115 million, accounting for 8.8% of the $1.316 billion in losses; Binance's recovery rate this time was astonishingly high because the stolen assets were mainly stablecoins, while Bitcoin and Ethereum without issuers were still held by the attackers, who had about $2.4 billion.

### Conclusion

From smart contract vulnerabilities to employee device compromises, from third-party service provider breaches to AI-assisted penetration, from governance attacks to the long-term layout of North Korean hacker organizations, the crypto industry is undergoing a profound change in attack patterns.

AI has further reduced the cost of attack preparation, while specialized attack organizations have continuously increased the scale and persistence of attacks. Meanwhile, the long-standing insufficient security investment by project parties has created more opportunities for these attacks.

A project's withdrawals may be promptly suspended, an abnormal transaction may be frozen by the stablecoin issuer, and an attack may only result in user data breaches and internal system permission compromises. But these events all signify that almost all crypto projects have lost control over their security boundaries.

Blockchain can ensure that transaction records are immutable, but it cannot guarantee that the person initiating the transaction has not been deceived, nor can it ensure that the keys used to sign transactions have not been stolen. When attackers begin to bypass code and directly target people and organizations, the crypto industry needs to re-understand what true security is.

If the most important innovation in the crypto industry over the past decade was establishing a value transfer system that does not require trust in third parties, then in the next decade, the industry must answer another question: how to truly protect users' assets and trust in an environment filled with untrustworthy participants?