99.17% of assets are in cold wallets—and yet the $6.3 billion hack was still a wake-up call
The $6.3 billion theft happened less than ten days ago, and South Korea’s Financial Services Commission has already called local exchanges and cybersecurity agencies together for an emergency meeting
🔍 进群聊行情
The first public demand after the meeting was for exchanges to keep increasing the share of assets held in cold wallets
The problem is, South Korean law already requires at least 80%
One leading platform is already at 99.17%, another at 94.76%, and a third at 85%
There’s less than one percentage point of room left to go 🦖
What’s really making regulators nervous isn’t that cold wallets aren’t cold enough—it’s three other things
IT access permissions, withdrawal approvals and signing procedures, and administrator accounts
All three were compromised in the $6.3 billion hack
India, meanwhile, has provided harder evidence
On Wednesday, India’s Computer Emergency Response Team gave the attackers a distinct name: CRAFTY FALCON
It also explicitly named crypto exchanges as an affected industry
The statement said the threat remains active and reports of successful attacks continue to come in
These include financial and fintech companies that had already received restrictive warnings and made changes ⚠️
In other words, the patches were applied, but the door was still pushed open
In October, a CrowdStrike report said the attackers used the AI penetration-testing tool ARTEX
Alongside Claude Code and other models, they broke into multiple South Korean financial institutions and stole data
Now look at South Korea’s central bank
It is conducting a stress survey of 31 financial institutions
One scenario in the questionnaire asks what would happen if the exchange with the largest market share in the country suspended operations after a major hacking incident
The other two scenarios are a prolonged slump in trading after a sharp drop in coin prices, and another institution suffering huge losses in a crypto incident
Taken together, the three scenarios show that regulators are really worried about cascading effects, not the losses of a single platform 💥
My take is simple
The cold-wallet ratio is a static line of defense; its only purpose is to keep private keys offline
But attackers target people. Employees’ computers, third-party vendors, and administrator privileges are the real entry points
Raising the cold-wallet ratio from 99.17% to 99.9% still won’t stop a phishing email disguised as a meeting invitation
Two things are worth watching next
Will South Korea make access permissions and signing procedures mandatory inspection items, instead of focusing only on cold-wallet ratios?
Will the CRAFTY FALCON attack list in India continue to expand to more platforms across Asia? 👀
What do you think exchanges most need to shore up: cold wallets, permissions, or people?
Tap the profile picture to watch the livestream
Every day, I’ll keep you up to date on crypto security and regulatory developments—not just what’s happening, but the logic and opportunities behind it 👀🚀
The $6.3 billion theft happened less than ten days ago, and South Korea’s Financial Services Commission has already called local exchanges and cybersecurity agencies together for an emergency meeting
🔍 进群聊行情
The first public demand after the meeting was for exchanges to keep increasing the share of assets held in cold wallets
The problem is, South Korean law already requires at least 80%
One leading platform is already at 99.17%, another at 94.76%, and a third at 85%
There’s less than one percentage point of room left to go 🦖
What’s really making regulators nervous isn’t that cold wallets aren’t cold enough—it’s three other things
IT access permissions, withdrawal approvals and signing procedures, and administrator accounts
All three were compromised in the $6.3 billion hack
India, meanwhile, has provided harder evidence
On Wednesday, India’s Computer Emergency Response Team gave the attackers a distinct name: CRAFTY FALCON
It also explicitly named crypto exchanges as an affected industry
The statement said the threat remains active and reports of successful attacks continue to come in
These include financial and fintech companies that had already received restrictive warnings and made changes ⚠️
In other words, the patches were applied, but the door was still pushed open
In October, a CrowdStrike report said the attackers used the AI penetration-testing tool ARTEX
Alongside Claude Code and other models, they broke into multiple South Korean financial institutions and stole data
Now look at South Korea’s central bank
It is conducting a stress survey of 31 financial institutions
One scenario in the questionnaire asks what would happen if the exchange with the largest market share in the country suspended operations after a major hacking incident
The other two scenarios are a prolonged slump in trading after a sharp drop in coin prices, and another institution suffering huge losses in a crypto incident
Taken together, the three scenarios show that regulators are really worried about cascading effects, not the losses of a single platform 💥
My take is simple
The cold-wallet ratio is a static line of defense; its only purpose is to keep private keys offline
But attackers target people. Employees’ computers, third-party vendors, and administrator privileges are the real entry points
Raising the cold-wallet ratio from 99.17% to 99.9% still won’t stop a phishing email disguised as a meeting invitation
Two things are worth watching next
Will South Korea make access permissions and signing procedures mandatory inspection items, instead of focusing only on cold-wallet ratios?
Will the CRAFTY FALCON attack list in India continue to expand to more platforms across Asia? 👀
What do you think exchanges most need to shore up: cold wallets, permissions, or people?
Tap the profile picture to watch the livestream
Every day, I’ll keep you up to date on crypto security and regulatory developments—not just what’s happening, but the logic and opportunities behind it 👀🚀
