#两地址约12.8亿枚USDT遭冻结
Binance’s $6 billion heist has now, without a doubt, become the largest theft by value ever recorded in human history!
The incident was apparently caused by hackers breaking into an engineer’s laptop, gaining authorized access to the server, and directly submitting a withdrawal command. In just two years, three leading CEXs—Bybit, Bitget, and Binance—have all been breached one after another. I don’t think this is a coincidence. The underlying cause is basically the same: this is a fundamental weakness of centralized exchanges.
Many major companies are now adopting zero-trust security architectures, claiming to “never trust, always verify.” But engineers need elevated privileges to maintain and test systems. Hackers can attack employees’ devices and crack through every layer—even bastion hosts with multiple approval steps. That makes all identity-based authentication mechanisms virtually useless.
In fact, CEXs wear the decentralized clothing of Web3, but at their core, they are the most centralized kind of Web2 internet company. To let users deposit and withdraw funds in seconds, their systems have to be highly automated. If every withdrawal required a dozen executives to sign with hardware wallets, the user experience would be ruined, and everyone would leave for DEXs.
So hot wallets have to stay online, APIs have to remain open, and automated fund-sweeping programs have to run 24/7. This means that if hackers find an API privilege-escalation vulnerability on the internal network or forge a withdrawal command, they can drain all the funds!
Thankfully, Tether and Circle helped freeze the funds on-chain in an emergency. Although this recovered most of the losses, it treats the symptom, not the cause. As long as custody and trading aren’t separated, and people remain the trust hubs within automated systems, hot wallets will always be the industry’s biggest pain point!
Binance has set an example by announcing that it will fully cover the losses. That’s the responsibility and accountability of the world’s largest exchange—worthy of praise 👍. As the saying goes, if your own wallet gets hacked, the money is really gone; if you get hacked on an exchange, you can still be fully reimbursed 🤣. I believe in Binance’s capabilities and technology, and hope they can make their security a perfect 100.
Follow me so you don’t lose your way, and join my Binance group chat 👇
Binance’s $6 billion heist has now, without a doubt, become the largest theft by value ever recorded in human history!
The incident was apparently caused by hackers breaking into an engineer’s laptop, gaining authorized access to the server, and directly submitting a withdrawal command. In just two years, three leading CEXs—Bybit, Bitget, and Binance—have all been breached one after another. I don’t think this is a coincidence. The underlying cause is basically the same: this is a fundamental weakness of centralized exchanges.
Many major companies are now adopting zero-trust security architectures, claiming to “never trust, always verify.” But engineers need elevated privileges to maintain and test systems. Hackers can attack employees’ devices and crack through every layer—even bastion hosts with multiple approval steps. That makes all identity-based authentication mechanisms virtually useless.
In fact, CEXs wear the decentralized clothing of Web3, but at their core, they are the most centralized kind of Web2 internet company. To let users deposit and withdraw funds in seconds, their systems have to be highly automated. If every withdrawal required a dozen executives to sign with hardware wallets, the user experience would be ruined, and everyone would leave for DEXs.
So hot wallets have to stay online, APIs have to remain open, and automated fund-sweeping programs have to run 24/7. This means that if hackers find an API privilege-escalation vulnerability on the internal network or forge a withdrawal command, they can drain all the funds!
Thankfully, Tether and Circle helped freeze the funds on-chain in an emergency. Although this recovered most of the losses, it treats the symptom, not the cause. As long as custody and trading aren’t separated, and people remain the trust hubs within automated systems, hot wallets will always be the industry’s biggest pain point!
Binance has set an example by announcing that it will fully cover the losses. That’s the responsibility and accountability of the world’s largest exchange—worthy of praise 👍. As the saying goes, if your own wallet gets hacked, the money is really gone; if you get hacked on an exchange, you can still be fully reimbursed 🤣. I believe in Binance’s capabilities and technology, and hope they can make their security a perfect 100.
Follow me so you don’t lose your way, and join my Binance group chat 👇