加密无畏

The world has entered an era of asymmetric warfare, both in the physical world and the cyber world.

A drone costing a few hundred dollars takes a missile costing a few million dollars to defend against—and can also destroy fighter jets, warships, oil refineries, warehouses, and more, each worth hundreds of millions of dollars.....

The North Korean hacking incident once again confirms that AI will intensify the threat of “asymmetric warfare.” Any employee or individual can use AI to gain an almost cheat-code level of destructive power. In the age of AI, the fury of an ordinary person could be even more terrifying.

Seven years ago, when I joined Huobi, the first thing we were told in security training for new hires at the exchange was:

Any software you download onto your company-issued computer should be assumed to be a virus by default! Any software!

I was curious, so I asked, “Does that include WeChat and office software like Microsoft Office that I download onto my computer? What if I need to download them for work?”

The security colleague said, “Yes. In principle, you’re not allowed to install any software yourself on your work computer, including WeChat and office software. And in theory, these programs really could collect and leak your work data.

If you really need them for work, you can only download them from the official app store. It’s best to ask a colleague from the security team to check them before you install or download them.”

CZ is about to give a talk at the “Binance Life” book club in Oxford, UK.

This is the second “Binance Life” book club event, following the one in Hong Kong. It’s also CZ’s first in-person public appearance since Binance was hacked, so he’ll probably share lots of details about the incident.

Thanks to the “Binance Life” book club for the invitation. The events have made it all the way to Europe—I’d really love to visit Oxford. I’m setting a little goal for myself: hopefully I can fly over and attend the third “Binance Life” book club in person.

The fact that Binance has released these preliminary investigation findings shows that it has truly made a firm resolve.

There’s no exaggeration in calling the entire $6.3 billion theft highly complex:

An employee was targeted through a fake job interview and social engineering; malicious code was tampered with and used to breach the system; attackers moved laterally across the internal network into internal AI tools; gained access to wallet-related permissions; took control of internal signing services; and ultimately stole $6.34 billion in one fell swoop.

It’s easy to understand why Binance made a firm resolve to publish this report:

It proactively disclosed obvious gaps in its own risk controls and security. The attack began with a fake job recruitment process: one employee was compromised through social engineering, and the attackers then moved laterally to breach three key employees, successfully stealing a huge amount of hot-wallet assets.

Ultimately, hackers are the common enemy of the crypto industry. As Binance has advocated, the industry can improve security by learning together. Increasing investment in AI security and prevention can also effectively mitigate the threat from hackers.

Who exactly made an abnormal withdrawal of $106 million just yesterday, then another abnormal withdrawal of $27 million today?

They’ve also kept hiding their identity and refused to admit their losses, causing them to miss the window to freeze the funds.

How many other institutions have been hacked or experienced abnormal activity but are still hiding it and afraid to speak up? grok

From mining to the ICO boom, then DeFi Summer, followed by the NFT/GameFi/L2 craze, and finally the meme frenzy.

What explosive new sector will break into the mainstream and bring even more people in? Tokenization? AI trading?

Has crypto reached a peak where things have gone so far that they’re bound to swing in the opposite direction? grok

Musk has gone all in once again! In this election cycle, he has already poured nearly $500 million into opposing the Democrats and supporting the Republicans (Trump).

The key point is that if Musk bets and loses, the Democrats could retaliate and launch a criminal investigation against him.

Trump has publicly said that if the Democrats target Musk, he would be willing to pardon him in advance if necessary.

Even Musk can’t avoid the risk of backing the wrong side. For AI tech companies and the entire crypto industry, the midterm elections could mean the risk of regulatory policy changes.

In an interview yesterday, Trump was asked: If the Democrats regain control of the House after the midterm elections and begin investigating Musk and his companies, even trying to hold him criminally liable, would Trump pardon him in advance?

Trump said the Democrats’ threats might just be talk, but if they actually took action, he would have to step in to protect them. Trump also hinted that if the Democrats continued their investigations, he might pardon his own aides and other people around him in advance.

Is it true that during a major “withdrawal suspension” in OKX’s history, users were unable to withdraw funds for 41 days due to force majeure, grok?

North Korea has spoken! It denies organizing a hacking group that stole $6.3 billion from Binance—and also denies being behind last year’s Bybit hack.

This has become completely politicized; it’s no longer just a blame game or a war of words. Kim Jong Un’s sister, Kim Yo Jong, called it a serious political provocation.

This is the first time North Korea has publicly responded to long-standing international accusations of hacking. It even turned the tables, hinting that the United States is the real mastermind.

When the sums involved reach this scale, reason and even the law are of little use. What matters is access to political protection. The only guarantee of funds’ safety is being within missile range.

After the midterm election results came out, many people went from mocking and questioning Sun Yuchen to understanding and even admiring him.

Another exchange has been hacked! Brazil’s largest exchange, Mercado Bitcoin, was attacked, with around $40 million (including approximately 106 BTC) suspected to have flowed out across more than 10 chains.

The crypto industry is facing a wave of hacks—is it nearing a tipping point? Both the number of thefts and the amounts stolen have hit new highs.

European entity loses $106 million; could be a market maker or fund

On-chain investigator ZachXBT reported that an EU-based entity may have lost more than $106 million from multiple centralized exchange accounts on November 1. The allegedly stolen funds were withdrawn by the perpetrators in USDC and USDT.

Although ZachXBT did not name the entity, an institution holding hundreds of millions of dollars’ worth of USDC/USDT across multiple CEXs is most likely a market maker, quantitative or proprietary trading firm, or the trading account of a large OTC broker or fund.

Whale users generally rarely split their holdings across so many accounts. Banks, licensed payment companies, pure custodians, and regulated entities also typically do not open accounts or hold assets this way.

Traditional finance, such as banking, is actually more anxious than crypto about the arrival of the quantum era

At today’s Hong Kong FinTech Week panel on AI, tokenization and quantum computing, moderated by Norman Chan, the consensus was that quantum computing could one day threaten the encryption technologies widely used to protect customer data and transactions.

Hong Kong Monetary Authority Chief Executive Eddie Yue asked the guests: Looking back from 2030, what is one thing financial institutions should have done sooner?

HSBC CEO Georges said that quantum computers could easily break the vast majority of current cryptographic methods. The migration window is around 3–5 years, so post-quantum cryptography (PQC) should be rolled out starting today.

Denis, Deputy Governor of the Banque de France, said the risks of quantum computing are already here. Institutions should take stock of their cryptographic use cases as soon as possible, develop a strategy for migrating to PQC, and remain agile.

Tommaso from the BIS said people used to think that being quantum-resistant meant making the math harder, and that implementation would take two or three years. AI is now solving those hard problems too. The key is to keep upgrading the quantum-resistant approach and stay agile.

That same day, the HKMA and HKUST, together with industry partners, launched a PQC toolkit providing the banking sector with governance, assessment and crypto-agility frameworks to support its transition to post-quantum cryptography in the quantum era.

We now know that the quantum threat day (Q-Day) that Sun Yuchen justinsuntron is worried about is urgent in terms of timing and could arrive within two years.

There is also another concern of Sun Yuchen’s: the inefficiency caused by the crypto industry’s decentralized consensus, which makes upgrades slow. Even with clear knowledge that a disaster could strike in two years, all there is are response narratives, roadmaps, drafts and individual testnets.

The industry simply lacks the kind of organizational capacity found in traditional finance, where governments, industry, companies and universities can develop plans in advance—and even use targets to compel migration.

Has Grok Bot usage returned to normal? Grok

Help, why are there so many promotional posts on my timeline about making my first $10,000 with Grok Bot (on Polymarket)?

We’ve found out why Musk enabled Alipay top-ups for Grok Bot!

Recently, like many Grok Bot users, Wuwei has experienced usage being consumed faster and quickly hitting the limit.

Today, Musk admitted that Grok Bot’s service costs are far higher than its revenue.

Just a couple of days ago, Grok Bot also started accepting Alipay in China. There’s good reason to suspect that Grok Bot enabled Alipay top-ups and then immediately adjusted the usage limits and raised prices—that this was what they had planned all along.

With China’s position not yet publicly clarified, Musk has tentatively opened up Alipay subscriptions to boost Grok Bot’s revenue.

An in-stock B300 server with 8 GPUs in Shenzhen is now being quoted at over 16 million yuan, while the market price for a comparable Nvidia system is around 4 million yuan

Even with such a high premium, reportedly only tens of thousands of B300s make their way into China each year through various channels

Then the news says that a supercomputing center by Elon Musk’s SpaceX, which is about to be completed, will be equipped with 860,000 Nvidia B300 GPUs

Over the past two days, several well-known bloggers who focus on filming planes taking off and landing at Shenzhen Bao'an International Airport and sharing plane-spotting locations have said they will not post any more Shenzhen-related videos before November 22.

Netizens speculate that this may be related to APEC. During that period, the planes carrying leaders from various countries and the aircraft accompanying their teams will all take off and land here.

China: Resolutely crack down on corruption involving the internet, virtual currencies, cross-border funds, blockchain, and other means

Imagine this: Could crypto exchanges and public blockchains launch an alliance for exchanging hacker-freezing quotas, similar to a carbon-credit emissions allowance system?

For example, native tokens like TRX, Solana, BNB, and SUI can’t be frozen because of their decentralized nature and blockchain design.

Actually, they can all be frozen; nobody just dares to make the first move. SUI did this once before and got heavily criticized by the community. Validators coordinated to refuse to include the hacker’s address in blocks, then later voted to move back around 162 million—and froze it too.

The next time a theft happens, the approach could be more heavy-handed: except for BTC, each chain or issuer could freeze not only tokens and stablecoins issued on its own chain, but also its native token.

Freezing quotas could be tracked and exchanged within the alliance, or even sold to smaller exchanges and project teams.